Root/
1 | /* |
2 | * security/tomoyo/gc.c |
3 | * |
4 | * Implementation of the Domain-Based Mandatory Access Control. |
5 | * |
6 | * Copyright (C) 2005-2010 NTT DATA CORPORATION |
7 | * |
8 | */ |
9 | |
10 | #include "common.h" |
11 | #include <linux/kthread.h> |
12 | #include <linux/slab.h> |
13 | |
14 | enum tomoyo_gc_id { |
15 | TOMOYO_ID_DOMAIN_INITIALIZER, |
16 | TOMOYO_ID_DOMAIN_KEEPER, |
17 | TOMOYO_ID_ALIAS, |
18 | TOMOYO_ID_GLOBALLY_READABLE, |
19 | TOMOYO_ID_PATTERN, |
20 | TOMOYO_ID_NO_REWRITE, |
21 | TOMOYO_ID_MANAGER, |
22 | TOMOYO_ID_NAME, |
23 | TOMOYO_ID_ACL, |
24 | TOMOYO_ID_DOMAIN |
25 | }; |
26 | |
27 | struct tomoyo_gc_entry { |
28 | struct list_head list; |
29 | int type; |
30 | void *element; |
31 | }; |
32 | static LIST_HEAD(tomoyo_gc_queue); |
33 | static DEFINE_MUTEX(tomoyo_gc_mutex); |
34 | |
35 | /* Caller holds tomoyo_policy_lock mutex. */ |
36 | static bool tomoyo_add_to_gc(const int type, void *element) |
37 | { |
38 | struct tomoyo_gc_entry *entry = kzalloc(sizeof(*entry), GFP_ATOMIC); |
39 | if (!entry) |
40 | return false; |
41 | entry->type = type; |
42 | entry->element = element; |
43 | list_add(&entry->list, &tomoyo_gc_queue); |
44 | return true; |
45 | } |
46 | |
47 | static void tomoyo_del_allow_read |
48 | (struct tomoyo_globally_readable_file_entry *ptr) |
49 | { |
50 | tomoyo_put_name(ptr->filename); |
51 | } |
52 | |
53 | static void tomoyo_del_file_pattern(struct tomoyo_pattern_entry *ptr) |
54 | { |
55 | tomoyo_put_name(ptr->pattern); |
56 | } |
57 | |
58 | static void tomoyo_del_no_rewrite(struct tomoyo_no_rewrite_entry *ptr) |
59 | { |
60 | tomoyo_put_name(ptr->pattern); |
61 | } |
62 | |
63 | static void tomoyo_del_domain_initializer |
64 | (struct tomoyo_domain_initializer_entry *ptr) |
65 | { |
66 | tomoyo_put_name(ptr->domainname); |
67 | tomoyo_put_name(ptr->program); |
68 | } |
69 | |
70 | static void tomoyo_del_domain_keeper(struct tomoyo_domain_keeper_entry *ptr) |
71 | { |
72 | tomoyo_put_name(ptr->domainname); |
73 | tomoyo_put_name(ptr->program); |
74 | } |
75 | |
76 | static void tomoyo_del_alias(struct tomoyo_alias_entry *ptr) |
77 | { |
78 | tomoyo_put_name(ptr->original_name); |
79 | tomoyo_put_name(ptr->aliased_name); |
80 | } |
81 | |
82 | static void tomoyo_del_manager(struct tomoyo_policy_manager_entry *ptr) |
83 | { |
84 | tomoyo_put_name(ptr->manager); |
85 | } |
86 | |
87 | static void tomoyo_del_acl(struct tomoyo_acl_info *acl) |
88 | { |
89 | switch (acl->type) { |
90 | case TOMOYO_TYPE_PATH_ACL: |
91 | { |
92 | struct tomoyo_path_acl *entry |
93 | = container_of(acl, typeof(*entry), head); |
94 | tomoyo_put_name(entry->filename); |
95 | } |
96 | break; |
97 | case TOMOYO_TYPE_PATH2_ACL: |
98 | { |
99 | struct tomoyo_path2_acl *entry |
100 | = container_of(acl, typeof(*entry), head); |
