[mirror_ubuntu-bionic-kernel.git] / security / tomoyo / gc.c

/*
 * security/tomoyo/gc.c
 *
 * Implementation of the Domain-Based Mandatory Access Control.
 *
 * Copyright (C) 2005-2010  NTT DATA CORPORATION
 *
 */

#include "common.h"
#include <linux/kthread.h>
#include <linux/slab.h>

struct tomoyo_gc {
	struct list_head list;
	int type;
	struct list_head *element;
};
static LIST_HEAD(tomoyo_gc_queue);
static DEFINE_MUTEX(tomoyo_gc_mutex);

/* Caller holds tomoyo_policy_lock mutex. */
static bool tomoyo_add_to_gc(const int type, struct list_head *element)
{
	struct tomoyo_gc *entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
	if (!entry)
		return false;
	entry->type = type;
	entry->element = element;
	list_add(&entry->list, &tomoyo_gc_queue);
	list_del_rcu(element);
	return true;
}

static void tomoyo_del_transition_control(struct list_head *element)
{
	struct tomoyo_transition_control *ptr =
		container_of(element, typeof(*ptr), head.list);
	tomoyo_put_name(ptr->domainname);
	tomoyo_put_name(ptr->program);
}

static void tomoyo_del_aggregator(struct list_head *element)
{
	struct tomoyo_aggregator *ptr =
		container_of(element, typeof(*ptr), head.list);
	tomoyo_put_name(ptr->original_name);
	tomoyo_put_name(ptr->aggregated_name);
}

static void tomoyo_del_manager(struct list_head *element)
{
	struct tomoyo_manager *ptr =
		container_of(element, typeof(*ptr), head.list);
	tomoyo_put_name(ptr->manager);
}

static void tomoyo_del_acl(struct list_head *element)
{
	struct tomoyo_acl_info *acl =
		container_of(element, typeof(*acl), list);
	switch (acl->type) {
	case TOMOYO_TYPE_PATH_ACL:
		{
			struct tomoyo_path_acl *entry
				= container_of(acl, typeof(*entry), head);
			tomoyo_put_name_union(&entry->name);
		}
		break;
	case TOMOYO_TYPE_PATH2_ACL:
		{
			struct tomoyo_path2_acl *entry
				= container_of(acl, typeof(*entry), head);
			tomoyo_put_name_union(&entry->name1);
			tomoyo_put_name_union(&entry->name2);
		}
		break;
	case TOMOYO_TYPE_PATH_NUMBER_ACL:
		{
			struct tomoyo_path_number_acl *entry
				= container_of(acl, typeof(*entry), head);
			tomoyo_put_name_union(&entry->name);
			tomoyo_put_number_union(&entry->number);
		}
		break;
	case TOMOYO_TYPE_MKDEV_ACL:
		{
			struct tomoyo_mkdev_acl *entry
				= container_of(acl, typeof(*entry), head);
			tomoyo_put_name_union(&entry->name);
			tomoyo_put_number_union(&entry->mode);
			tomoyo_put_number_union(&entry->major);
			tomoyo_put_number_union(&entry->minor);
		}
		break;
	case TOMOYO_TYPE_MOUNT_ACL:
		{
			struct tomoyo_mount_acl *entry
				= container_of(acl, typeof(*entry), head);
			tomoyo_put_name_union(&entry->dev_name);
			tomoyo_put_name_union(&entry->dir_name);
			tomoyo_put_name_union(&entry->fs_type);
			tomoyo_put_number_union(&entry->flags);
		}
		break;
	}
}

