4 * Implementation of the Domain-Based Mandatory Access Control.
6 * Copyright (C) 2005-2010 NTT DATA CORPORATION
11 #include <linux/kthread.h>
12 #include <linux/slab.h>
15 struct list_head list
;
16 enum tomoyo_policy_id type
;
17 struct list_head
*element
;
19 static LIST_HEAD(tomoyo_gc_queue
);
20 static DEFINE_MUTEX(tomoyo_gc_mutex
);
23 * tomoyo_add_to_gc - Add an entry to to be deleted list.
25 * @type: One of values in "enum tomoyo_policy_id".
26 * @element: Pointer to "struct list_head".
28 * Returns true on success, false otherwise.
30 * Caller holds tomoyo_policy_lock mutex.
32 * Adding an entry needs kmalloc(). Thus, if we try to add thousands of
33 * entries at once, it will take too long time. Thus, do not add more than 128
34 * entries per a scan. But to be able to handle worst case where all entries
35 * are in-use, we accept one more entry per a scan.
37 * If we use singly linked list using "struct list_head"->prev (which is
38 * LIST_POISON2), we can avoid kmalloc().
40 static bool tomoyo_add_to_gc(const int type
, struct list_head
*element
)
42 struct tomoyo_gc
*entry
= kzalloc(sizeof(*entry
), GFP_ATOMIC
);
46 entry
->element
= element
;
47 list_add(&entry
->list
, &tomoyo_gc_queue
);
48 list_del_rcu(element
);
53 * tomoyo_del_transition_control - Delete members in "struct tomoyo_transition_control".
55 * @element: Pointer to "struct list_head".
59 static void tomoyo_del_transition_control(struct list_head
*element
)
61 struct tomoyo_transition_control
*ptr
=
62 container_of(element
, typeof(*ptr
), head
.list
);
63 tomoyo_put_name(ptr
->domainname
);
64 tomoyo_put_name(ptr
->program
);
68 * tomoyo_del_aggregator - Delete members in "struct tomoyo_aggregator".
70 * @element: Pointer to "struct list_head".
74 static void tomoyo_del_aggregator(struct list_head
*element
)
76 struct tomoyo_aggregator
*ptr
=
77 container_of(element
, typeof(*ptr
), head
.list
);
78 tomoyo_put_name(ptr
->original_name
);
79 tomoyo_put_name(ptr
->aggregated_name
);
83 * tomoyo_del_manager - Delete members in "struct tomoyo_manager".
85 * @element: Pointer to "struct list_head".
89 static void tomoyo_del_manager(struct list_head
*element
)
91 struct tomoyo_manager
*ptr
=
92 container_of(element
, typeof(*ptr
), head
.list
);
93 tomoyo_put_name(ptr
->manager
);
97 * tomoyo_del_acl - Delete members in "struct tomoyo_acl_info".
99 * @element: Pointer to "struct list_head".
103 static void tomoyo_del_acl(struct list_head
*element
)
105 struct tomoyo_acl_info
*acl
=
106 container_of(element
, typeof(*acl
), list
);
108 case TOMOYO_TYPE_PATH_ACL
:
110 struct tomoyo_path_acl
*entry
111 = container_of(acl
, typeof(*entry
), head
);
112 tomoyo_put_name_union(&entry
->name
);
115 case TOMOYO_TYPE_PATH2_ACL
:
117 struct tomoyo_path2_acl
*entry
118 = container_of(acl
, typeof(*entry
), head
);
119 tomoyo_put_name_union(&entry
->name1
);
120 tomoyo_put_name_union(&entry
->name2
);
123 case TOMOYO_TYPE_PATH_NUMBER_ACL
:
125 struct tomoyo_path_number_acl
*entry
126 = container_of(acl
, typeof(*entry
), head
);
127 tomoyo_put_name_union(&entry
->name
);
128 tomoyo_put_number_union(&entry
->number
);
131 case TOMOYO_TYPE_MKDEV_ACL
:
133 struct tomoyo_mkdev_acl
*entry
134 = container_of(acl
, typeof(*entry
), head
);
135 tomoyo_put_name_union(&entry
->name
);
136 tomoyo_put_number_union(&entry
->mode
);
137 tomoyo_put_number_union(&entry
->major
);
138 tomoyo_put_number_union(&entry
->minor
);
141 case TOMOYO_TYPE_MOUNT_ACL
:
143 struct tomoyo_mount_acl
*entry
144 = container_of(acl
, typeof(*entry
), head
);
145 tomoyo_put_name_union(&entry
->dev_name
);
146 tomoyo_put_name_union(&entry
->dir_name
);
147 tomoyo_put_name_union(&entry
->fs_type
);
148 tomoyo_put_number_union(&entry
->flags
);
154 static bool tomoyo_del_domain(struct list_head
*element
)
156 struct tomoyo_domain_info
*domain
=
157 container_of(element
, typeof(*domain
), list
);
158 struct tomoyo_acl_info
*acl
;
159 struct tomoyo_acl_info
*tmp
;
161 * Since we don't protect whole execve() operation using SRCU,
162 * we need to recheck domain->users at this point.
