1 /*
2 * security/ccsecurity/internal.h
3 *
4 * Copyright (C) 2005-2012 NTT DATA CORPORATION
5 *
6 * Version: 1.8.11 2024/07/15
7 */
8
9 #ifndef _SECURITY_CCSECURITY_INTERNAL_H
10 #define _SECURITY_CCSECURITY_INTERNAL_H
11
12 #include <linux/version.h>
13 #include <linux/types.h>
14 #include <linux/kernel.h>
15 #include <linux/string.h>
16 #include <linux/mm.h>
17 #include <linux/utime.h>
18 #include <linux/file.h>
19 #if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 38)
20 #include <linux/smp_lock.h>
21 #endif
22 #include <linux/module.h>
23 #include <linux/init.h>
24 #include <linux/slab.h>
25 #include <linux/highmem.h>
26 #include <linux/poll.h>
27 #include <linux/binfmts.h>
28 #include <linux/delay.h>
29 #include <linux/sched.h>
30 #include <linux/dcache.h>
31 #include <linux/mount.h>
32 #include <linux/net.h>
33 #include <linux/inet.h>
34 #include <linux/in.h>
35 #include <linux/in6.h>
36 #include <linux/un.h>
37 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 5, 0)
38 #include <linux/fs.h>
39 #endif
40 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 5, 0)
41 #include <linux/namei.h>
42 #endif
43 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 30)
44 #include <linux/fs_struct.h>
45 #endif
46 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 20)
47 #include <linux/namespace.h>
48 #endif
49 #include <linux/proc_fs.h>
50 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0) || defined(RHEL_MAJOR)
51 #include <linux/hash.h>
52 #endif
53 #if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18) || (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 33) && defined(CONFIG_SYSCTL_SYSCALL))
54 #include <linux/sysctl.h>
55 #endif
56 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 6)
57 #include <linux/kthread.h>
58 #endif
59 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0)
60 #include <linux/magic.h>
61 #endif
62 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 10, 0)
63 #include <linux/uaccess.h>
64 #else
65 #include <asm/uaccess.h>
66 #endif
67 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
68 #include <linux/sched/signal.h>
69 #endif
70 #include <net/sock.h>
71 #include <net/af_unix.h>
72 #include <net/ip.h>
73 #include <net/ipv6.h>
74 #include <net/udp.h>
75 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0) || (defined(RHEL_MAJOR) && RHEL_MAJOR >= 8 && defined(RHEL_MINOR) && RHEL_MINOR >= 4)
76 #include <uapi/linux/mount.h>
77 #endif
78
79 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 5, 0)
80 #define sk_family family
81 #define sk_protocol protocol
82 #define sk_type type
83 #endif
84
85 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 20)
86
87 /* Structure for holding "struct vfsmount *" and "struct dentry *". */
88 struct path {
89 struct vfsmount *mnt;
90 struct dentry *dentry;
91 };
92
93 #endif
94
95 #ifndef __printf
96 #define __printf(a,b) __attribute__((format(printf,a,b)))
97 #endif
98 #ifndef __packed
99 #define __packed __attribute__((__packed__))
100 #endif
101 #ifndef bool
102 #define bool _Bool
103 #endif
104 #ifndef false
105 #define false 0
106 #endif
107 #ifndef true
108 #define true 1
109 #endif
110
111 #ifndef __user
112 #define __user
113 #endif
114
115 #ifndef fallthrough
116 #define fallthrough do {} while (0)
117 #endif
118
119 #ifndef current_uid
120 #define current_uid() (current->uid)
121 #endif
122 #ifndef current_gid
123 #define current_gid() (current->gid)
124 #endif
125 #ifndef current_euid
126 #define current_euid() (current->euid)
127 #endif
128 #ifndef current_egid
129 #define current_egid() (current->egid)
130 #endif
131 #ifndef current_suid
132 #define current_suid() (current->suid)
133 #endif
134 #ifndef current_sgid
135 #define current_sgid() (current->sgid)
136 #endif
137 #ifndef current_fsuid
138 #define current_fsuid() (current->fsuid)
139 #endif
140 #ifndef current_fsgid
141 #define current_fsgid() (current->fsgid)
142 #endif
143
144 #ifndef DEFINE_SPINLOCK
145 #define DEFINE_SPINLOCK(x) spinlock_t x = SPIN_LOCK_UNLOCKED
146 #endif
147
148 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 16)
149 #define mutex semaphore
150 #define mutex_init(mutex) init_MUTEX(mutex)
151 #define mutex_unlock(mutex) up(mutex)
152 #define mutex_lock(mutex) down(mutex)
153 #define mutex_lock_interruptible(mutex) down_interruptible(mutex)
154 #define mutex_trylock(mutex) (!down_trylock(mutex))
155 #define DEFINE_MUTEX(mutexname) DECLARE_MUTEX(mutexname)
156 #endif
157
158 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 15)
159 #define MS_UNBINDABLE (1<<17) /* change to unbindable */
160 #define MS_PRIVATE (1<<18) /* change to private */
161 #define MS_SLAVE (1<<19) /* change to slave */
162 #define MS_SHARED (1<<20) /* change to shared */
163 #endif
164
165 #ifndef container_of
166 #define container_of(ptr, type, member) ({ \
167 const typeof(((type *)0)->member) *__mptr = (ptr); \
168 (type *)((char *)__mptr - offsetof(type, member)); })
169 #endif
170
171 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0)
172 #define smp_read_barrier_depends smp_rmb
173 #endif
174
175 #ifndef ACCESS_ONCE
176 #define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
177 #endif
178
179 #ifndef rcu_dereference
180 #define rcu_dereference(p) ({ \
181 typeof(p) _________p1 = ACCESS_ONCE(p); \
182 smp_read_barrier_depends(); /* see RCU */ \
183 (_________p1); \
184 })
185 #endif
186
187 #ifndef rcu_assign_pointer
188 #define rcu_assign_pointer(p, v) \
189 ({ \
190 if (!__builtin_constant_p(v) || \
191 ((v) != NULL)) \
192 smp_wmb(); /* see RCU */ \
193 (p) = (v); \
194 })
195 #endif
196
197 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0)
198 #define f_vfsmnt f_path.mnt
199 #endif
200
201 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 14)
202
203 /**
204 * kzalloc() - Allocate memory. The memory is set to zero.
205 *
206 * @size: Size to allocate.
207 * @flags: GFP flags.
208 *
209 * Returns pointer to allocated memory on success, NULL otherwise.
210 *
211 * This is for compatibility with older kernels.
212 *
213 * Since several distributions backported kzalloc(), I define it as a macro
214 * rather than an inlined function in order to avoid multiple definition error.
215 */
216 #define kzalloc(size, flags) ({ \
217 void *ret = kmalloc((size), (flags)); \
218 if (ret) \
219 memset(ret, 0, (size)); \
220 ret; })
221
222 #endif
223
224 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 25)
225
226 /**
227 * path_put - Drop reference on "struct path".
228 *
229 * @path: Pointer to "struct path".
230 *
231 * Returns nothing.
232 *
233 * This is for compatibility with older kernels.
234 */
235 static inline void path_put(struct path *path)
236 {
237 dput(path->dentry);
238 mntput(path->mnt);
239 }
240
241 #endif
242
243 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 5, 0)
244
245 /**
246 * __list_add_rcu - Insert a new entry between two known consecutive entries.
247 *
248 * @new: Pointer to "struct list_head".
249 * @prev: Pointer to "struct list_head".
250 * @next: Pointer to "struct list_head".
251 *
252 * Returns nothing.
253 *
254 * This is for compatibility with older kernels.
255 */
256 static inline void __list_add_rcu(struct list_head *new,
257 struct list_head *prev,
258 struct list_head *next)
259 {
260 new->next = next;
261 new->prev = prev;
262 rcu_assign_pointer(prev->next, new);
263 next->prev = new;
264 }
265
266 /**
267 * list_add_tail_rcu - Add a new entry to rcu-protected list.
268 *
269 * @new: Pointer to "struct list_head".
270 * @head: Pointer to "struct list_head".
271 *
272 * Returns nothing.
273 *
274 * This is for compatibility with older kernels.
275 */
276 static inline void list_add_tail_rcu(struct list_head *new,
277 struct list_head *head)
278 {
279 __list_add_rcu(new, head->prev, head);
280 }
281
282 /**
283 * list_add_rcu - Add a new entry to rcu-protected list.
284 *
285 * @new: Pointer to "struct list_head".
286 * @head: Pointer to "struct list_head".
287 *
288 * Returns nothing.
289 *
290 * This is for compatibility with older kernels.
291 */
292 static inline void list_add_rcu(struct list_head *new, struct list_head *head)
293 {
294 __list_add_rcu(new, head, head->next);
295 }
296
297 #endif
298
299 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 38)
300
301 /**
302 * __list_del_entry - Deletes entry from list without re-initialization.
303 *
304 * @entry: Pointer to "struct list_head".
305 *
306 * Returns nothing.
307 *
308 * This is for compatibility with older kernels.
309 */
310 static inline void __list_del_entry(struct list_head *entry)
311 {
312 __list_del(entry->prev, entry->next);
313 }
314
315 #endif
316
317 #ifndef list_for_each_entry_safe
318
319 /**
320 * list_for_each_entry_safe - Iterate over list of given type safe against removal of list entry.
321 *
322 * @pos: The "type *" to use as a loop cursor.
323 * @n: Another "type *" to use as temporary storage.
324 * @head: Pointer to "struct list_head".
325 * @member: The name of the list_struct within the struct.
326 *
327 * This is for compatibility with older kernels.
328 */
329 #define list_for_each_entry_safe(pos, n, head, member) \
330 for (pos = list_entry((head)->next, typeof(*pos), member), \
331 n = list_entry(pos->member.next, typeof(*pos), member); \
332 &pos->member != (head); \
333 pos = n, n = list_entry(n->member.next, typeof(*n), member))
334
335 #endif
336
337 #ifndef srcu_dereference
338
339 /**
340 * srcu_dereference - Fetch SRCU-protected pointer with checking.