static bool tomoyo_del_domain(struct list_head *element)
{
	struct tomoyo_domain_info *domain =
		container_of(element, typeof(*domain), list);
	struct tomoyo_acl_info *acl;
	struct tomoyo_acl_info *tmp;
	/*
	 * Since we don't protect whole execve() operation using SRCU,
	 * we need to recheck domain->users at this point.
	 *
	 * (1) Reader starts SRCU section upon execve().
	 * (2) Reader traverses tomoyo_domain_list and finds this domain.
	 * (3) Writer marks this domain as deleted.
	 * (4) Garbage collector removes this domain from tomoyo_domain_list
	 *     because this domain is marked as deleted and used by nobody.
	 * (5) Reader saves reference to this domain into
	 *     "struct linux_binprm"->cred->security .
	 * (6) Reader finishes SRCU section, although execve() operation has
	 *     not finished yet.
	 * (7) Garbage collector waits for SRCU synchronization.
	 * (8) Garbage collector kfree() this domain because this domain is
	 *     used by nobody.
	 * (9) Reader finishes execve() operation and restores this domain from
	 *     "struct linux_binprm"->cred->security.
	 *
	 * By updating domain->users at (5), we can solve this race problem
	 * by rechecking domain->users at (8).
	 */
	if (atomic_read(&domain->users))
		return false;
	list_for_each_entry_safe(acl, tmp, &domain->acl_info_list, list) {
		tomoyo_del_acl(&acl->list);
		tomoyo_memory_free(acl);
	}
	tomoyo_put_name(domain->domainname);
	return true;
}


static void tomoyo_del_name(struct list_head *element)
{
	const struct tomoyo_name *ptr =
		container_of(element, typeof(*ptr), list);
}

static void tomoyo_del_path_group(struct list_head *element)
{
	struct tomoyo_path_group *member =
		container_of(element, typeof(*member), head.list);
	tomoyo_put_name(member->member_name);
}

static void tomoyo_del_group(struct list_head *element)
{
	struct tomoyo_group *group =
		container_of(element, typeof(*group), list);
	tomoyo_put_name(group->group_name);
}

static void tomoyo_del_number_group(struct list_head *element)
{
	struct tomoyo_number_group *member =
		container_of(element, typeof(*member), head.list);
}

static bool tomoyo_collect_member(struct list_head *member_list, int id)
{
	struct tomoyo_acl_head *member;
	list_for_each_entry(member, member_list, list) {
		if (!member->is_deleted)
			continue;
		if (!tomoyo_add_to_gc(id, &member->list))
			return false;
	}
        return true;
}

static bool tomoyo_collect_acl(struct tomoyo_domain_info *domain)
{
	struct tomoyo_acl_info *acl;
	list_for_each_entry(acl, &domain->acl_info_list, list) {
		if (!acl->is_deleted)
			continue;
		if (!tomoyo_add_to_gc(TOMOYO_ID_ACL, &acl->list))
			return false;
	}
	return true;
}

static void tomoyo_collect_entry(void)
{
	int i;
	if (mutex_lock_interruptible(&tomoyo_policy_lock))
		return;
	for (i = 0; i < TOMOYO_MAX_POLICY; i++) {
		if (!tomoyo_collect_member(&tomoyo_policy_list[i], i))
			goto unlock;
	}
	{
		struct tomoyo_domain_info *domain;
		list_for_each_entry_rcu(domain, &tomoyo_domain_list, list) {
			if (!tomoyo_collect_acl(domain))
				goto unlock;
			if (!domain->is_deleted || atomic_read(&domain->users))
				continue;
			/*
			 * Nobody is referring this domain. But somebody may
			 * refer this domain after successful execve().
			 * We recheck domain->users after SRCU synchronization.
			 */
			if (!tomoyo_add_to_gc(TOMOYO_ID_DOMAIN, &domain->list))
				goto unlock;
		}
	}
	for (i = 0; i < TOMOYO_MAX_HASH; i++) {
		struct tomoyo_name *ptr;
		list_for_each_entry_rcu(ptr, &tomoyo_name_list[i], list) {
			if (atomic_read(&ptr->users))
				continue;
			if (!tomoyo_add_to_gc(TOMOYO_ID_NAME, &ptr->list))
				goto unlock;
		}
	}
	for (i = 0; i < TOMOYO_MAX_GROUP; i++) {
		struct list_head *list = &tomoyo_group_list[i];
		int id;
		struct tomoyo_group *group;
		switch (i) {
		case 0:
			id = TOMOYO_ID_PATH_GROUP;
			break;
		default:
			id = TOMOYO_ID_NUMBER_GROUP;
			break;
		}
		list_for_each_entry(group, list, list) {
			if (!tomoyo_collect_member(&group->member_list, id))
				goto unlock;
			if (!list_empty(&group->member_list) ||
			    atomic_read(&group->users))
				continue;
			if (!tomoyo_add_to_gc(TOMOYO_ID_GROUP, &group->list))
				goto unlock;
		}
	}
 unlock:
	mutex_unlock(&tomoyo_policy_lock);
}

