4 * Implementation of the Domain-Based Mandatory Access Control.
6 * Copyright (C) 2005-2010 NTT DATA CORPORATION
11 #include <linux/kthread.h>
12 #include <linux/slab.h>
15 struct list_head list
;
16 enum tomoyo_policy_id type
;
17 struct list_head
*element
;
19 static LIST_HEAD(tomoyo_gc_queue
);
20 static DEFINE_MUTEX(tomoyo_gc_mutex
);
23 * tomoyo_add_to_gc - Add an entry to to be deleted list.
25 * @type: One of values in "enum tomoyo_policy_id".
26 * @element: Pointer to "struct list_head".
28 * Returns true on success, false otherwise.
30 * Caller holds tomoyo_policy_lock mutex.
32 * Adding an entry needs kmalloc(). Thus, if we try to add thousands of
33 * entries at once, it will take too long time. Thus, do not add more than 128
34 * entries per a scan. But to be able to handle worst case where all entries
35 * are in-use, we accept one more entry per a scan.
37 * If we use singly linked list using "struct list_head"->prev (which is
38 * LIST_POISON2), we can avoid kmalloc().
40 static bool tomoyo_add_to_gc(const int type
, struct list_head
*element
)
42 struct tomoyo_gc
*entry
= kzalloc(sizeof(*entry
), GFP_ATOMIC
);
46 entry
->element
= element
;
47 list_add(&entry
->list
, &tomoyo_gc_queue
);
48 list_del_rcu(element
);
53 * tomoyo_del_transition_control - Delete members in "struct tomoyo_transition_control".
55 * @element: Pointer to "struct list_head".
59 static void tomoyo_del_transition_control(struct list_head
*element
)
61 struct tomoyo_transition_control
*ptr
=
62 container_of(element
, typeof(*ptr
), head
.list
);
63 tomoyo_put_name(ptr
->domainname
);
64 tomoyo_put_name(ptr
->program
);
68 * tomoyo_del_aggregator - Delete members in "struct tomoyo_aggregator".
70 * @element: Pointer to "struct list_head".
74 static void tomoyo_del_aggregator(struct list_head
*element
)
76 struct tomoyo_aggregator
*ptr
=
77 container_of(element
, typeof(*ptr
), head
.list
);
78 tomoyo_put_name(ptr
->original_name
);
79 tomoyo_put_name(ptr
->aggregated_name
);
83 * tomoyo_del_manager - Delete members in "struct tomoyo_manager".
85 * @element: Pointer to "struct list_head".
89 static void tomoyo_del_manager(struct list_head
*element
)
91 struct tomoyo_manager
*ptr
=
92 container_of(element
, typeof(*ptr
), head
.list
);
93 tomoyo_put_name(ptr
->manager
);
97 * tomoyo_del_acl - Delete members in "struct tomoyo_acl_info".
99 * @element: Pointer to "struct list_head".
103 static void tomoyo_del_acl(struct list_head
*element
)
105 struct tomoyo_acl_info
*acl
=
106 container_of(element
, typeof(*acl
), list
);
108 case TOMOYO_TYPE_PATH_ACL
:
110 struct tomoyo_path_acl
*entry
111 = container_of(acl
, typeof(*entry
), head
);
112 tomoyo_put_name_union(&entry
->name
);
115 case TOMOYO_TYPE_PATH2_ACL
:
117 struct tomoyo_path2_acl
*entry
118 = container_of(acl
, typeof(*entry
), head
);
119 tomoyo_put_name_union(&entry
->name1
);
120 tomoyo_put_name_union(&entry
->name2
);
123 case TOMOYO_TYPE_PATH_NUMBER_ACL
:
125 struct tomoyo_path_number_acl
*entry
126 = container_of(acl
, typeof(*entry
), head
);
127 tomoyo_put_name_union(&entry
->name
);
128 tomoyo_put_number_union(&entry
->number
);
131 case TOMOYO_TYPE_MKDEV_ACL
:
133 struct tomoyo_mkdev_acl
*entry
134 = container_of(acl
, typeof(*entry
), head
);
135 tomoyo_put_name_union(&entry
->name
);
136 tomoyo_put_number_union(&entry
->mode
);
137 tomoyo_put_number_union(&entry
->major
);
138 tomoyo_put_number_union(&entry
->minor
);
141 case TOMOYO_TYPE_MOUNT_ACL
:
143 struct tomoyo_mount_acl
*entry
144 = container_of(acl
, typeof(*entry
), head
);
145 tomoyo_put_name_union(&entry
->dev_name
);
146 tomoyo_put_name_union(&entry
->dir_name
);
147 tomoyo_put_name_union(&entry
->fs_type
);
148 tomoyo_put_number_union(&entry
->flags
);
154 static bool tomoyo_del_domain(struct list_head
*element
)
156 struct tomoyo_domain_info
*domain
=
157 container_of(element
, typeof(*domain
), list
);
158 struct tomoyo_acl_info
*acl
;
159 struct tomoyo_acl_info
*tmp
;
161 * Since we don't protect whole execve() operation using SRCU,
162 * we need to recheck domain->users at this point.