341 *
342 * @p: The pointer to read, prior to dereferencing.
343 * @ss: Pointer to "struct srcu_struct".
344 *
345 * Returns @p.
346 *
347 * This is for compatibility with older kernels.
348 */
349 #define srcu_dereference(p, ss) rcu_dereference(p)
350
351 #endif
352
353 #ifndef list_for_each_entry_srcu
354
355 /**
356 * list_for_each_entry_srcu - Iterate over rcu list of given type.
357 *
358 * @pos: The type * to use as a loop cursor.
359 * @head: The head for your list.
360 * @member: The name of the list_struct within the struct.
361 * @ss: Pointer to "struct srcu_struct".
362 *
363 * As of 2.6.36, this macro is not provided because only TOMOYO wants it.
364 */
365 #define list_for_each_entry_srcu(pos, head, member, ss) \
366 for (pos = list_entry(srcu_dereference((head)->next, ss), \
367 typeof(*pos), member); \
368 prefetch(pos->member.next), &pos->member != (head); \
369 pos = list_entry(srcu_dereference(pos->member.next, ss), \
370 typeof(*pos), member))
371
372 #endif
373
374 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 30) || (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 5, 0) && LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 9))
375
376 #if LINUX_VERSION_CODE == KERNEL_VERSION(2, 4, 21)
377 #undef ssleep
378 #endif
379
380 #ifndef ssleep
381
382 /**
383 * ssleep - Sleep for specified seconds.
384 *
385 * @secs: Seconds to sleep.
386 *
387 * Returns nothing.
388 *
389 * This is for compatibility with older kernels.
390 *
391 * Since several distributions backported ssleep(), I define it as a macro
392 * rather than an inlined function in order to avoid multiple definition error.
393 */
394 #define ssleep(secs) { \
395 set_current_state(TASK_UNINTERRUPTIBLE); \
396 schedule_timeout((HZ * secs) + 1); \
397 }
398
399 #endif
400
401 #endif
402
403 #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 5, 0)
404
405 /**
406 * from_kuid - Convert kuid_t to uid_t.
407 *
408 * @ns: Unused.
409 * @uid: kuid_t value.
410 *
411 * Returns uid seen from init's user namespace.
412 */
413 #define from_kuid(ns, uid) (uid)
414
415 /**
416 * from_kgid - Convert kgid_t to gid_t.
417 *
418 * @ns: Unused.
419 * @gid: kgid_t value.
420 *
421 * Returns gid seen from init's user namespace.
422 */
423 #define from_kgid(ns, gid) (gid)
424
425 /**
426 * uid_eq - Check whether the uids are equals or not.
427 *
428 * @left: Uid seen from current user namespace.
429 * @right: Uid seen from current user namespace.
430 *
431 * Returns true if uid is root in init's user namespace, false otherwise.
432 */
433 #define uid_eq(left, right) ((left) == (right))
434 #define GLOBAL_ROOT_UID 0
435
436 #endif
437
438 #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 0, 0)
439 #define d_backing_inode(upper) (upper)->d_inode
440 #endif
441 #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0)
442 #define d_is_dir(dentry) ({ struct inode *inode = d_backing_inode(dentry); \
443 inode && S_ISDIR(inode->i_mode); })
444 #endif
445
446 /*
447 * TOMOYO specific part start.
448 */
449
450 #include <linux/ccsecurity.h>
451
452 /* Enumeration definition for internal use. */
453
454 /* Index numbers for Access Controls. */
455 enum ccs_acl_entry_type_index {
456 CCS_TYPE_PATH_ACL,
457 CCS_TYPE_PATH2_ACL,
458 CCS_TYPE_PATH_NUMBER_ACL,
459 CCS_TYPE_MKDEV_ACL,
460 CCS_TYPE_MOUNT_ACL,
461 #ifdef CONFIG_CCSECURITY_MISC
462 CCS_TYPE_ENV_ACL,
463 #endif
464 #ifdef CONFIG_CCSECURITY_CAPABILITY
465 CCS_TYPE_CAPABILITY_ACL,
466 #endif
467 #ifdef CONFIG_CCSECURITY_NETWORK
468 CCS_TYPE_INET_ACL,
469 CCS_TYPE_UNIX_ACL,
470 #endif
471 #ifdef CONFIG_CCSECURITY_IPC
472 CCS_TYPE_SIGNAL_ACL,
473 #endif
474 #ifdef CONFIG_CCSECURITY_TASK_EXECUTE_HANDLER
475 CCS_TYPE_AUTO_EXECUTE_HANDLER,
476 CCS_TYPE_DENIED_EXECUTE_HANDLER,
477 #endif
478 #ifdef CONFIG_CCSECURITY_TASK_DOMAIN_TRANSITION
479 CCS_TYPE_AUTO_TASK_ACL,
480 CCS_TYPE_MANUAL_TASK_ACL,
481 #endif
482 };
483
484 /* Index numbers for "struct ccs_condition". */
485 enum ccs_conditions_index {
486 CCS_TASK_UID, /* current_uid() */
487 CCS_TASK_EUID, /* current_euid() */
488 CCS_TASK_SUID, /* current_suid() */
489 CCS_TASK_FSUID, /* current_fsuid() */
490 CCS_TASK_GID, /* current_gid() */
491 CCS_TASK_EGID, /* current_egid() */
492 CCS_TASK_SGID, /* current_sgid() */
493 CCS_TASK_FSGID, /* current_fsgid() */
494 CCS_TASK_PID, /* sys_getpid() */
495 CCS_TASK_PPID, /* sys_getppid() */
496 CCS_EXEC_ARGC, /* "struct linux_binprm *"->argc */
497 CCS_EXEC_ENVC, /* "struct linux_binprm *"->envc */
498 CCS_TYPE_IS_SOCKET, /* S_IFSOCK */
499 CCS_TYPE_IS_SYMLINK, /* S_IFLNK */
500 CCS_TYPE_IS_FILE, /* S_IFREG */
501 CCS_TYPE_IS_BLOCK_DEV, /* S_IFBLK */
502 CCS_TYPE_IS_DIRECTORY, /* S_IFDIR */
503 CCS_TYPE_IS_CHAR_DEV, /* S_IFCHR */
504 CCS_TYPE_IS_FIFO, /* S_IFIFO */
505 CCS_MODE_SETUID, /* S_ISUID */
506 CCS_MODE_SETGID, /* S_ISGID */
507 CCS_MODE_STICKY, /* S_ISVTX */
508 CCS_MODE_OWNER_READ, /* S_IRUSR */
509 CCS_MODE_OWNER_WRITE, /* S_IWUSR */
510 CCS_MODE_OWNER_EXECUTE, /* S_IXUSR */
511 CCS_MODE_GROUP_READ, /* S_IRGRP */
512 CCS_MODE_GROUP_WRITE, /* S_IWGRP */
513 CCS_MODE_GROUP_EXECUTE, /* S_IXGRP */
514 CCS_MODE_OTHERS_READ, /* S_IROTH */
515 CCS_MODE_OTHERS_WRITE, /* S_IWOTH */
516 CCS_MODE_OTHERS_EXECUTE, /* S_IXOTH */
517 CCS_TASK_TYPE, /* ((u8) task->ccs_flags) &
518 CCS_TASK_IS_EXECUTE_HANDLER */
519 CCS_TASK_EXECUTE_HANDLER, /* CCS_TASK_IS_EXECUTE_HANDLER */
520 CCS_EXEC_REALPATH,
521 CCS_SYMLINK_TARGET,
522 CCS_PATH1_UID,
523 CCS_PATH1_GID,
524 CCS_PATH1_INO,
525 CCS_PATH1_MAJOR,
526 CCS_PATH1_MINOR,
527 CCS_PATH1_PERM,
528 CCS_PATH1_TYPE,
529 CCS_PATH1_DEV_MAJOR,
530 CCS_PATH1_DEV_MINOR,
531 CCS_PATH2_UID,
532 CCS_PATH2_GID,
533 CCS_PATH2_INO,
534 CCS_PATH2_MAJOR,
535 CCS_PATH2_MINOR,
536 CCS_PATH2_PERM,
537 CCS_PATH2_TYPE,
538 CCS_PATH2_DEV_MAJOR,
539 CCS_PATH2_DEV_MINOR,
540 CCS_PATH1_PARENT_UID,
541 CCS_PATH1_PARENT_GID,
542 CCS_PATH1_PARENT_INO,
543 CCS_PATH1_PARENT_PERM,
544 CCS_PATH2_PARENT_UID,
545 CCS_PATH2_PARENT_GID,
546 CCS_PATH2_PARENT_INO,
547 CCS_PATH2_PARENT_PERM,
548 CCS_MAX_CONDITION_KEYWORD,
549 CCS_NUMBER_UNION,
550 CCS_NAME_UNION,
551 CCS_ARGV_ENTRY,
552 CCS_ENVP_ENTRY,
553 };
554
555 /* Index numbers for domain's attributes. */
556 enum ccs_domain_info_flags_index {
557 /* Quota warnning flag. */
558 CCS_DIF_QUOTA_WARNED,
559 /*
560 * This domain was unable to create a new domain at
561 * ccs_find_next_domain() because the name of the domain to be created
562 * was too long or it could not allocate memory.
563 * More than one process continued execve() without domain transition.