static void tomoyo_kfree_entry(void)
{
	struct tomoyo_gc *p;
	struct tomoyo_gc *tmp;

	list_for_each_entry_safe(p, tmp, &tomoyo_gc_queue, list) {
		struct list_head *element = p->element;
		switch (p->type) {
		case TOMOYO_ID_TRANSITION_CONTROL:
			tomoyo_del_transition_control(element);
			break;
		case TOMOYO_ID_AGGREGATOR:
			tomoyo_del_aggregator(element);
			break;
		case TOMOYO_ID_MANAGER:
			tomoyo_del_manager(element);
			break;
		case TOMOYO_ID_NAME:
			tomoyo_del_name(element);
			break;
		case TOMOYO_ID_ACL:
			tomoyo_del_acl(element);
			break;
		case TOMOYO_ID_DOMAIN:
			if (!tomoyo_del_domain(element))
				continue;
			break;
		case TOMOYO_ID_PATH_GROUP:
			tomoyo_del_path_group(element);
			break;
		case TOMOYO_ID_GROUP:
			tomoyo_del_group(element);
			break;
		case TOMOYO_ID_NUMBER_GROUP:
			tomoyo_del_number_group(element);
			break;
		}
		tomoyo_memory_free(element);
		list_del(&p->list);
		kfree(p);
	}
}

static int tomoyo_gc_thread(void *unused)
{
	daemonize("GC for TOMOYO");
	if (mutex_trylock(&tomoyo_gc_mutex)) {
		int i;
		for (i = 0; i < 10; i++) {
			tomoyo_collect_entry();
			if (list_empty(&tomoyo_gc_queue))
				break;
			synchronize_srcu(&tomoyo_ss);
			tomoyo_kfree_entry();
		}
		mutex_unlock(&tomoyo_gc_mutex);
	}
	do_exit(0);
}

