group.c 5.65 KB
Newer Older
1 2 3
/*
 * security/tomoyo/group.c
 *
4
 * Copyright (C) 2005-2011  NTT DATA CORPORATION
5 6 7
 */

#include <linux/slab.h>
8 9
#include <linux/rculist.h>

10 11
#include "common.h"

12 13 14 15 16 17 18 19
/**
 * tomoyo_same_path_group - Check for duplicated "struct tomoyo_path_group" entry.
 *
 * @a: Pointer to "struct tomoyo_acl_head".
 * @b: Pointer to "struct tomoyo_acl_head".
 *
 * Returns true if @a == @b, false otherwise.
 */
20
static bool tomoyo_same_path_group(const struct tomoyo_acl_head *a,
21
				   const struct tomoyo_acl_head *b)
22 23 24 25 26
{
	return container_of(a, struct tomoyo_path_group, head)->member_name ==
		container_of(b, struct tomoyo_path_group, head)->member_name;
}

27 28 29 30 31 32 33 34
/**
 * tomoyo_same_number_group - Check for duplicated "struct tomoyo_number_group" entry.
 *
 * @a: Pointer to "struct tomoyo_acl_head".
 * @b: Pointer to "struct tomoyo_acl_head".
 *
 * Returns true if @a == @b, false otherwise.
 */
35
static bool tomoyo_same_number_group(const struct tomoyo_acl_head *a,
36
				     const struct tomoyo_acl_head *b)
37 38 39 40 41 42 43 44 45 46
{
	return !memcmp(&container_of(a, struct tomoyo_number_group, head)
		       ->number,
		       &container_of(b, struct tomoyo_number_group, head)
		       ->number,
		       sizeof(container_of(a, struct tomoyo_number_group, head)
			      ->number));
}

/**
47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66
 * tomoyo_same_address_group - Check for duplicated "struct tomoyo_address_group" entry.
 *
 * @a: Pointer to "struct tomoyo_acl_head".
 * @b: Pointer to "struct tomoyo_acl_head".
 *
 * Returns true if @a == @b, false otherwise.
 */
static bool tomoyo_same_address_group(const struct tomoyo_acl_head *a,
				      const struct tomoyo_acl_head *b)
{
	const struct tomoyo_address_group *p1 = container_of(a, typeof(*p1),
							     head);
	const struct tomoyo_address_group *p2 = container_of(b, typeof(*p2),
							     head);

	return tomoyo_same_ipaddr_union(&p1->address, &p2->address);
}

/**
 * tomoyo_write_group - Write "struct tomoyo_path_group"/"struct tomoyo_number_group"/"struct tomoyo_address_group" list.
67
 *
68
 * @param: Pointer to "struct tomoyo_acl_param".
69
 * @type:  Type of this group.
70 71 72
 *
 * Returns 0 on success, negative value otherwise.
 */
73
int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type)
74
{
75
	struct tomoyo_group *group = tomoyo_get_group(param, type);
76 77 78
	int error = -EINVAL;
	if (!group)
		return -ENOMEM;
79
	param->list = &group->member_list;
80 81
	if (type == TOMOYO_PATH_GROUP) {
		struct tomoyo_path_group e = { };
82
		e.member_name = tomoyo_get_name(tomoyo_read_token(param));
83 84 85 86
		if (!e.member_name) {
			error = -ENOMEM;
			goto out;
		}
87 88
		error = tomoyo_update_policy(&e.head, sizeof(e), param,
					  tomoyo_same_path_group);
89 90 91
		tomoyo_put_name(e.member_name);
	} else if (type == TOMOYO_NUMBER_GROUP) {
		struct tomoyo_number_group e = { };
92 93
		if (param->data[0] == '@' ||
		    !tomoyo_parse_number_union(param, &e.number))
94
			goto out;
95 96
		error = tomoyo_update_policy(&e.head, sizeof(e), param,
					  tomoyo_same_number_group);
97 98
		/*
		 * tomoyo_put_number_union() is not needed because
99
		 * param->data[0] != '@'.
100
		 */
101 102 103 104 105 106 107 108
	} else {
		struct tomoyo_address_group e = { };

		if (param->data[0] == '@' ||
		    !tomoyo_parse_ipaddr_union(param, &e.address))
			goto out;
		error = tomoyo_update_policy(&e.head, sizeof(e), param,
					     tomoyo_same_address_group);
109
	}
110
out:
111 112 113 114 115 116 117
	tomoyo_put_group(group);
	return error;
}

/**
 * tomoyo_path_matches_group - Check whether the given pathname matches members of the given pathname group.
 *
118 119
 * @pathname: The name of pathname.
 * @group:    Pointer to "struct tomoyo_path_group".
120
 *
121 122
 * Returns matched member's pathname if @pathname matches pathnames in @group,
 * NULL otherwise.
123 124 125
 *
 * Caller holds tomoyo_read_lock().
 */
126 127 128
const struct tomoyo_path_info *
tomoyo_path_matches_group(const struct tomoyo_path_info *pathname,
			  const struct tomoyo_group *group)
129 130 131 132 133 134 135
{
	struct tomoyo_path_group *member;
	list_for_each_entry_rcu(member, &group->member_list, head.list) {
		if (member->head.is_deleted)
			continue;
		if (!tomoyo_path_matches_pattern(pathname, member->member_name))
			continue;
136
		return member->member_name;
137
	}
138
	return NULL;
139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168
}

/**
 * tomoyo_number_matches_group - Check whether the given number matches members of the given number group.
 *
 * @min:   Min number.
 * @max:   Max number.
 * @group: Pointer to "struct tomoyo_number_group".
 *
 * Returns true if @min and @max partially overlaps @group, false otherwise.
 *
 * Caller holds tomoyo_read_lock().
 */
bool tomoyo_number_matches_group(const unsigned long min,
				 const unsigned long max,
				 const struct tomoyo_group *group)
{
	struct tomoyo_number_group *member;
	bool matched = false;
	list_for_each_entry_rcu(member, &group->member_list, head.list) {
		if (member->head.is_deleted)
			continue;
		if (min > member->number.values[1] ||
		    max < member->number.values[0])
			continue;
		matched = true;
		break;
	}
	return matched;
}
169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200

/**
 * tomoyo_address_matches_group - Check whether the given address matches members of the given address group.
 *
 * @is_ipv6: True if @address is an IPv6 address.
 * @address: An IPv4 or IPv6 address.
 * @group:   Pointer to "struct tomoyo_address_group".
 *
 * Returns true if @address matches addresses in @group group, false otherwise.
 *
 * Caller holds tomoyo_read_lock().
 */
bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address,
				  const struct tomoyo_group *group)
{
	struct tomoyo_address_group *member;
	bool matched = false;
	const u8 size = is_ipv6 ? 16 : 4;

	list_for_each_entry_rcu(member, &group->member_list, head.list) {
		if (member->head.is_deleted)
			continue;
		if (member->address.is_ipv6 != is_ipv6)
			continue;
		if (memcmp(&member->address.ip[0], address, size) > 0 ||
		    memcmp(address, &member->address.ip[1], size) > 0)
			continue;
		matched = true;
		break;
	}
	return matched;
}