164 * (1) Reader starts SRCU section upon execve().
165 * (2) Reader traverses tomoyo_domain_list and finds this domain.
166 * (3) Writer marks this domain as deleted.
167 * (4) Garbage collector removes this domain from tomoyo_domain_list
168 * because this domain is marked as deleted and used by nobody.
169 * (5) Reader saves reference to this domain into
170 * "struct linux_binprm"->cred->security .
171 * (6) Reader finishes SRCU section, although execve() operation has
173 * (7) Garbage collector waits for SRCU synchronization.
174 * (8) Garbage collector kfree() this domain because this domain is
176 * (9) Reader finishes execve() operation and restores this domain from
177 * "struct linux_binprm"->cred->security.
179 * By updating domain->users at (5), we can solve this race problem
180 * by rechecking domain->users at (8).
182 if (atomic_read(&domain
->users
))
184 list_for_each_entry_safe(acl
, tmp
, &domain
->acl_info_list
, list
) {
185 tomoyo_del_acl(&acl
->list
);
186 tomoyo_memory_free(acl
);
188 tomoyo_put_name(domain
->domainname
);
194 * tomoyo_del_name - Delete members in "struct tomoyo_name".
196 * @element: Pointer to "struct list_head".
200 static void tomoyo_del_name(struct list_head
*element
)
202 const struct tomoyo_name
*ptr
=
203 container_of(element
, typeof(*ptr
), head
.list
);
207 * tomoyo_del_path_group - Delete members in "struct tomoyo_path_group".
209 * @element: Pointer to "struct list_head".
213 static void tomoyo_del_path_group(struct list_head
*element
)
215 struct tomoyo_path_group
*member
=
216 container_of(element
, typeof(*member
), head
.list
);
217 tomoyo_put_name(member
->member_name
);
221 * tomoyo_del_group - Delete "struct tomoyo_group".
223 * @element: Pointer to "struct list_head".
227 static void tomoyo_del_group(struct list_head
*element
)
229 struct tomoyo_group
*group
=
230 container_of(element
, typeof(*group
), head
.list
);
231 tomoyo_put_name(group
->group_name
);
235 * tomoyo_del_number_group - Delete members in "struct tomoyo_number_group".
237 * @element: Pointer to "struct list_head".
241 static void tomoyo_del_number_group(struct list_head
*element
)
243 struct tomoyo_number_group
*member
=
244 container_of(element
, typeof(*member
), head
.list
);
248 * tomoyo_collect_member - Delete elements with "struct tomoyo_acl_head".
250 * @id: One of values in "enum tomoyo_policy_id".
251 * @member_list: Pointer to "struct list_head".
253 * Returns true if some elements are deleted, false otherwise.
255 static bool tomoyo_collect_member(const enum tomoyo_policy_id id
,
256 struct list_head
*member_list
)
258 struct tomoyo_acl_head
*member
;
259 list_for_each_entry(member
, member_list
, list
) {
260 if (!member
->is_deleted
)
262 if (!tomoyo_add_to_gc(id
, &member
->list
))
269 * tomoyo_collect_acl - Delete elements in "struct tomoyo_domain_info".
271 * @list: Pointer to "struct list_head".
273 * Returns true if some elements are deleted, false otherwise.
275 static bool tomoyo_collect_acl(struct list_head
*list
)
277 struct tomoyo_acl_info
*acl
;
278 list_for_each_entry(acl
, list
, list
) {
279 if (!acl
->is_deleted
)
281 if (!tomoyo_add_to_gc(TOMOYO_ID_ACL
, &acl
->list
))
288 * tomoyo_collect_entry - Scan lists for deleted elements.