564 */
565 CCS_DIF_TRANSITION_FAILED,
566 CCS_MAX_DOMAIN_INFO_FLAGS
567 };
568
569 /* Index numbers for audit type. */
570 enum ccs_grant_log {
571 /* Follow profile's configuration. */
572 CCS_GRANTLOG_AUTO,
573 /* Do not generate grant log. */
574 CCS_GRANTLOG_NO,
575 /* Generate grant_log. */
576 CCS_GRANTLOG_YES,
577 };
578
579 /* Index numbers for group entries. */
580 enum ccs_group_id {
581 CCS_PATH_GROUP,
582 CCS_NUMBER_GROUP,
583 #ifdef CONFIG_CCSECURITY_NETWORK
584 CCS_ADDRESS_GROUP,
585 #endif
586 CCS_MAX_GROUP
587 };
588
589 /* Index numbers for category of functionality. */
590 enum ccs_mac_category_index {
591 CCS_MAC_CATEGORY_FILE,
592 #ifdef CONFIG_CCSECURITY_NETWORK
593 CCS_MAC_CATEGORY_NETWORK,
594 #endif
595 #ifdef CONFIG_CCSECURITY_MISC
596 CCS_MAC_CATEGORY_MISC,
597 #endif
598 #ifdef CONFIG_CCSECURITY_IPC
599 CCS_MAC_CATEGORY_IPC,
600 #endif
601 #ifdef CONFIG_CCSECURITY_CAPABILITY
602 CCS_MAC_CATEGORY_CAPABILITY,
603 #endif
604 CCS_MAX_MAC_CATEGORY_INDEX
605 };
606
607 /* Index numbers for functionality. */
608 enum ccs_mac_index {
609 CCS_MAC_FILE_EXECUTE,
610 CCS_MAC_FILE_OPEN,
611 CCS_MAC_FILE_CREATE,
612 CCS_MAC_FILE_UNLINK,
613 #ifdef CONFIG_CCSECURITY_FILE_GETATTR
614 CCS_MAC_FILE_GETATTR,
615 #endif
616 CCS_MAC_FILE_MKDIR,
617 CCS_MAC_FILE_RMDIR,
618 CCS_MAC_FILE_MKFIFO,
619 CCS_MAC_FILE_MKSOCK,
620 CCS_MAC_FILE_TRUNCATE,
621 CCS_MAC_FILE_SYMLINK,
622 CCS_MAC_FILE_MKBLOCK,
623 CCS_MAC_FILE_MKCHAR,
624 CCS_MAC_FILE_LINK,
625 CCS_MAC_FILE_RENAME,
626 CCS_MAC_FILE_CHMOD,
627 CCS_MAC_FILE_CHOWN,
628 CCS_MAC_FILE_CHGRP,
629 CCS_MAC_FILE_IOCTL,
630 CCS_MAC_FILE_CHROOT,
631 CCS_MAC_FILE_MOUNT,
632 CCS_MAC_FILE_UMOUNT,
633 CCS_MAC_FILE_PIVOT_ROOT,
634 #ifdef CONFIG_CCSECURITY_NETWORK
635 CCS_MAC_NETWORK_INET_STREAM_BIND,
636 CCS_MAC_NETWORK_INET_STREAM_LISTEN,
637 CCS_MAC_NETWORK_INET_STREAM_CONNECT,
638 CCS_MAC_NETWORK_INET_STREAM_ACCEPT,
639 CCS_MAC_NETWORK_INET_DGRAM_BIND,
640 CCS_MAC_NETWORK_INET_DGRAM_SEND,
641 #ifdef CONFIG_CCSECURITY_NETWORK_RECVMSG
642 CCS_MAC_NETWORK_INET_DGRAM_RECV,
643 #endif
644 CCS_MAC_NETWORK_INET_RAW_BIND,
645 CCS_MAC_NETWORK_INET_RAW_SEND,
646 #ifdef CONFIG_CCSECURITY_NETWORK_RECVMSG
647 CCS_MAC_NETWORK_INET_RAW_RECV,
648 #endif
649 CCS_MAC_NETWORK_UNIX_STREAM_BIND,
650 CCS_MAC_NETWORK_UNIX_STREAM_LISTEN,
651 CCS_MAC_NETWORK_UNIX_STREAM_CONNECT,
652 CCS_MAC_NETWORK_UNIX_STREAM_ACCEPT,
653 CCS_MAC_NETWORK_UNIX_DGRAM_BIND,
654 CCS_MAC_NETWORK_UNIX_DGRAM_SEND,
655 #ifdef CONFIG_CCSECURITY_NETWORK_RECVMSG
656 CCS_MAC_NETWORK_UNIX_DGRAM_RECV,
657 #endif
658 CCS_MAC_NETWORK_UNIX_SEQPACKET_BIND,
659 CCS_MAC_NETWORK_UNIX_SEQPACKET_LISTEN,
660 CCS_MAC_NETWORK_UNIX_SEQPACKET_CONNECT,
661 CCS_MAC_NETWORK_UNIX_SEQPACKET_ACCEPT,
662 #endif
663 #ifdef CONFIG_CCSECURITY_MISC
664 CCS_MAC_ENVIRON,
665 #endif
666 #ifdef CONFIG_CCSECURITY_IPC
667 CCS_MAC_SIGNAL,
668 #endif
669 #ifdef CONFIG_CCSECURITY_CAPABILITY
670 CCS_MAC_CAPABILITY_USE_ROUTE_SOCKET,
671 CCS_MAC_CAPABILITY_USE_PACKET_SOCKET,
672 CCS_MAC_CAPABILITY_SYS_REBOOT,
673 CCS_MAC_CAPABILITY_SYS_VHANGUP,
674 CCS_MAC_CAPABILITY_SYS_SETTIME,
675 CCS_MAC_CAPABILITY_SYS_NICE,
676 CCS_MAC_CAPABILITY_SYS_SETHOSTNAME,
677 CCS_MAC_CAPABILITY_USE_KERNEL_MODULE,
678 CCS_MAC_CAPABILITY_SYS_KEXEC_LOAD,
679 CCS_MAC_CAPABILITY_SYS_PTRACE,
680 #endif
681 CCS_MAX_MAC_INDEX
682 };
683
684 /* Index numbers for /proc/ccs/stat interface. */
685 enum ccs_memory_stat_type {
686 CCS_MEMORY_POLICY,
687 CCS_MEMORY_AUDIT,
688 CCS_MEMORY_QUERY,
689 CCS_MAX_MEMORY_STAT
690 };
691
692 /* Index numbers for access controls with one pathname and three numbers. */
693 enum ccs_mkdev_acl_index {
694 CCS_TYPE_MKBLOCK,
695 CCS_TYPE_MKCHAR,
696 CCS_MAX_MKDEV_OPERATION
697 };
698
699 /* Index numbers for operation mode. */
700 enum ccs_mode_value {
701 CCS_CONFIG_DISABLED,
702 CCS_CONFIG_LEARNING,
703 CCS_CONFIG_PERMISSIVE,
704 CCS_CONFIG_ENFORCING,
705 CCS_CONFIG_MAX_MODE,
706 CCS_CONFIG_WANT_REJECT_LOG = 64,
707 CCS_CONFIG_WANT_GRANT_LOG = 128,
708 CCS_CONFIG_USE_DEFAULT = 255,
709 };
710
711 /* Index numbers for socket operations. */
712 enum ccs_network_acl_index {
713 CCS_NETWORK_BIND, /* bind() operation. */
714 CCS_NETWORK_LISTEN, /* listen() operation. */
715 CCS_NETWORK_CONNECT, /* connect() operation. */
716 CCS_NETWORK_ACCEPT, /* accept() operation. */
717 CCS_NETWORK_SEND, /* send() operation. */
718 #ifdef CONFIG_CCSECURITY_NETWORK_RECVMSG
719 CCS_NETWORK_RECV, /* recv() operation. */
720 #endif
721 CCS_MAX_NETWORK_OPERATION
722 };
723
724 /* Index numbers for access controls with two pathnames. */
725 enum ccs_path2_acl_index {
726 CCS_TYPE_LINK,
727 CCS_TYPE_RENAME,
728 CCS_TYPE_PIVOT_ROOT,
729 CCS_MAX_PATH2_OPERATION
730 };
731
732 /* Index numbers for access controls with one pathname. */
733 enum ccs_path_acl_index {
734 CCS_TYPE_EXECUTE,
735 CCS_TYPE_READ,
736 CCS_TYPE_WRITE,
737 CCS_TYPE_APPEND,
738 CCS_TYPE_UNLINK,
739 #ifdef CONFIG_CCSECURITY_FILE_GETATTR
740 CCS_TYPE_GETATTR,
741 #endif
742 CCS_TYPE_RMDIR,
743 CCS_TYPE_TRUNCATE,
744 CCS_TYPE_SYMLINK,
745 CCS_TYPE_CHROOT,
746 CCS_TYPE_UMOUNT,
747 CCS_MAX_PATH_OPERATION
748 };
749
750 /* Index numbers for access controls with one pathname and one number. */
751 enum ccs_path_number_acl_index {
752 CCS_TYPE_CREATE,
753 CCS_TYPE_MKDIR,
754 CCS_TYPE_MKFIFO,
755 CCS_TYPE_MKSOCK,
756 CCS_TYPE_IOCTL,
757 CCS_TYPE_CHMOD,
758 CCS_TYPE_CHOWN,
759 CCS_TYPE_CHGRP,
760 CCS_MAX_PATH_NUMBER_OPERATION
761 };
762
763 /* Index numbers for stat(). */
764 enum ccs_path_stat_index {
765 /* Do not change this order. */
766 CCS_PATH1,
767 CCS_PATH1_PARENT,
768 CCS_PATH2,
769 CCS_PATH2_PARENT,
770 CCS_MAX_PATH_STAT
771 };
772
773 /* Index numbers for entry type. */
774 enum ccs_policy_id {
775 #ifdef CONFIG_CCSECURITY_PORTRESERVE
776 CCS_ID_RESERVEDPORT,
777 #endif
778 CCS_ID_GROUP,
779 #ifdef CONFIG_CCSECURITY_NETWORK
780 CCS_ID_ADDRESS_GROUP,
781 #endif
782 CCS_ID_PATH_GROUP,
783 CCS_ID_NUMBER_GROUP,
784 CCS_ID_AGGREGATOR,
785 CCS_ID_TRANSITION_CONTROL,
786 CCS_ID_MANAGER,
787 CCS_ID_CONDITION,
788 CCS_ID_NAME,
789 CCS_ID_ACL,
790 CCS_ID_DOMAIN,
791 CCS_MAX_POLICY
792 };
793
794 /* Index numbers for /proc/ccs/stat interface. */
795 enum ccs_policy_stat_type {
796 /* Do not change this order. */
797 CCS_STAT_POLICY_UPDATES,
798 CCS_STAT_POLICY_LEARNING, /* == CCS_CONFIG_LEARNING */
799 CCS_STAT_POLICY_PERMISSIVE, /* == CCS_CONFIG_PERMISSIVE */
800 CCS_STAT_POLICY_ENFORCING, /* == CCS_CONFIG_ENFORCING */
801 CCS_MAX_POLICY_STAT
802 };
803
804 /* Index numbers for profile's PREFERENCE values. */
805 enum ccs_pref_index {
806 CCS_PREF_MAX_AUDIT_LOG,
807 CCS_PREF_MAX_LEARNING_ENTRY,
808 CCS_PREF_ENFORCING_PENALTY,
809 CCS_MAX_PREF
810 };
811
812 /* Index numbers for /proc/ccs/ interfaces. */
813 enum ccs_proc_interface_index {
814 CCS_DOMAIN_POLICY,
815 CCS_EXCEPTION_POLICY,
816 CCS_PROCESS_STATUS,