164 * (1) Reader starts SRCU section upon execve().
165 * (2) Reader traverses tomoyo_domain_list and finds this domain.
166 * (3) Writer marks this domain as deleted.
167 * (4) Garbage collector removes this domain from tomoyo_domain_list
168 * because this domain is marked as deleted and used by nobody.
169 * (5) Reader saves reference to this domain into
170 * "struct linux_binprm"->cred->security .
171 * (6) Reader finishes SRCU section, although execve() operation has
173 * (7) Garbage collector waits for SRCU synchronization.
174 * (8) Garbage collector kfree() this domain because this domain is
176 * (9) Reader finishes execve() operation and restores this domain from
177 * "struct linux_binprm"->cred->security.
179 * By updating domain->users at (5), we can solve this race problem
180 * by rechecking domain->users at (8).
182 if (atomic_read(&domain
->users
))
184 list_for_each_entry_safe(acl
, tmp
, &domain
->acl_info_list
, list
) {
185 tomoyo_del_acl(&acl
->list
);
186 tomoyo_memory_free(acl
);
188 tomoyo_put_name(domain
->domainname
);
194 * tomoyo_del_name - Delete members in "struct tomoyo_name".
196 * @element: Pointer to "struct list_head".
200 static void tomoyo_del_name(struct list_head
*element
)
202 const struct tomoyo_name
*ptr
=
203 container_of(element
, typeof(*ptr
), head
.list
);
207 * tomoyo_del_path_group - Delete members in "struct tomoyo_path_group".
209 * @element: Pointer to "struct list_head".
213 static void tomoyo_del_path_group(struct list_head
*element
)
215 struct tomoyo_path_group
*member
=
216 container_of(element
, typeof(*member
), head
.list
);
217 tomoyo_put_name(member
->member_name
);
221 * tomoyo_del_group - Delete "struct tomoyo_group".
223 * @element: Pointer to "struct list_head".
227 static void tomoyo_del_group(struct list_head
*element
)
229 struct tomoyo_group
*group
=
230 container_of(element
, typeof(*group
), head
.list
);
231 tomoyo_put_name(group
->group_name
);
235 * tomoyo_del_number_group - Delete members in "struct tomoyo_number_group".
237 * @element: Pointer to "struct list_head".
241 static void tomoyo_del_number_group(struct list_head
*element
)
243 struct tomoyo_number_group
*member
=
244 container_of(element
, typeof(*member
), head
.list
);
248 * tomoyo_collect_member - Delete elements with "struct tomoyo_acl_head".
250 * @id: One of values in "enum tomoyo_policy_id".
251 * @member_list: Pointer to "struct list_head".
253 * Returns true if some elements are deleted, false otherwise.
255 static bool tomoyo_collect_member(const enum tomoyo_policy_id id
,
256 struct list_head
*member_list
)
258 struct tomoyo_acl_head
*member
;
259 list_for_each_entry(member
, member_list
, list
) {
260 if (!member
->is_deleted
)
262 if (!tomoyo_add_to_gc(id
, &member
->list
))
268 static bool tomoyo_collect_acl(struct tomoyo_domain_info
*domain
)
270 struct tomoyo_acl_info
*acl
;
271 list_for_each_entry(acl
, &domain
->acl_info_list
, list
) {
272 if (!acl
->is_deleted
)
274 if (!tomoyo_add_to_gc(TOMOYO_ID_ACL
, &acl
->list
))
281 * tomoyo_collect_entry - Scan lists for deleted elements.