292 static void tomoyo_collect_entry(void)
295 if (mutex_lock_interruptible(&tomoyo_policy_lock
))
297 for (i
= 0; i
< TOMOYO_MAX_POLICY
; i
++) {
298 if (!tomoyo_collect_member(i
, &tomoyo_policy_list
[i
]))
301 for (i
= 0; i
< TOMOYO_MAX_ACL_GROUPS
; i
++)
302 if (!tomoyo_collect_acl(&tomoyo_acl_group
[i
]))
305 struct tomoyo_domain_info
*domain
;
306 list_for_each_entry_rcu(domain
, &tomoyo_domain_list
, list
) {
307 if (!tomoyo_collect_acl(&domain
->acl_info_list
))
309 if (!domain
->is_deleted
|| atomic_read(&domain
->users
))
312 * Nobody is referring this domain. But somebody may
313 * refer this domain after successful execve().
314 * We recheck domain->users after SRCU synchronization.
316 if (!tomoyo_add_to_gc(TOMOYO_ID_DOMAIN
, &domain
->list
))
320 for (i
= 0; i
< TOMOYO_MAX_HASH
; i
++) {
321 struct tomoyo_name
*ptr
;
322 list_for_each_entry_rcu(ptr
, &tomoyo_name_list
[i
], head
.list
) {
323 if (atomic_read(&ptr
->head
.users
))
325 if (!tomoyo_add_to_gc(TOMOYO_ID_NAME
, &ptr
->head
.list
))
329 for (i
= 0; i
< TOMOYO_MAX_GROUP
; i
++) {
330 struct list_head
*list
= &tomoyo_group_list
[i
];
332 struct tomoyo_group
*group
;
335 id
= TOMOYO_ID_PATH_GROUP
;
338 id
= TOMOYO_ID_NUMBER_GROUP
;
341 list_for_each_entry(group
, list
, head
.list
) {
342 if (!tomoyo_collect_member(id
, &group
->member_list
))
344 if (!list_empty(&group
->member_list
) ||
345 atomic_read(&group
->head
.users
))
347 if (!tomoyo_add_to_gc(TOMOYO_ID_GROUP
,
353 mutex_unlock(&tomoyo_policy_lock
);
356 static void tomoyo_kfree_entry(void)
359 struct tomoyo_gc
*tmp
;
361 list_for_each_entry_safe(p
, tmp
, &tomoyo_gc_queue
, list
) {
362 struct list_head
*element
= p
->element
;
364 case TOMOYO_ID_TRANSITION_CONTROL
:
365 tomoyo_del_transition_control(element
);
367 case TOMOYO_ID_AGGREGATOR
:
368 tomoyo_del_aggregator(element
);
370 case TOMOYO_ID_MANAGER
:
371 tomoyo_del_manager(element
);
374 tomoyo_del_name(element
);
377 tomoyo_del_acl(element
);
379 case TOMOYO_ID_DOMAIN
:
380 if (!tomoyo_del_domain(element
))
383 case TOMOYO_ID_PATH_GROUP
:
384 tomoyo_del_path_group(element
);
386 case TOMOYO_ID_GROUP
:
387 tomoyo_del_group(element
);
389 case TOMOYO_ID_NUMBER_GROUP
:
390 tomoyo_del_number_group(element
);
392 case TOMOYO_MAX_POLICY
:
395 tomoyo_memory_free(element
);
402 * tomoyo_gc_thread - Garbage collector thread function.
406 * In case OOM-killer choose this thread for termination, we create this thread
407 * as a short live thread whenever /sys/kernel/security/tomoyo/ interface was
412 static int tomoyo_gc_thread(void *unused
)
414 daemonize("GC for TOMOYO");
415 if (mutex_trylock(&tomoyo_gc_mutex
)) {
417 for (i
= 0; i
< 10; i
++) {
418 tomoyo_collect_entry();
419 if (list_empty(&tomoyo_gc_queue
))
421 synchronize_srcu(&tomoyo_ss
);
422 tomoyo_kfree_entry();
424 mutex_unlock(&tomoyo_gc_mutex
);
429 void tomoyo_run_gc(void)
431 struct task_struct
*task
= kthread_create(tomoyo_gc_thread
, NULL
,
434 wake_up_process(task
);