void tomoyo_run_gc(void)
{
	struct task_struct *task = kthread_create(tomoyo_gc_thread, NULL,
						  "GC for TOMOYO");
	if (!IS_ERR(task))
		wake_up_process(task);
}
Commit	Line	Data
847b173e TH	1	/*
	2	* security/tomoyo/gc.c
	3	*
	4	* Implementation of the Domain-Based Mandatory Access Control.
	5	*
	6	* Copyright (C) 2005-2010 NTT DATA CORPORATION
	7	*
	8	*/
	9
	10	#include "common.h"
	11	#include <linux/kthread.h>
5a0e3ad6	12	#include <linux/slab.h>
847b173e	13
e2bf6907	14	struct tomoyo_gc {
847b173e TH	15	struct list_head list;
847b173e TH	16	int type;
e79acf0e	17	struct list_head *element;
847b173e TH	18	};
	19	static LIST_HEAD(tomoyo_gc_queue);
	20	static DEFINE_MUTEX(tomoyo_gc_mutex);
	21
	22	/* Caller holds tomoyo_policy_lock mutex. */
e79acf0e	23	static bool tomoyo_add_to_gc(const int type, struct list_head *element)
847b173e	24	{
e2bf6907	25	struct tomoyo_gc entry = kzalloc(sizeof(entry), GFP_ATOMIC);
847b173e TH	26	if (!entry)
	27	return false;
	28	entry->type = type;
	29	entry->element = element;
	30	list_add(&entry->list, &tomoyo_gc_queue);
e79acf0e	31	list_del_rcu(element);
847b173e TH	32	return true;
	33	}
	34
5448ec4f	35	static void tomoyo_del_transition_control(struct list_head *element)
847b173e	36	{
5448ec4f	37	struct tomoyo_transition_control *ptr =
e79acf0e	38	container_of(element, typeof(*ptr), head.list);
847b173e TH	39	tomoyo_put_name(ptr->domainname);
	40	tomoyo_put_name(ptr->program);
	41	}
	42
e79acf0e	43	static void tomoyo_del_aggregator(struct list_head *element)
1084307c	44	{
e2bf6907	45	struct tomoyo_aggregator *ptr =
e79acf0e	46	container_of(element, typeof(*ptr), head.list);
1084307c TH	47	tomoyo_put_name(ptr->original_name);
	48	tomoyo_put_name(ptr->aggregated_name);
	49	}
	50
e79acf0e	51	static void tomoyo_del_manager(struct list_head *element)
847b173e	52	{
e2bf6907	53	struct tomoyo_manager *ptr =
e79acf0e	54	container_of(element, typeof(*ptr), head.list);
847b173e TH	55	tomoyo_put_name(ptr->manager);
	56	}
	57
e79acf0e	58	static void tomoyo_del_acl(struct list_head *element)
847b173e	59	{
e79acf0e TH	60	struct tomoyo_acl_info *acl =
e79acf0e TH	61	container_of(element, typeof(*acl), list);
847b173e	62	switch (acl->type) {
7ef61233	63	case TOMOYO_TYPE_PATH_ACL:
847b173e	64	{
7ef61233	65	struct tomoyo_path_acl *entry
847b173e	66	= container_of(acl, typeof(*entry), head);
7762fbff	67	tomoyo_put_name_union(&entry->name);
847b173e TH	68	}
847b173e TH	69	break;
7ef61233	70	case TOMOYO_TYPE_PATH2_ACL:
847b173e	71	{
7ef61233	72	struct tomoyo_path2_acl *entry
847b173e	73	= container_of(acl, typeof(*entry), head);
7762fbff TH	74	tomoyo_put_name_union(&entry->name1);
7762fbff TH	75	tomoyo_put_name_union(&entry->name2);
847b173e TH	76	}
847b173e TH	77	break;
a1f9bb6a TH	78	case TOMOYO_TYPE_PATH_NUMBER_ACL:
	79	{
	80	struct tomoyo_path_number_acl *entry
	81	= container_of(acl, typeof(*entry), head);
	82	tomoyo_put_name_union(&entry->name);
	83	tomoyo_put_number_union(&entry->number);
	84	}
	85	break;
75093152	86	case TOMOYO_TYPE_MKDEV_ACL:
a1f9bb6a	87	{
75093152	88	struct tomoyo_mkdev_acl *entry
a1f9bb6a TH	89	= container_of(acl, typeof(*entry), head);
	90	tomoyo_put_name_union(&entry->name);
	91	tomoyo_put_number_union(&entry->mode);
	92	tomoyo_put_number_union(&entry->major);
	93	tomoyo_put_number_union(&entry->minor);
	94	}
	95	break;
2106ccd9 TH	96	case TOMOYO_TYPE_MOUNT_ACL:
	97	{
	98	struct tomoyo_mount_acl *entry
	99	= container_of(acl, typeof(*entry), head);
	100	tomoyo_put_name_union(&entry->dev_name);
	101	tomoyo_put_name_union(&entry->dir_name);
	102	tomoyo_put_name_union(&entry->fs_type);
	103	tomoyo_put_number_union(&entry->flags);
	104	}
	105	break;
847b173e TH	106	}
	107	}
	108