285 static void tomoyo_collect_entry(void)
288 if (mutex_lock_interruptible(&tomoyo_policy_lock
))
290 for (i
= 0; i
< TOMOYO_MAX_POLICY
; i
++) {
291 if (!tomoyo_collect_member(i
, &tomoyo_policy_list
[i
]))
295 struct tomoyo_domain_info
*domain
;
296 list_for_each_entry_rcu(domain
, &tomoyo_domain_list
, list
) {
297 if (!tomoyo_collect_acl(domain
))
299 if (!domain
->is_deleted
|| atomic_read(&domain
->users
))
302 * Nobody is referring this domain. But somebody may
303 * refer this domain after successful execve().
304 * We recheck domain->users after SRCU synchronization.
306 if (!tomoyo_add_to_gc(TOMOYO_ID_DOMAIN
, &domain
->list
))
310 for (i
= 0; i
< TOMOYO_MAX_HASH
; i
++) {
311 struct tomoyo_name
*ptr
;
312 list_for_each_entry_rcu(ptr
, &tomoyo_name_list
[i
], head
.list
) {
313 if (atomic_read(&ptr
->head
.users
))
315 if (!tomoyo_add_to_gc(TOMOYO_ID_NAME
, &ptr
->head
.list
))
319 for (i
= 0; i
< TOMOYO_MAX_GROUP
; i
++) {
320 struct list_head
*list
= &tomoyo_group_list
[i
];
322 struct tomoyo_group
*group
;
325 id
= TOMOYO_ID_PATH_GROUP
;
328 id
= TOMOYO_ID_NUMBER_GROUP
;
331 list_for_each_entry(group
, list
, head
.list
) {
332 if (!tomoyo_collect_member(id
, &group
->member_list
))
334 if (!list_empty(&group
->member_list
) ||
335 atomic_read(&group
->head
.users
))
337 if (!tomoyo_add_to_gc(TOMOYO_ID_GROUP
,
343 mutex_unlock(&tomoyo_policy_lock
);
346 static void tomoyo_kfree_entry(void)
349 struct tomoyo_gc
*tmp
;
351 list_for_each_entry_safe(p
, tmp
, &tomoyo_gc_queue
, list
) {
352 struct list_head
*element
= p
->element
;
354 case TOMOYO_ID_TRANSITION_CONTROL
:
355 tomoyo_del_transition_control(element
);
357 case TOMOYO_ID_AGGREGATOR
:
358 tomoyo_del_aggregator(element
);
360 case TOMOYO_ID_MANAGER
:
361 tomoyo_del_manager(element
);
364 tomoyo_del_name(element
);
367 tomoyo_del_acl(element
);
369 case TOMOYO_ID_DOMAIN
:
370 if (!tomoyo_del_domain(element
))
373 case TOMOYO_ID_PATH_GROUP
:
374 tomoyo_del_path_group(element
);
376 case TOMOYO_ID_GROUP
:
377 tomoyo_del_group(element
);
379 case TOMOYO_ID_NUMBER_GROUP
:
380 tomoyo_del_number_group(element
);
382 case TOMOYO_MAX_POLICY
:
385 tomoyo_memory_free(element
);
392 * tomoyo_gc_thread - Garbage collector thread function.
396 * In case OOM-killer choose this thread for termination, we create this thread
397 * as a short live thread whenever /sys/kernel/security/tomoyo/ interface was
402 static int tomoyo_gc_thread(void *unused
)
404 daemonize("GC for TOMOYO");
405 if (mutex_trylock(&tomoyo_gc_mutex
)) {
407 for (i
= 0; i
< 10; i
++) {
408 tomoyo_collect_entry();
409 if (list_empty(&tomoyo_gc_queue
))
411 synchronize_srcu(&tomoyo_ss
);
412 tomoyo_kfree_entry();
414 mutex_unlock(&tomoyo_gc_mutex
);
419 void tomoyo_run_gc(void)
421 struct task_struct
*task
= kthread_create(tomoyo_gc_thread
, NULL
,
424 wake_up_process(task
);