817 CCS_STAT,
818 CCS_AUDIT,
819 CCS_VERSION,
820 CCS_PROFILE,
821 CCS_QUERY,
822 CCS_MANAGER,
823 #ifdef CONFIG_CCSECURITY_TASK_EXECUTE_HANDLER
824 CCS_EXECUTE_HANDLER,
825 #endif
826 };
827
828 /* Index numbers for special mount operations. */
829 enum ccs_special_mount {
830 CCS_MOUNT_BIND, /* mount --bind /source /dest */
831 CCS_MOUNT_MOVE, /* mount --move /old /new */
832 CCS_MOUNT_REMOUNT, /* mount -o remount /dir */
833 CCS_MOUNT_MAKE_UNBINDABLE, /* mount --make-unbindable /dir */
834 CCS_MOUNT_MAKE_PRIVATE, /* mount --make-private /dir */
835 CCS_MOUNT_MAKE_SLAVE, /* mount --make-slave /dir */
836 CCS_MOUNT_MAKE_SHARED, /* mount --make-shared /dir */
837 CCS_MAX_SPECIAL_MOUNT
838 };
839
840 /* Index numbers for domain transition control keywords. */
841 enum ccs_transition_type {
842 /* Do not change this order, */
843 CCS_TRANSITION_CONTROL_NO_RESET,
844 CCS_TRANSITION_CONTROL_RESET,
845 CCS_TRANSITION_CONTROL_NO_INITIALIZE,
846 CCS_TRANSITION_CONTROL_INITIALIZE,
847 CCS_TRANSITION_CONTROL_NO_KEEP,
848 CCS_TRANSITION_CONTROL_KEEP,
849 CCS_MAX_TRANSITION_TYPE
850 };
851
852 /* Index numbers for type of numeric values. */
853 enum ccs_value_type {
854 CCS_VALUE_TYPE_INVALID,
855 CCS_VALUE_TYPE_DECIMAL,
856 CCS_VALUE_TYPE_OCTAL,
857 CCS_VALUE_TYPE_HEXADECIMAL,
858 };
859
860 /* Constants definition for internal use. */
861
862 /*
863 * TOMOYO uses this hash only when appending a string into the string table.
864 * Frequency of appending strings is very low. So we don't need large (e.g.
865 * 64k) hash size. 256 will be sufficient.
866 */
867 #define CCS_HASH_BITS 8
868 #define CCS_MAX_HASH (1u << CCS_HASH_BITS)
869
870 /*
871 * TOMOYO checks only SOCK_STREAM, SOCK_DGRAM, SOCK_RAW, SOCK_SEQPACKET.
872 * Therefore, we don't need SOCK_MAX.
873 */
874 #define CCS_SOCK_MAX 6
875
876 /* Size of temporary buffer for execve() operation. */
877 #define CCS_EXEC_TMPSIZE 4096
878
879 /* Garbage collector is trying to kfree() this element. */
880 #define CCS_GC_IN_PROGRESS -1
881
882 /* Profile number is an integer between 0 and 255. */
883 #define CCS_MAX_PROFILES 256
884
885 /* Group number is an integer between 0 and 255. */
886 #define CCS_MAX_ACL_GROUPS 256
887
888 /* Current thread is doing open(O_RDONLY | O_TRUNC) ? */
889 #define CCS_OPEN_FOR_READ_TRUNCATE 1
890 /* Current thread is doing open(3) ? */
891 #define CCS_OPEN_FOR_IOCTL_ONLY 2
892 /* Current thread is doing do_execve() ? */
893 #define CCS_TASK_IS_IN_EXECVE 4
894 /* Current thread is running as an execute handler program? */
895 #define CCS_TASK_IS_EXECUTE_HANDLER 8
896 /* Current thread is allowed to modify policy via /proc/ccs/ interface? */
897 #define CCS_TASK_IS_MANAGER 16
898
899 /*
900 * Retry this request. Returned by ccs_supervisor() if policy violation has
901 * occurred in enforcing mode and the userspace daemon decided to retry.
902 *
903 * We must choose a positive value in order to distinguish "granted" (which is
904 * 0) and "rejected" (which is a negative value) and "retry".
905 */
906 #define CCS_RETRY_REQUEST 1
907
908 /* The gfp flags used by TOMOYO. */
909 #define CCS_GFP_FLAGS GFP_NOFS
910
911 /* Size of read buffer for /proc/ccs/ interface. */
912 #define CCS_MAX_IO_READ_QUEUE 64
913
914 /* Structure definition for internal use. */
915
916 /* Common header for holding ACL entries. */
917 struct ccs_acl_head {
918 struct list_head list;
919 s8 is_deleted; /* true or false or CCS_GC_IN_PROGRESS */
920 } __packed;
921
922 /* Common header for shared entries. */
923 struct ccs_shared_acl_head {
924 struct list_head list;
925 atomic_t users;
926 } __packed;
927
928 /* Common header for individual entries. */
929 struct ccs_acl_info {
930 struct list_head list;
931 struct ccs_condition *cond; /* Maybe NULL. */
932 s8 is_deleted; /* true or false or CCS_GC_IN_PROGRESS */
933 u8 type; /* One of values in "enum ccs_acl_entry_type_index". */
934 u16 perm;
935 } __packed;
936
937 /* Structure for holding a word. */
938 struct ccs_name_union {
939 /* Either @filename or @group is NULL. */
940 const struct ccs_path_info *filename;
941 struct ccs_group *group;
942 };
943
944 /* Structure for holding a number. */
945 struct ccs_number_union {
946 unsigned long values[2];
947 struct ccs_group *group; /* Maybe NULL. */
948 /* One of values in "enum ccs_value_type". */
949 u8 value_type[2];
950 };
951
952 /* Structure for holding an IP address. */
953 struct ccs_ipaddr_union {
954 struct in6_addr ip[2]; /* Big endian. */
955 struct ccs_group *group; /* Pointer to address group. */
956 bool is_ipv6; /* Valid only if @group == NULL. */
957 };
958
959 /* Structure for "path_group"/"number_group"/"address_group" directive. */
960 struct ccs_group {
961 struct ccs_shared_acl_head head;
962 /* Name of group (without leading '@'). */
963 const struct ccs_path_info *group_name;
964 /*
965 * List of "struct ccs_path_group" or "struct ccs_number_group" or
966 * "struct ccs_address_group".
967 */
968 struct list_head member_list;
969 };
970
971 /* Structure for "path_group" directive. */
972 struct ccs_path_group {
973 struct ccs_acl_head head;
974 const struct ccs_path_info *member_name;
975 };
976
977 /* Structure for "number_group" directive. */
978 struct ccs_number_group {
979 struct ccs_acl_head head;
980 struct ccs_number_union number;
981 };
982
983 /* Structure for "address_group" directive. */
984 struct ccs_address_group {
985 struct ccs_acl_head head;
986 /* Structure for holding an IP address. */
987 struct ccs_ipaddr_union address;
988 };
989
990 /* Subset of "struct stat". Used by conditional ACL and audit logs. */
991 struct ccs_mini_stat {
992 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 5, 0)
993 kuid_t uid;
994 kgid_t gid;
995 #else
996 uid_t uid;
997 gid_t gid;
998 #endif
999 ino_t ino;
1000 umode_t mode;
1001 dev_t dev;
1002 dev_t rdev;
1003 };
1004
1005 /* Structure for dumping argv[] and envp[] of "struct linux_binprm". */
1006 struct ccs_page_dump {
1007 struct page *page; /* Previously dumped page. */
1008 char *data; /* Contents of "page". Size is PAGE_SIZE. */
1009 };
1010
1011 /* Structure for attribute checks in addition to pathname checks. */
1012 struct ccs_obj_info {
1013 /* True if ccs_get_attributes() was already called, false otherwise. */
1014 bool validate_done;
1015 /* True if @stat[] is valid. */
1016 bool stat_valid[CCS_MAX_PATH_STAT];
1017 /* First pathname. Initialized with { NULL, NULL } if no path. */
1018 struct path path1;
1019 /* Second pathname. Initialized with { NULL, NULL } if no path. */
1020 struct path path2;
1021 /*
1022 * Information on @path1, @path1's parent directory, @path2, @path2's
1023 * parent directory.
1024 */
1025 struct ccs_mini_stat stat[CCS_MAX_PATH_STAT];
1026 /*
1027 * Content of symbolic link to be created. NULL for operations other
1028 * than symlink().