101 | tomoyo_put_name(entry->filename1); |
102 | tomoyo_put_name(entry->filename2); |
103 | } |
104 | break; |
105 | default: |
106 | printk(KERN_WARNING "Unknown type\n"); |
107 | break; |
108 | } |
109 | } |
110 | |
111 | static bool tomoyo_del_domain(struct tomoyo_domain_info *domain) |
112 | { |
113 | struct tomoyo_acl_info *acl; |
114 | struct tomoyo_acl_info *tmp; |
115 | /* |
116 | * Since we don't protect whole execve() operation using SRCU, |
117 | * we need to recheck domain->users at this point. |
118 | * |
119 | * (1) Reader starts SRCU section upon execve(). |
120 | * (2) Reader traverses tomoyo_domain_list and finds this domain. |
121 | * (3) Writer marks this domain as deleted. |
122 | * (4) Garbage collector removes this domain from tomoyo_domain_list |
123 | * because this domain is marked as deleted and used by nobody. |
124 | * (5) Reader saves reference to this domain into |
125 | * "struct linux_binprm"->cred->security . |
126 | * (6) Reader finishes SRCU section, although execve() operation has |
127 | * not finished yet. |
128 | * (7) Garbage collector waits for SRCU synchronization. |
129 | * (8) Garbage collector kfree() this domain because this domain is |
130 | * used by nobody. |
131 | * (9) Reader finishes execve() operation and restores this domain from |
132 | * "struct linux_binprm"->cred->security. |
133 | * |
134 | * By updating domain->users at (5), we can solve this race problem |
135 | * by rechecking domain->users at (8). |
136 | */ |
137 | if (atomic_read(&domain->users)) |
138 | return false; |
139 | list_for_each_entry_safe(acl, tmp, &domain->acl_info_list, list) { |
140 | tomoyo_del_acl(acl); |
141 | tomoyo_memory_free(acl); |
142 | } |
143 | tomoyo_put_name(domain->domainname); |
144 | return true; |
145 | } |
146 | |
147 | |
148 | static void tomoyo_del_name(const struct tomoyo_name_entry *ptr) |
149 | { |
150 | } |
151 | |
152 | static void tomoyo_collect_entry(void) |
153 | { |
154 | mutex_lock(&tomoyo_policy_lock); |
155 | { |
156 | struct tomoyo_globally_readable_file_entry *ptr; |
157 | list_for_each_entry_rcu(ptr, &tomoyo_globally_readable_list, |
158 | list) { |
159 | if (!ptr->is_deleted) |
160 | continue; |
161 | if (tomoyo_add_to_gc(TOMOYO_ID_GLOBALLY_READABLE, ptr)) |
162 | list_del_rcu(&ptr->list); |
163 | else |
164 | break; |
165 | } |
166 | } |
167 | { |
168 | struct tomoyo_pattern_entry *ptr; |
169 | list_for_each_entry_rcu(ptr, &tomoyo_pattern_list, list) { |
170 | if (!ptr->is_deleted) |
171 | continue; |
172 | if (tomoyo_add_to_gc(TOMOYO_ID_PATTERN, ptr)) |
173 | list_del_rcu(&ptr->list); |
174 | else |
175 | break; |
176 | } |
177 | } |
178 | { |
179 | struct tomoyo_no_rewrite_entry *ptr; |
180 | list_for_each_entry_rcu(ptr, &tomoyo_no_rewrite_list, list) { |
181 | if (!ptr->is_deleted) |
182 | continue; |