e79acf0e	109	static bool tomoyo_del_domain(struct list_head *element)
847b173e	110	{
e79acf0e TH	111	struct tomoyo_domain_info *domain =
e79acf0e TH	112	container_of(element, typeof(*domain), list);
847b173e TH	113	struct tomoyo_acl_info *acl;
	114	struct tomoyo_acl_info *tmp;
	115	/*
	116	* Since we don't protect whole execve() operation using SRCU,
	117	* we need to recheck domain->users at this point.
	118	*
	119	* (1) Reader starts SRCU section upon execve().
	120	* (2) Reader traverses tomoyo_domain_list and finds this domain.
	121	* (3) Writer marks this domain as deleted.
	122	* (4) Garbage collector removes this domain from tomoyo_domain_list
	123	* because this domain is marked as deleted and used by nobody.
	124	* (5) Reader saves reference to this domain into
	125	* "struct linux_binprm"->cred->security .
	126	* (6) Reader finishes SRCU section, although execve() operation has
	127	* not finished yet.
	128	* (7) Garbage collector waits for SRCU synchronization.
	129	* (8) Garbage collector kfree() this domain because this domain is
	130	* used by nobody.
	131	* (9) Reader finishes execve() operation and restores this domain from
	132	* "struct linux_binprm"->cred->security.
	133	*
	134	* By updating domain->users at (5), we can solve this race problem
	135	* by rechecking domain->users at (8).
	136	*/
	137	if (atomic_read(&domain->users))
	138	return false;
	139	list_for_each_entry_safe(acl, tmp, &domain->acl_info_list, list) {
e79acf0e	140	tomoyo_del_acl(&acl->list);
847b173e TH	141	tomoyo_memory_free(acl);
	142	}
	143	tomoyo_put_name(domain->domainname);
	144	return true;
	145	}
	146
	147
e79acf0e	148	static void tomoyo_del_name(struct list_head *element)
847b173e	149	{
e2bf6907	150	const struct tomoyo_name *ptr =
e79acf0e	151	container_of(element, typeof(*ptr), list);
847b173e TH	152	}
847b173e TH	153
a98aa4de	154	static void tomoyo_del_path_group(struct list_head *element)
7762fbff	155	{
a98aa4de	156	struct tomoyo_path_group *member =
e79acf0e	157	container_of(element, typeof(*member), head.list);
7762fbff TH	158	tomoyo_put_name(member->member_name);
	159	}
	160
a98aa4de	161	static void tomoyo_del_group(struct list_head *element)
7762fbff	162	{
a98aa4de	163	struct tomoyo_group *group =
e79acf0e	164	container_of(element, typeof(*group), list);
7762fbff TH	165	tomoyo_put_name(group->group_name);
	166	}
	167
e79acf0e	168	static void tomoyo_del_number_group(struct list_head *element)
4c3e9e2d	169	{
a98aa4de TH	170	struct tomoyo_number_group *member =
a98aa4de TH	171	container_of(element, typeof(*member), head.list);
4c3e9e2d TH	172	}
4c3e9e2d TH	173
d2f8b234 TH	174	static bool tomoyo_collect_member(struct list_head *member_list, int id)
	175	{
	176	struct tomoyo_acl_head *member;
	177	list_for_each_entry(member, member_list, list) {
	178	if (!member->is_deleted)
	179	continue;
	180	if (!tomoyo_add_to_gc(id, &member->list))
	181	return false;
d2f8b234 TH	182	}
	183	return true;
	184	}
	185
	186	static bool tomoyo_collect_acl(struct tomoyo_domain_info *domain)
	187	{
	188	struct tomoyo_acl_info *acl;
	189	list_for_each_entry(acl, &domain->acl_info_list, list) {
	190	if (!acl->is_deleted)
	191	continue;
	192	if (!tomoyo_add_to_gc(TOMOYO_ID_ACL, &acl->list))
	193	return false;
d2f8b234 TH	194	}
	195	return true;
	196	}
	197
847b173e TH	198	static void tomoyo_collect_entry(void)
847b173e TH	199	{
d2f8b234	200	int i;
29282381 TH	201	if (mutex_lock_interruptible(&tomoyo_policy_lock))
29282381 TH	202	return;
d2f8b234	203	for (i = 0; i < TOMOYO_MAX_POLICY; i++) {
a230f9e7 TH	204	if (!tomoyo_collect_member(&tomoyo_policy_list[i], i))
a230f9e7 TH	205	goto unlock;
847b173e TH	206	}
	207	{
	208	struct tomoyo_domain_info *domain;