1029 */
1030 struct ccs_path_info *symlink_target;
1031 };
1032
1033 /* Structure for entries which follows "struct ccs_condition". */
1034 struct ccs_condition_element {
1035 /*
1036 * Left hand operand. A "struct ccs_argv" for CCS_ARGV_ENTRY, a
1037 * "struct ccs_envp" for CCS_ENVP_ENTRY is attached to the tail
1038 * of the array of this struct.
1039 */
1040 u8 left;
1041 /*
1042 * Right hand operand. A "struct ccs_number_union" for
1043 * CCS_NUMBER_UNION, a "struct ccs_name_union" for CCS_NAME_UNION is
1044 * attached to the tail of the array of this struct.
1045 */
1046 u8 right;
1047 /* Equation operator. True if equals or overlaps, false otherwise. */
1048 bool equals;
1049 };
1050
1051 /* Structure for optional arguments. */
1052 struct ccs_condition {
1053 struct ccs_shared_acl_head head;
1054 u32 size; /* Memory size allocated for this entry. */
1055 u16 condc; /* Number of conditions in this struct. */
1056 u16 numbers_count; /* Number of "struct ccs_number_union values". */
1057 u16 names_count; /* Number of "struct ccs_name_union names". */
1058 u16 argc; /* Number of "struct ccs_argv". */
1059 u16 envc; /* Number of "struct ccs_envp". */
1060 u8 grant_log; /* One of values in "enum ccs_grant_log". */
1061 bool exec_transit; /* True if transit is for "file execute". */
1062 const struct ccs_path_info *transit; /* Maybe NULL. */
1063 /*
1064 * struct ccs_condition_element condition[condc];
1065 * struct ccs_number_union values[numbers_count];
1066 * struct ccs_name_union names[names_count];
1067 * struct ccs_argv argv[argc];
1068 * struct ccs_envp envp[envc];
1069 */
1070 };
1071
1072 struct ccs_execve;
1073 struct ccs_policy_namespace;
1074
1075 /* Structure for request info. */
1076 struct ccs_request_info {
1077 /*
1078 * For holding parameters specific to operations which deal files.
1079 * NULL if not dealing files.
1080 */
1081 struct ccs_obj_info *obj;
1082 /*
1083 * For holding parameters specific to execve() request.
1084 * NULL if not dealing do_execve().
1085 */
1086 struct ccs_execve *ee;
1087 /*
1088 * For holding parameters.
1089 * Pointers in this union are not NULL except path->matched_path.
1090 */
1091 union {
1092 struct {
1093 const struct ccs_path_info *filename;
1094 /*
1095 * For using wildcards at ccs_find_next_domain().
1096 *
1097 * The matched_acl cannot be used because it may refer
1098 * a "struct ccs_path_acl" with ->is_group == true.
1099 * We want to use exact "struct ccs_path_info" rather
1100 * than "struct ccs_path_acl".
1101 */
1102 const struct ccs_path_info *matched_path;
1103 /* One of values in "enum ccs_path_acl_index". */
1104 u8 operation;
1105 } path;
1106 struct {
1107 const struct ccs_path_info *filename1;
1108 const struct ccs_path_info *filename2;
1109 /* One of values in "enum ccs_path2_acl_index". */
1110 u8 operation;
1111 } path2;
1112 struct {
1113 const struct ccs_path_info *filename;
1114 unsigned int mode;
1115 unsigned int major;
1116 unsigned int minor;
1117 /* One of values in "enum ccs_mkdev_acl_index". */
1118 u8 operation;
1119 } mkdev;
1120 struct {
1121 const struct ccs_path_info *filename;
1122 unsigned long number;
1123 /*
1124 * One of values in "enum ccs_path_number_acl_index".
1125 */
1126 u8 operation;
1127 } path_number;
1128 #ifdef CONFIG_CCSECURITY_NETWORK
1129 struct {
1130 const u32 *address; /* Big endian. */
1131 u16 port; /* Host endian. */
1132 /* One of values smaller than CCS_SOCK_MAX. */
1133 u8 protocol;
1134 /* One of values in "enum ccs_network_acl_index". */
1135 u8 operation;
1136 bool is_ipv6;
1137 } inet_network;
1138 struct {
1139 const struct ccs_path_info *address;
1140 /* One of values smaller than CCS_SOCK_MAX. */
1141 u8 protocol;
1142 /* One of values in "enum ccs_network_acl_index". */
1143 u8 operation;
1144 } unix_network;
1145 #endif
1146 #ifdef CONFIG_CCSECURITY_MISC
1147 struct {
1148 const struct ccs_path_info *name;
1149 } environ;
1150 #endif
1151 #ifdef CONFIG_CCSECURITY_CAPABILITY
1152 struct {
1153 /* One of values in "enum ccs_capability_acl_index". */
1154 u8 operation;
1155 } capability;
1156 #endif
1157 #ifdef CONFIG_CCSECURITY_IPC
1158 struct {
1159 const char *dest_pattern;
1160 int sig;
1161 } signal;
1162 #endif
1163 struct {
1164 const struct ccs_path_info *type;
1165 const struct ccs_path_info *dir;
1166 const struct ccs_path_info *dev;
1167 unsigned long flags;
1168 int need_dev;
1169 } mount;
1170 #ifdef CONFIG_CCSECURITY_TASK_DOMAIN_TRANSITION
1171 struct {
1172 const struct ccs_path_info *domainname;
1173 } task;
1174 #endif
1175 } param;
1176 /*
1177 * For updating current->ccs_domain_info at ccs_update_task_domain().
1178 * Initialized to NULL at ccs_init_request_info().
1179 * Matching "struct ccs_acl_info" is copied if access request was
1180 * granted. Re-initialized to NULL at ccs_update_task_domain().
1181 */
1182 struct ccs_acl_info *matched_acl;
1183 u8 param_type; /* One of values in "enum ccs_acl_entry_type_index". */
1184 bool granted; /* True if granted, false otherwise. */
1185 /* True if current thread should not be carried sleep penalty. */
1186 bool dont_sleep_on_enforce_error;
1187 /*
1188 * For counting number of retries made for this request.
1189 * This counter is incremented whenever ccs_supervisor() returned
1190 * CCS_RETRY_REQUEST.
1191 */
1192 u8 retry;
1193 /*
1194 * For holding profile number used for this request.
1195 * One of values between 0 and CCS_MAX_PROFILES - 1.
1196 */
1197 u8 profile;
1198 /*
1199 * For holding operation mode used for this request.
1200 * One of CCS_CONFIG_DISABLED, CCS_CONFIG_LEARNING,
1201 * CCS_CONFIG_PERMISSIVE, CCS_CONFIG_ENFORCING.
1202 */
1203 u8 mode;
1204 /*
1205 * For holding operation index used for this request.
1206 * Used by ccs_init_request_info() / ccs_get_mode() /
1207 * ccs_write_log(). One of values in "enum ccs_mac_index".
1208 */
1209 u8 type;
1210 };
1211
1212 /* Structure for holding a token. */
1213 struct ccs_path_info {
1214 const char *name;
1215 u32 hash; /* = full_name_hash(name, strlen(name)) */
1216 u16 total_len; /* = strlen(name) */
1217 u16 const_len; /* = ccs_const_part_length(name) */
1218 bool is_dir; /* = ccs_strendswith(name, "/") */
1219 bool is_patterned; /* = const_len < total_len */
1220 };
1221
1222 /* Structure for execve() operation. */
1223 struct ccs_execve {
1224 struct ccs_request_info r;
1225 struct ccs_obj_info obj;
1226 struct linux_binprm *bprm;
1227 struct ccs_domain_info *previous_domain;
1228 const struct ccs_path_info *transition;
1229 /* For execute_handler */
1230 const struct ccs_path_info *handler;
1231 char *handler_path; /* = kstrdup(handler->name, CCS_GFP_FLAGS) */
1232 /* For dumping argv[] and envp[]. */
1233 struct ccs_page_dump dump;
1234 /* For temporary use. */
1235 char *tmp; /* Size is CCS_EXEC_TMPSIZE bytes */
1236 };
1237
1238 /* Structure for domain information. */
1239 struct ccs_domain_info {
1240 struct list_head list;
1241 struct list_head acl_info_list;
1242 /* Name of this domain. Never NULL. */
1243 const struct ccs_path_info *domainname;
1244 /* Namespace for this domain. Never NULL. */
1245 struct ccs_policy_namespace *ns;
1246 /* Group numbers to use. */
1247 unsigned long group[CCS_MAX_ACL_GROUPS / BITS_PER_LONG];
1248 u8 profile; /* Profile number to use. */
1249 bool is_deleted; /* Delete flag. */
1250 bool flags[CCS_MAX_DOMAIN_INFO_FLAGS];
1251 };
1252
1253 /*
1254 * Structure for "reset_domain"/"no_reset_domain"/"initialize_domain"/
1255 * "no_initialize_domain"/"keep_domain"/"no_keep_domain" keyword.
1256 */
1257 struct ccs_transition_control {
1258 struct ccs_acl_head head;
1259 u8 type; /* One of values in "enum ccs_transition_type" */
1260 bool is_last_name; /* True if the domainname is ccs_last_word(). */
1261 const struct ccs_path_info *domainname; /* Maybe NULL */
1262 const struct ccs_path_info *program; /* Maybe NULL */
1263 };
1264
1265 /* Structure for "aggregator" keyword. */
1266 struct ccs_aggregator {
1267 struct ccs_acl_head head;
1268 const struct ccs_path_info *original_name;
1269 const struct ccs_path_info *aggregated_name;
1270 };
1271
1272 /* Structure for "deny_autobind" keyword. */
1273 struct ccs_reserved {
1274 struct ccs_acl_head head;
1275 struct ccs_number_union port;
1276 };
1277
1278 /* Structure for policy manager. */
1279 struct ccs_manager {
1280 struct ccs_acl_head head;
1281 /* A path to program or a domainname. */
1282 const struct ccs_path_info *manager;
1283 };
1284
1285 /* Structure for argv[]. */
1286 struct ccs_argv {
1287 unsigned long index;
1288 const struct ccs_path_info *value;
1289 bool is_not;
1290 };
1291
1292 /* Structure for envp[]. */
1293 struct ccs_envp {
1294 const struct ccs_path_info *name;
1295 const struct ccs_path_info *value;
1296 bool is_not;
1297 };
1298
1299 /*
1300 * Structure for "task auto_execute_handler" and "task denied_execute_handler"
1301 * directive.