183 | if (tomoyo_add_to_gc(TOMOYO_ID_NO_REWRITE, ptr)) |
184 | list_del_rcu(&ptr->list); |
185 | else |
186 | break; |
187 | } |
188 | } |
189 | { |
190 | struct tomoyo_domain_initializer_entry *ptr; |
191 | list_for_each_entry_rcu(ptr, &tomoyo_domain_initializer_list, |
192 | list) { |
193 | if (!ptr->is_deleted) |
194 | continue; |
195 | if (tomoyo_add_to_gc(TOMOYO_ID_DOMAIN_INITIALIZER, ptr)) |
196 | list_del_rcu(&ptr->list); |
197 | else |
198 | break; |
199 | } |
200 | } |
201 | { |
202 | struct tomoyo_domain_keeper_entry *ptr; |
203 | list_for_each_entry_rcu(ptr, &tomoyo_domain_keeper_list, list) { |
204 | if (!ptr->is_deleted) |
205 | continue; |
206 | if (tomoyo_add_to_gc(TOMOYO_ID_DOMAIN_KEEPER, ptr)) |
207 | list_del_rcu(&ptr->list); |
208 | else |
209 | break; |
210 | } |
211 | } |
212 | { |
213 | struct tomoyo_alias_entry *ptr; |
214 | list_for_each_entry_rcu(ptr, &tomoyo_alias_list, list) { |
215 | if (!ptr->is_deleted) |
216 | continue; |
217 | if (tomoyo_add_to_gc(TOMOYO_ID_ALIAS, ptr)) |
218 | list_del_rcu(&ptr->list); |
219 | else |
220 | break; |
221 | } |
222 | } |
223 | { |
224 | struct tomoyo_policy_manager_entry *ptr; |
225 | list_for_each_entry_rcu(ptr, &tomoyo_policy_manager_list, |
226 | list) { |
227 | if (!ptr->is_deleted) |
228 | continue; |
229 | if (tomoyo_add_to_gc(TOMOYO_ID_MANAGER, ptr)) |
230 | list_del_rcu(&ptr->list); |
231 | else |
232 | break; |
233 | } |
234 | } |
235 | { |
236 | struct tomoyo_domain_info *domain; |
237 | list_for_each_entry_rcu(domain, &tomoyo_domain_list, list) { |
238 | struct tomoyo_acl_info *acl; |
239 | list_for_each_entry_rcu(acl, &domain->acl_info_list, |
240 | list) { |
241 | switch (acl->type) { |
242 | case TOMOYO_TYPE_PATH_ACL: |
243 | if (container_of(acl, |
244 | struct tomoyo_path_acl, |
245 | head)->perm || |
246 | container_of(acl, |
247 | struct tomoyo_path_acl, |
248 | head)->perm_high) |
249 | continue; |
250 | break; |
251 | case TOMOYO_TYPE_PATH2_ACL: |
252 | if (container_of(acl, |
253 | struct tomoyo_path2_acl, |
254 | head)->perm) |
255 | continue; |
256 | break; |
257 | default: |
258 | continue; |
259 | } |
260 | if (tomoyo_add_to_gc(TOMOYO_ID_ACL, acl)) |
261 | list_del_rcu(&acl->list); |
262 | else |
263 | break; |
264 | } |
265 | if (!domain->is_deleted || atomic_read(&domain->users)) |
266 | continue; |
267 | /* |
268 | * Nobody is referring this domain. But somebody may |
269 | * refer this domain after successful execve(). |
270 | * We recheck domain->users after SRCU synchronization. |
271 | */ |
272 | if (tomoyo_add_to_gc(TOMOYO_ID_DOMAIN, domain)) |
273 | list_del_rcu(&domain->list); |
274 | else |
275 | break; |
276 | } |
277 | } |
278 | mutex_unlock(&tomoyo_policy_lock); |
279 | mutex_lock(&tomoyo_name_list_lock); |
280 | { |
281 | int i; |
282 | for (i = 0; i < TOMOYO_MAX_HASH; i++) { |
283 | struct tomoyo_name_entry *ptr; |