	209	list_for_each_entry_rcu(domain, &tomoyo_domain_list, list) {
d2f8b234 TH	210	if (!tomoyo_collect_acl(domain))
d2f8b234 TH	211	goto unlock;
847b173e TH	212	if (!domain->is_deleted \|\| atomic_read(&domain->users))
	213	continue;
	214	/*
	215	* Nobody is referring this domain. But somebody may
	216	* refer this domain after successful execve().
	217	* We recheck domain->users after SRCU synchronization.
	218	*/
e79acf0e	219	if (!tomoyo_add_to_gc(TOMOYO_ID_DOMAIN, &domain->list))
d2f8b234	220	goto unlock;
847b173e TH	221	}
847b173e TH	222	}
d2f8b234	223	for (i = 0; i < TOMOYO_MAX_HASH; i++) {
e2bf6907	224	struct tomoyo_name *ptr;
d2f8b234 TH	225	list_for_each_entry_rcu(ptr, &tomoyo_name_list[i], list) {
	226	if (atomic_read(&ptr->users))
	227	continue;
e79acf0e	228	if (!tomoyo_add_to_gc(TOMOYO_ID_NAME, &ptr->list))
d2f8b234	229	goto unlock;
847b173e TH	230	}
847b173e TH	231	}
7c2ea22e TH	232	for (i = 0; i < TOMOYO_MAX_GROUP; i++) {
	233	struct list_head *list = &tomoyo_group_list[i];
	234	int id;
a98aa4de	235	struct tomoyo_group *group;
7c2ea22e TH	236	switch (i) {
	237	case 0:
	238	id = TOMOYO_ID_PATH_GROUP;
	239	break;
	240	default:
	241	id = TOMOYO_ID_NUMBER_GROUP;
	242	break;
7762fbff	243	}
7c2ea22e TH	244	list_for_each_entry(group, list, list) {
	245	if (!tomoyo_collect_member(&group->member_list, id))
	246	goto unlock;
4c3e9e2d TH	247	if (!list_empty(&group->member_list) \|\|
	248	atomic_read(&group->users))
	249	continue;
7c2ea22e	250	if (!tomoyo_add_to_gc(TOMOYO_ID_GROUP, &group->list))
d2f8b234	251	goto unlock;
4c3e9e2d TH	252	}
4c3e9e2d TH	253	}
d2f8b234	254	unlock:
29282381	255	mutex_unlock(&tomoyo_policy_lock);
847b173e TH	256	}
	257
	258	static void tomoyo_kfree_entry(void)
	259	{
e2bf6907 TH	260	struct tomoyo_gc *p;
e2bf6907 TH	261	struct tomoyo_gc *tmp;
847b173e TH	262
847b173e TH	263	list_for_each_entry_safe(p, tmp, &tomoyo_gc_queue, list) {
e79acf0e	264	struct list_head *element = p->element;
847b173e	265	switch (p->type) {
5448ec4f TH	266	case TOMOYO_ID_TRANSITION_CONTROL:
5448ec4f TH	267	tomoyo_del_transition_control(element);
847b173e	268	break;
1084307c	269	case TOMOYO_ID_AGGREGATOR:
e79acf0e	270	tomoyo_del_aggregator(element);
1084307c	271	break;
847b173e	272	case TOMOYO_ID_MANAGER:
e79acf0e	273	tomoyo_del_manager(element);
847b173e TH	274	break;
847b173e TH	275	case TOMOYO_ID_NAME:
e79acf0e	276	tomoyo_del_name(element);
847b173e TH	277	break;
847b173e TH	278	case TOMOYO_ID_ACL:
e79acf0e	279	tomoyo_del_acl(element);
847b173e TH	280	break;
847b173e TH	281	case TOMOYO_ID_DOMAIN:
e79acf0e	282	if (!tomoyo_del_domain(element))
847b173e TH	283	continue;
847b173e TH	284	break;
7762fbff	285	case TOMOYO_ID_PATH_GROUP:
e79acf0e	286	tomoyo_del_path_group(element);
7762fbff	287	break;
a98aa4de TH	288	case TOMOYO_ID_GROUP:
a98aa4de TH	289	tomoyo_del_group(element);
4c3e9e2d TH	290	break;
4c3e9e2d TH	291	case TOMOYO_ID_NUMBER_GROUP:
e79acf0e	292	tomoyo_del_number_group(element);
847b173e TH	293	break;
847b173e TH	294	}
e79acf0e	295	tomoyo_memory_free(element);
847b173e TH	296	list_del(&p->list);
	297	kfree(p);
	298	}
	299	}
	300
	301	static int tomoyo_gc_thread(void *unused)
	302	{
	303	daemonize("GC for TOMOYO");
	304	if (mutex_trylock(&tomoyo_gc_mutex)) {
	305	int i;
	306	for (i = 0; i < 10; i++) {
	307	tomoyo_collect_entry();
	308	if (list_empty(&tomoyo_gc_queue))
	309	break;
	310	synchronize_srcu(&tomoyo_ss);
	311	tomoyo_kfree_entry();
	312	}
	313	mutex_unlock(&tomoyo_gc_mutex);
	314	}
	315	do_exit(0);
	316	}
	317
	318	void tomoyo_run_gc(void)
	319	{
	320	struct task_struct *task = kthread_create(tomoyo_gc_thread, NULL,
	321	"GC for TOMOYO");
	322	if (!IS_ERR(task))
	323	wake_up_process(task);
	324	}