1302 *
1303 * If "task auto_execute_handler" directive exists and the current process is
1304 * not an execute handler, all execve() requests are replaced by execve()
1305 * requests of a program specified by "task auto_execute_handler" directive.
1306 * If the current process is an execute handler, "task auto_execute_handler"
1307 * and "task denied_execute_handler" directives are ignored.
1308 * The program specified by "task execute_handler" validates execve()
1309 * parameters and executes the original execve() requests if appropriate.
1310 *
1311 * "task denied_execute_handler" directive is used only when execve() request
1312 * was rejected in enforcing mode (i.e. CONFIG::file::execute={ mode=enforcing
1313 * }). The program specified by "task denied_execute_handler" does whatever it
1314 * wants to do (e.g. silently terminate, change firewall settings, redirect the
1315 * user to honey pot etc.).
1316 */
1317 struct ccs_handler_acl {
1318 struct ccs_acl_info head; /* type = CCS_TYPE_*_EXECUTE_HANDLER */
1319 const struct ccs_path_info *handler; /* Pointer to single pathname. */
1320 };
1321
1322 /*
1323 * Structure for "task auto_domain_transition" and
1324 * "task manual_domain_transition" directive.
1325 */
1326 struct ccs_task_acl {
1327 struct ccs_acl_info head; /* type = CCS_TYPE_*_TASK_ACL */
1328 /* Pointer to domainname. */
1329 const struct ccs_path_info *domainname;
1330 };
1331
1332 /*
1333 * Structure for "file execute", "file read", "file write", "file append",
1334 * "file unlink", "file getattr", "file rmdir", "file truncate",
1335 * "file symlink", "file chroot" and "file unmount" directive.
1336 */
1337 struct ccs_path_acl {
1338 struct ccs_acl_info head; /* type = CCS_TYPE_PATH_ACL */
1339 struct ccs_name_union name;
1340 };
1341
1342 /*
1343 * Structure for "file rename", "file link" and "file pivot_root" directive.
1344 */
1345 struct ccs_path2_acl {
1346 struct ccs_acl_info head; /* type = CCS_TYPE_PATH2_ACL */
1347 struct ccs_name_union name1;
1348 struct ccs_name_union name2;
1349 };
1350
1351 /*
1352 * Structure for "file create", "file mkdir", "file mkfifo", "file mksock",
1353 * "file ioctl", "file chmod", "file chown" and "file chgrp" directive.
1354 */
1355 struct ccs_path_number_acl {
1356 struct ccs_acl_info head; /* type = CCS_TYPE_PATH_NUMBER_ACL */
1357 struct ccs_name_union name;
1358 struct ccs_number_union number;
1359 };
1360
1361 /* Structure for "file mkblock" and "file mkchar" directive. */
1362 struct ccs_mkdev_acl {
1363 struct ccs_acl_info head; /* type = CCS_TYPE_MKDEV_ACL */
1364 struct ccs_name_union name;
1365 struct ccs_number_union mode;
1366 struct ccs_number_union major;
1367 struct ccs_number_union minor;
1368 };
1369
1370 /* Structure for "file mount" directive. */
1371 struct ccs_mount_acl {
1372 struct ccs_acl_info head; /* type = CCS_TYPE_MOUNT_ACL */
1373 struct ccs_name_union dev_name;
1374 struct ccs_name_union dir_name;
1375 struct ccs_name_union fs_type;
1376 struct ccs_number_union flags;
1377 };
1378
1379 /* Structure for "misc env" directive in domain policy. */
1380 struct ccs_env_acl {
1381 struct ccs_acl_info head; /* type = CCS_TYPE_ENV_ACL */
1382 const struct ccs_path_info *env; /* environment variable */
1383 };
1384
1385 /* Structure for "capability" directive. */
1386 struct ccs_capability_acl {
1387 struct ccs_acl_info head; /* type = CCS_TYPE_CAPABILITY_ACL */
1388 u8 operation; /* One of values in "enum ccs_capability_acl_index". */
1389 };
1390
1391 /* Structure for "ipc signal" directive. */
1392 struct ccs_signal_acl {
1393 struct ccs_acl_info head; /* type = CCS_TYPE_SIGNAL_ACL */
1394 struct ccs_number_union sig;
1395 /* Pointer to destination pattern. */
1396 const struct ccs_path_info *domainname;
1397 };
1398
1399 /* Structure for "network inet" directive. */
1400 struct ccs_inet_acl {
1401 struct ccs_acl_info head; /* type = CCS_TYPE_INET_ACL */
1402 u8 protocol;
1403 struct ccs_ipaddr_union address;
1404 struct ccs_number_union port;
1405 };
1406
1407 /* Structure for "network unix" directive. */
1408 struct ccs_unix_acl {
1409 struct ccs_acl_info head; /* type = CCS_TYPE_UNIX_ACL */
1410 u8 protocol;
1411 struct ccs_name_union name;
1412 };
1413
1414 /* Structure for holding string data. */
1415 struct ccs_name {
1416 struct ccs_shared_acl_head head;
1417 int size; /* Memory size allocated for this entry. */
1418 struct ccs_path_info entry;
1419 };
1420
1421 /* Structure for holding a line from /proc/ccs/ interface. */
1422 struct ccs_acl_param {
1423 char *data; /* Unprocessed data. */
1424 struct list_head *list; /* List to add or remove. */
1425 struct ccs_policy_namespace *ns; /* Namespace to use. */
1426 bool is_delete; /* True if it is a delete request. */
1427 union ccs_acl_union {
1428 struct ccs_acl_info acl_info;
1429 struct ccs_handler_acl handler_acl;
1430 struct ccs_task_acl task_acl;
1431 struct ccs_path_acl path_acl;
1432 struct ccs_path2_acl path2_acl;
1433 struct ccs_path_number_acl path_number_acl;
1434 struct ccs_mkdev_acl mkdev_acl;
1435 struct ccs_mount_acl mount_acl;
1436 struct ccs_env_acl env_acl;
1437 struct ccs_capability_acl capability_acl;
1438 struct ccs_signal_acl signal_acl;
1439 struct ccs_inet_acl inet_acl;
1440 struct ccs_unix_acl unix_acl;
1441 /**/
1442 struct ccs_acl_head acl_head;
1443 struct ccs_transition_control transition_control;
1444 struct ccs_aggregator aggregator;
1445 struct ccs_reserved reserved;
1446 struct ccs_manager manager;
1447 struct ccs_path_group path_group;
1448 struct ccs_number_group number_group;
1449 struct ccs_address_group address_group;
1450 } e;
1451 };
1452
1453 /* Structure for reading/writing policy via /proc/ccs/ interfaces. */
1454 struct ccs_io_buffer {
1455 /* Exclusive lock for this structure. */
1456 struct mutex io_sem;
1457 char __user *read_user_buf;
1458 size_t read_user_buf_avail;
1459 struct {
1460 struct list_head *ns;
1461 struct list_head *domain;
1462 struct list_head *group;
1463 struct list_head *acl;
1464 size_t avail;
1465 unsigned int step;
1466 unsigned int query_index;
1467 u16 index;
1468 u16 cond_index;
1469 u8 acl_group_index;
1470 u8 cond_step;
1471 u8 bit;
1472 u8 w_pos;
1473 bool eof;
1474 bool print_this_domain_only;
1475 bool print_transition_related_only;
1476 bool print_cond_part;
1477 const char *w[CCS_MAX_IO_READ_QUEUE];
1478 } r;
1479 struct {
1480 struct ccs_policy_namespace *ns;
1481 struct ccs_domain_info *domain;
1482 size_t avail;
1483 bool is_delete;
1484 } w;
1485 /* Buffer for reading. */
1486 char *read_buf;
1487 /* Size of read buffer. */
1488 size_t readbuf_size;
1489 /* Buffer for writing. */
1490 char *write_buf;
1491 /* Size of write buffer. */
1492 size_t writebuf_size;
1493 /* Type of interface. */
1494 enum ccs_proc_interface_index type;
1495 /* Users counter protected by ccs_io_buffer_list_lock. */
1496 u8 users;
1497 /* List for telling GC not to kfree() elements. */
1498 struct list_head list;
1499 };
1500
1501 /* Structure for /proc/ccs/profile interface. */
1502 struct ccs_profile {
1503 const struct ccs_path_info *comment;
1504 u8 default_config;
1505 u8 config[CCS_MAX_MAC_INDEX + CCS_MAX_MAC_CATEGORY_INDEX];
1506 unsigned int pref[CCS_MAX_PREF];
1507 };
1508
1509 /* Structure for representing YYYY/MM/DD hh/mm/ss. */
1510 struct ccs_time {
1511 u16 year;
1512 u8 month;
1513 u8 day;
1514 u8 hour;
1515 u8 min;
1516 u8 sec;
1517 };
1518
1519 /* Structure for policy namespace. */
1520 struct ccs_policy_namespace {
1521 /* Profile table. Memory is allocated as needed. */
1522 struct ccs_profile *profile_ptr[CCS_MAX_PROFILES];
1523 /* List of "struct ccs_group". */
1524 struct list_head group_list[CCS_MAX_GROUP];
1525 /* List of policy. */
1526 struct list_head policy_list[CCS_MAX_POLICY];
1527 /* The global ACL referred by "use_group" keyword. */
1528 struct list_head acl_group[CCS_MAX_ACL_GROUPS];
1529 /* List for connecting to ccs_namespace_list list. */
1530 struct list_head namespace_list;
1531 /* Profile version. Currently only 20200505 is supported. */
1532 unsigned int profile_version;
1533 /* Name of this namespace (e.g. "<kernel>", "</usr/sbin/httpd>" ). */
1534 const char *name;
1535 };
1536
1537 /* Prototype definition for "struct ccsecurity_operations". */
1538
1539 void __init ccs_permission_init(void);
1540 void __init ccs_mm_init(void);
1541
1542 /* Prototype definition for internal use. */
1543
1544 bool ccs_dump_page(struct linux_binprm *bprm, unsigned long pos,
1545 struct ccs_page_dump *dump);
1546 bool ccs_memory_ok(const void *ptr, const unsigned int size);
1547 char *ccs_encode(const char *str);
1548 char *ccs_encode2(const char *str, int str_len);
1549 char *ccs_realpath(const struct path *path);
1550 const char *ccs_get_exe(void);
1551 const struct ccs_path_info *ccs_get_name(const char *name);
1552 int ccs_audit_log(struct ccs_request_info *r);
1553 int ccs_check_acl(struct ccs_request_info *r);
1554 int ccs_init_request_info(struct ccs_request_info *r, const u8 index);
1555 struct ccs_domain_info *ccs_assign_domain(const char *domainname,
1556 const bool transit);
1557 u8 ccs_get_config(const u8 profile, const u8 index);
1558 void *ccs_commit_ok(void *data, const unsigned int size);
1559 void ccs_del_acl(struct list_head *element);
1560 void ccs_del_condition(struct list_head *element);
1561 void ccs_fill_path_info(struct ccs_path_info *ptr);
1562 void ccs_get_attributes(struct ccs_obj_info *obj);
1563 void ccs_notify_gc(struct ccs_io_buffer *head, const bool is_register);
1564 void ccs_transition_failed(const char *domainname);
1565 void ccs_warn_oom(const char *function);
1566 void ccs_write_log(struct ccs_request_info *r, const char *fmt, ...)