284 | list_for_each_entry_rcu(ptr, &tomoyo_name_list[i], |
285 | list) { |
286 | if (atomic_read(&ptr->users)) |
287 | continue; |
288 | if (tomoyo_add_to_gc(TOMOYO_ID_NAME, ptr)) |
289 | list_del_rcu(&ptr->list); |
290 | else { |
291 | i = TOMOYO_MAX_HASH; |
292 | break; |
293 | } |
294 | } |
295 | } |
296 | } |
297 | mutex_unlock(&tomoyo_name_list_lock); |
298 | } |
299 | |
300 | static void tomoyo_kfree_entry(void) |
301 | { |
302 | struct tomoyo_gc_entry *p; |
303 | struct tomoyo_gc_entry *tmp; |
304 | |
305 | list_for_each_entry_safe(p, tmp, &tomoyo_gc_queue, list) { |
306 | switch (p->type) { |
307 | case TOMOYO_ID_DOMAIN_INITIALIZER: |
308 | tomoyo_del_domain_initializer(p->element); |
309 | break; |
310 | case TOMOYO_ID_DOMAIN_KEEPER: |
311 | tomoyo_del_domain_keeper(p->element); |
312 | break; |
313 | case TOMOYO_ID_ALIAS: |
314 | tomoyo_del_alias(p->element); |
315 | break; |
316 | case TOMOYO_ID_GLOBALLY_READABLE: |
317 | tomoyo_del_allow_read(p->element); |
318 | break; |
319 | case TOMOYO_ID_PATTERN: |
320 | tomoyo_del_file_pattern(p->element); |
321 | break; |
322 | case TOMOYO_ID_NO_REWRITE: |
323 | tomoyo_del_no_rewrite(p->element); |
324 | break; |
325 | case TOMOYO_ID_MANAGER: |
326 | tomoyo_del_manager(p->element); |
327 | break; |
328 | case TOMOYO_ID_NAME: |
329 | tomoyo_del_name(p->element); |
330 | break; |
331 | case TOMOYO_ID_ACL: |
332 | tomoyo_del_acl(p->element); |
333 | break; |
334 | case TOMOYO_ID_DOMAIN: |
335 | if (!tomoyo_del_domain(p->element)) |
336 | continue; |
337 | break; |
338 | default: |
339 | printk(KERN_WARNING "Unknown type\n"); |
340 | break; |
341 | } |
342 | tomoyo_memory_free(p->element); |
343 | list_del(&p->list); |
344 | kfree(p); |
345 | } |
346 | } |
347 | |
348 | static int tomoyo_gc_thread(void *unused) |
349 | { |
350 | daemonize("GC for TOMOYO"); |
351 | if (mutex_trylock(&tomoyo_gc_mutex)) { |
352 | int i; |
353 | for (i = 0; i < 10; i++) { |
354 | tomoyo_collect_entry(); |
355 | if (list_empty(&tomoyo_gc_queue)) |
356 | break; |
357 | synchronize_srcu(&tomoyo_ss); |
358 | tomoyo_kfree_entry(); |
359 | } |
360 | mutex_unlock(&tomoyo_gc_mutex); |
361 | } |
362 | do_exit(0); |
363 | } |
364 | |
365 | void tomoyo_run_gc(void) |
366 | { |
367 | struct task_struct *task = kthread_create(tomoyo_gc_thread, NULL, |
368 | "GC for TOMOYO"); |
369 | if (!IS_ERR(task)) |
370 | wake_up_process(task); |
371 | } |
372 |
Branches:
ben-wpan
ben-wpan-stefan
javiroman/ks7010
jz-2.6.34
jz-2.6.34-rc5
jz-2.6.34-rc6
jz-2.6.34-rc7
jz-2.6.35
jz-2.6.36
jz-2.6.37
jz-2.6.38
jz-2.6.39
jz-3.0
jz-3.1
jz-3.11
jz-3.12
jz-3.13
jz-3.15
jz-3.16
jz-3.18-dt
jz-3.2
jz-3.3
jz-3.4
jz-3.5
jz-3.6
jz-3.6-rc2-pwm
jz-3.9
jz-3.9-clk
jz-3.9-rc8
jz47xx
jz47xx-2.6.38
master
Tags:
od-2011-09-04
od-2011-09-18
v2.6.34-rc5
v2.6.34-rc6
v2.6.34-rc7
v3.9