1567 __printf(2, 3);
1568
1569 /* Variable definition for internal use. */
1570
1571 extern bool ccs_policy_loaded;
1572 extern const char * const ccs_dif[CCS_MAX_DOMAIN_INFO_FLAGS];
1573 extern const u8 ccs_c2mac[CCS_MAX_CAPABILITY_INDEX];
1574 extern const u8 ccs_pn2mac[CCS_MAX_PATH_NUMBER_OPERATION];
1575 extern const u8 ccs_pnnn2mac[CCS_MAX_MKDEV_OPERATION];
1576 extern const u8 ccs_pp2mac[CCS_MAX_PATH2_OPERATION];
1577 extern struct ccs_domain_info ccs_kernel_domain;
1578 extern struct list_head ccs_condition_list;
1579 extern struct list_head ccs_domain_list;
1580 extern struct list_head ccs_name_list[CCS_MAX_HASH];
1581 extern struct list_head ccs_namespace_list;
1582 extern struct mutex ccs_policy_lock;
1583 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19)
1584 extern struct srcu_struct ccs_ss;
1585 #endif
1586 extern unsigned int ccs_memory_quota[CCS_MAX_MEMORY_STAT];
1587 extern unsigned int ccs_memory_used[CCS_MAX_MEMORY_STAT];
1588
1589 /* Inlined functions for internal use. */
1590
1591 /**
1592 * ccs_pathcmp - strcmp() for "struct ccs_path_info" structure.
1593 *
1594 * @a: Pointer to "struct ccs_path_info".
1595 * @b: Pointer to "struct ccs_path_info".
1596 *
1597 * Returns true if @a != @b, false otherwise.
1598 */
1599 static inline bool ccs_pathcmp(const struct ccs_path_info *a,
1600 const struct ccs_path_info *b)
1601 {
1602 return a->hash != b->hash || strcmp(a->name, b->name);
1603 }
1604
1605 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19)
1606
1607 /**
1608 * ccs_read_lock - Take lock for protecting policy.
1609 *
1610 * Returns index number for ccs_read_unlock().
1611 */
1612 static inline int ccs_read_lock(void)
1613 {
1614 return srcu_read_lock(&ccs_ss);
1615 }
1616
1617 /**
1618 * ccs_read_unlock - Release lock for protecting policy.
1619 *
1620 * @idx: Index number returned by ccs_read_lock().
1621 *
1622 * Returns nothing.
1623 */
1624 static inline void ccs_read_unlock(const int idx)
1625 {
1626 srcu_read_unlock(&ccs_ss, idx);
1627 }
1628
1629 #else
1630
1631 int ccs_lock(void);
1632 void ccs_unlock(const int idx);
1633
1634 /**
1635 * ccs_read_lock - Take lock for protecting policy.
1636 *
1637 * Returns index number for ccs_read_unlock().
1638 */
1639 static inline int ccs_read_lock(void)
1640 {
1641 return ccs_lock();
1642 }
1643
1644 /**
1645 * ccs_read_unlock - Release lock for protecting policy.
1646 *
1647 * @idx: Index number returned by ccs_read_lock().
1648 *
1649 * Returns nothing.
1650 */
1651 static inline void ccs_read_unlock(const int idx)
1652 {
1653 ccs_unlock(idx);
1654 }
1655
1656 #endif
1657
1658 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
1659
1660 /**
1661 * ccs_tasklist_lock - Take lock for reading list of "struct task_struct".
1662 *
1663 * Returns nothing.
1664 */
1665 static inline void ccs_tasklist_lock(void)
1666 {
1667 rcu_read_lock();
1668 }
1669
1670 /**
1671 * ccs_tasklist_unlock - Release lock for reading list of "struct task_struct".
1672 *
1673 * Returns nothing.
1674 */
1675 static inline void ccs_tasklist_unlock(void)
1676 {
1677 rcu_read_unlock();
1678 }
1679
1680 #else
1681
1682 /**
1683 * ccs_tasklist_lock - Take lock for reading list of "struct task_struct".
1684 *
1685 * Returns nothing.
1686 */
1687 static inline void ccs_tasklist_lock(void)
1688 {
1689 read_lock(&tasklist_lock);
1690 }
1691
1692 /**
1693 * ccs_tasklist_unlock - Release lock for reading list of "struct task_struct".
1694 *
1695 * Returns nothing.
1696 */
1697 static inline void ccs_tasklist_unlock(void)
1698 {
1699 read_unlock(&tasklist_lock);
1700 }
1701
1702 #endif
1703
1704 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
1705
1706 /**
1707 * ccs_sys_getppid - Copy of getppid().
1708 *
1709 * Returns parent process's PID.
1710 *
1711 * Alpha does not have getppid() defined. To be able to build this module on
1712 * Alpha, I have to copy getppid() from kernel/timer.c.
1713 */
1714 static inline pid_t ccs_sys_getppid(void)
1715 {
1716 pid_t pid;
1717 rcu_read_lock();
1718 pid = task_tgid_vnr(rcu_dereference(current->real_parent));
1719 rcu_read_unlock();
1720 return pid;
1721 }
1722
1723 #elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 5, 0)
1724
1725 /**
1726 * ccs_sys_getppid - Copy of getppid().
1727 *
1728 * Returns parent process's PID.
1729 *
1730 * This function was rewritten to use RCU in 2.6.16.34. However, distributors
1731 * which use earlier kernels (e.g. 2.6.8/2.6.9) did not backport the bugfix.
1732 * Therefore, I'm using code for 2.6.16.34 for earlier kernels.
1733 */
1734 static inline pid_t ccs_sys_getppid(void)
1735 {
1736 pid_t pid;
1737 rcu_read_lock();
1738 #if (defined(RHEL_MAJOR) && RHEL_MAJOR == 5) || (defined(AX_MAJOR) && AX_MAJOR == 3)
1739 pid = rcu_dereference(current->parent)->tgid;
1740 #elif defined(CONFIG_UTRACE)
1741 /*
1742 * RHEL 5.0 kernel does not have RHEL_MAJOR/RHEL_MINOR defined.
1743 * Assume RHEL 5.0 if CONFIG_UTRACE is defined.
1744 */
1745 pid = rcu_dereference(current->parent)->tgid;
1746 #else
1747 pid = rcu_dereference(current->real_parent)->tgid;
1748 #endif
1749 rcu_read_unlock();
1750 return pid;
1751 }
1752
1753 #else
1754
1755 /**
1756 * ccs_sys_getppid - Copy of getppid().
1757 *
1758 * Returns parent process's PID.
1759 *
1760 * I can't use code for 2.6.16.34 for 2.4 kernels because 2.4 kernels does not
1761 * have RCU. Therefore, I'm using pessimistic lock (i.e. tasklist_lock
1762 * spinlock).
1763 */
1764 static inline pid_t ccs_sys_getppid(void)
1765 {
1766 pid_t pid;
1767 read_lock(&tasklist_lock);
1768 #ifdef TASK_DEAD
1769 pid = current->group_leader->real_parent->tgid;
1770 #else
1771 pid = current->p_opptr->pid;
1772 #endif
1773 read_unlock(&tasklist_lock);
1774 return pid;
1775 }
1776
1777 #endif
1778
1779 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
1780
1781 /**
1782 * ccs_sys_getpid - Copy of getpid().
1783 *
1784 * Returns current thread's PID.
1785 *
1786 * Alpha does not have getpid() defined. To be able to build this module on
1787 * Alpha, I have to copy getpid() from kernel/timer.c.
1788 */
1789 static inline pid_t ccs_sys_getpid(void)
1790 {
1791 return task_tgid_vnr(current);
1792 }
1793
1794 #else
1795
1796 /**
1797 * ccs_sys_getpid - Copy of getpid().
1798 *
1799 * Returns current thread's PID.
1800 */
1801 static inline pid_t ccs_sys_getpid(void)
1802 {
1803 return current->tgid;
1804 }
1805
1806 #endif
1807
1808 /**
1809 * ccs_get_mode - Get mode for specified functionality.
1810 *
1811 * @profile: Profile number.
1812 * @index: Functionality number.
1813 *
1814 * Returns mode.
1815 */
1816 static inline u8 ccs_get_mode(const u8 profile, const u8 index)
1817 {
1818 return ccs_get_config(profile, index) & (CCS_CONFIG_MAX_MODE - 1);
1819 }
1820
1821 #if defined(CONFIG_SLOB)
1822
1823 /**
1824 * ccs_round2 - Round up to power of 2 for calculating memory usage.
1825 *
1826 * @size: Size to be rounded up.
1827 *
1828 * Returns @size.
1829 *
1830 * Since SLOB does not round up, this function simply returns @size.
1831 */
1832 static inline int ccs_round2(size_t size)
1833 {
1834 return size;
1835 }
1836
1837 #else
1838
1839 /**
1840 * ccs_round2 - Round up to power of 2 for calculating memory usage.
1841 *
1842 * @size: Size to be rounded up.
1843 *
1844 * Returns rounded size.
1845 *
1846 * Strictly speaking, SLAB may be able to allocate (e.g.) 96 bytes instead of
1847 * (e.g.) 128 bytes.
1848 */
1849 static inline int ccs_round2(size_t size)
1850 {
1851 #if PAGE_SIZE == 4096
1852 size_t bsize = 32;
1853 #else
1854 size_t bsize = 64;
1855 #endif
1856 if (!size)
1857 return 0;
1858 while (size > bsize)
1859 bsize <<= 1;
1860 return bsize;
1861 }
1862
1863 #endif
1864
1865 /**
1866 * ccs_put_condition - Drop reference on "struct ccs_condition".
1867 *
1868 * @cond: Pointer to "struct ccs_condition". Maybe NULL.
1869 *
1870 * Returns nothing.
1871 */
1872 static inline void ccs_put_condition(struct ccs_condition *cond)
1873 {
1874 if (cond)
1875 atomic_dec(&cond->head.users);
1876 }
1877
1878 /**
1879 * ccs_put_group - Drop reference on "struct ccs_group".
1880 *
1881 * @group: Pointer to "struct ccs_group". Maybe NULL.
1882 *
1883 * Returns nothing.
1884 */
1885 static inline void ccs_put_group(struct ccs_group *group)
1886 {
1887 if (group)
1888 atomic_dec(&group->head.users);
1889 }
1890
1891 /**
1892 * ccs_put_name - Drop reference on "struct ccs_name".
1893 *
1894 * @name: Pointer to "struct ccs_path_info". Maybe NULL.
1895 *
1896 * Returns nothing.
1897 */
1898 static inline void ccs_put_name(const struct ccs_path_info *name)
1899 {
1900 if (name)
1901 atomic_dec(&container_of(name, struct ccs_name, entry)->
1902 head.users);
1903 }
1904
1905 /* For importing variables and functions. */
1906 extern const struct ccsecurity_exports ccsecurity_exports;
1907
1908 #ifdef CONFIG_CCSECURITY_USE_EXTERNAL_TASK_SECURITY
1909
1910 /*
1911 * Structure for holding "struct ccs_domain_info *" and "struct ccs_execve *"
1912 * and "u32 ccs_flags" for each "struct task_struct".
1913 *
1914 * "struct ccs_domain_info *" and "u32 ccs_flags" for each "struct task_struct"
1915 * are maintained outside that "struct task_struct". Therefore, ccs_security
1916 * != task_struct . This keeps KABI for distributor's prebuilt kernels but
1917 * entails slow access.
1918 *
1919 * Memory for this structure is allocated when current thread tries to access
1920 * it. Therefore, if memory allocation failed, current thread will be killed by
1921 * SIGKILL. Note that if current->pid == 1, sending SIGKILL won't work.
1922 */
1923 struct ccs_security {
1924 struct list_head list;
1925 const struct task_struct *task;
1926 struct ccs_domain_info *ccs_domain_info;
1927 u32 ccs_flags;
1928 struct rcu_head rcu;
1929 };
1930
1931 #define CCS_TASK_SECURITY_HASH_BITS 12
1932 #define CCS_MAX_TASK_SECURITY_HASH (1u << CCS_TASK_SECURITY_HASH_BITS)
1933 extern struct list_head ccs_task_security_list[CCS_MAX_TASK_SECURITY_HASH];
1934
1935 struct ccs_security *ccs_find_task_security(const struct task_struct *task);
1936
1937 /**
1938 * ccs_current_security - Get "struct ccs_security" for current thread.
1939 *
1940 * Returns pointer to "struct ccs_security" for current thread.
1941 */
1942 static inline struct ccs_security *ccs_current_security(void)
1943 {
1944 return ccs_find_task_security(current);
1945 }
1946
1947 /**
1948 * ccs_task_domain - Get "struct ccs_domain_info" for specified thread.
1949 *
1950 * @task: Pointer to "struct task_struct".
1951 *
1952 * Returns pointer to "struct ccs_security" for specified thread.
1953 */
1954 static inline struct ccs_domain_info *ccs_task_domain(struct task_struct *task)
1955 {
1956 struct ccs_domain_info *domain;
1957 rcu_read_lock();
1958 domain = ccs_find_task_security(task)->ccs_domain_info;
1959 rcu_read_unlock();
1960 return domain;
1961 }
1962
1963 /**
1964 * ccs_current_domain - Get "struct ccs_domain_info" for current thread.
1965 *
1966 * Returns pointer to "struct ccs_domain_info" for current thread.
1967 */
1968 static inline struct ccs_domain_info *ccs_current_domain(void)
1969 {
1970 return ccs_find_task_security(current)->ccs_domain_info;
1971 }
1972
1973 /**
1974 * ccs_task_flags - Get flags for specified thread.
1975 *
1976 * @task: Pointer to "struct task_struct".
1977 *
1978 * Returns flags for specified thread.
1979 */
1980 static inline u32 ccs_task_flags(struct task_struct *task)
1981 {
1982 u32 ccs_flags;
1983 rcu_read_lock();
1984 ccs_flags = ccs_find_task_security(task)->ccs_flags;
1985 rcu_read_unlock();
1986 return ccs_flags;
1987 }
1988
1989 /**
1990 * ccs_current_flags - Get flags for current thread.
1991 *
1992 * Returns flags for current thread.
1993 */
1994 static inline u32 ccs_current_flags(void)
1995 {
1996 return ccs_find_task_security(current)->ccs_flags;
1997 }
1998
1999 #else
2000
2001 /*
2002 * "struct ccs_domain_info *" and "u32 ccs_flags" for each "struct task_struct"
2003 * are maintained inside that "struct task_struct". Therefore, ccs_security ==
2004 * task_struct . This allows fast access but breaks KABI checks for
2005 * distributor's prebuilt kernels due to changes in "struct task_struct".
2006 */
2007 #define ccs_security task_struct
2008
2009 /**
2010 * ccs_find_task_security - Find "struct ccs_security" for given task.
2011 *
2012 * @task: Pointer to "struct task_struct".
2013 *
2014 * Returns pointer to "struct ccs_security".
2015 */
2016 static inline struct ccs_security *ccs_find_task_security(struct task_struct *
2017 task)
2018 {
2019 return task;
2020 }
2021
2022 /**
2023 * ccs_current_security - Get "struct ccs_security" for current thread.
2024 *
2025 * Returns pointer to "struct ccs_security" for current thread.
2026 */
2027 static inline struct ccs_security *ccs_current_security(void)
2028 {
2029 return ccs_find_task_security(current);
2030 }
2031
2032 /**
2033 * ccs_task_domain - Get "struct ccs_domain_info" for specified thread.
2034 *
2035 * @task: Pointer to "struct task_struct".
2036 *
2037 * Returns pointer to "struct ccs_security" for specified thread.
2038 */
2039 static inline struct ccs_domain_info *ccs_task_domain(struct task_struct *task)
2040 {
2041 struct ccs_domain_info *domain = task->ccs_domain_info;
2042 return domain ? domain : &ccs_kernel_domain;
2043 }
2044
2045 /**
2046 * ccs_current_domain - Get "struct ccs_domain_info" for current thread.
2047 *
2048 * Returns pointer to "struct ccs_domain_info" for current thread.
2049 *
2050 * If current thread does not belong to a domain (which is true for initial
2051 * init_task in order to hide ccs_kernel_domain from this module),
2052 * current thread enters into ccs_kernel_domain.
2053 */
2054 static inline struct ccs_domain_info *ccs_current_domain(void)
2055 {
2056 struct task_struct *task = current;
2057 if (!task->ccs_domain_info)
2058 task->ccs_domain_info = &ccs_kernel_domain;
2059 return task->ccs_domain_info;
2060 }
2061
2062 /**
2063 * ccs_task_flags - Get flags for specified thread.
2064 *
2065 * @task: Pointer to "struct task_struct".
2066 *
2067 * Returns flags for specified thread.
2068 */
2069 static inline u32 ccs_task_flags(struct task_struct *task)
2070 {
2071 return ccs_find_task_security(task)->ccs_flags;
2072 }
2073
2074 /**
2075 * ccs_current_flags - Get flags for current thread.
2076 *
2077 * Returns flags for current thread.
2078 */
2079 static inline u32 ccs_current_flags(void)
2080 {
2081 return ccs_find_task_security(current)->ccs_flags;
2082 }
2083
2084 #endif
2085
2086 /**
2087 * ccs_current_namespace - Get "struct ccs_policy_namespace" for current thread.
2088 *
2089 * Returns pointer to "struct ccs_policy_namespace" for current thread.
2090 */
2091 static inline struct ccs_policy_namespace *ccs_current_namespace(void)
2092 {
2093 return ccs_current_domain()->ns;
2094 }
2095
2096 #endif
2097
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.