オープンソース・ソフトウェアの開発とダウンロード

TOMOYO

Subversion リポジトリの参照

/[tomoyo]/branches/ccs-patch/security/ccsecurity/policy_io.c

Diff of /branches/ccs-patch/security/ccsecurity/policy_io.c

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 2991 by kumaneko, Fri Sep 4 03:58:47 2009 UTC revision 3534 by kumaneko, Thu Mar 25 06:16:09 2010 UTC
# Line 1  Line 1 
1  /*  /*
2   * security/ccsecurity/policy_io.c   * security/ccsecurity/policy_io.c
3   *   *
4   * Copyright (C) 2005-2009  NTT DATA CORPORATION   * Copyright (C) 2005-2010  NTT DATA CORPORATION
5   *   *
6   * Version: 1.7.0   2009/09/04   * Version: 1.7.2-pre   2010/03/21
7   *   *
8   * This file is applicable to both 2.4.30 and 2.6.11 and later.   * This file is applicable to both 2.4.30 and 2.6.11 and later.
9   * See README.ccs for ChangeLog.   * See README.ccs for ChangeLog.
# Line 16  static struct ccs_profile ccs_default_pr Line 16  static struct ccs_profile ccs_default_pr
16          .learning = &ccs_default_profile.preference,          .learning = &ccs_default_profile.preference,
17          .permissive = &ccs_default_profile.preference,          .permissive = &ccs_default_profile.preference,
18          .enforcing = &ccs_default_profile.preference,          .enforcing = &ccs_default_profile.preference,
 #ifdef CONFIG_CCSECURITY_AUDIT  
19          .audit = &ccs_default_profile.preference,          .audit = &ccs_default_profile.preference,
20    #ifdef CONFIG_CCSECURITY_AUDIT
21          .preference.audit_max_grant_log = CONFIG_CCSECURITY_MAX_GRANT_LOG,          .preference.audit_max_grant_log = CONFIG_CCSECURITY_MAX_GRANT_LOG,
22          .preference.audit_max_reject_log = CONFIG_CCSECURITY_MAX_REJECT_LOG,          .preference.audit_max_reject_log = CONFIG_CCSECURITY_MAX_REJECT_LOG,
23  #endif  #endif
24            .preference.audit_task_info = true,
25            .preference.audit_path_info = true,
26          .preference.enforcing_penalty = 0,          .preference.enforcing_penalty = 0,
27          .preference.enforcing_verbose = true,          .preference.enforcing_verbose = true,
28          .preference.learning_max_entry = CONFIG_CCSECURITY_MAX_ACCEPT_ENTRY,          .preference.learning_max_entry = CONFIG_CCSECURITY_MAX_ACCEPT_ENTRY,
# Line 31  static struct ccs_profile ccs_default_pr Line 33  static struct ccs_profile ccs_default_pr
33          .preference.permissive_verbose = true          .preference.permissive_verbose = true
34  };  };
35    
36    /* Profile version. Currently only 20090903 is defined. */
37    static unsigned int ccs_profile_version;
38    
39  /* Profile table. Memory is allocated as needed. */  /* Profile table. Memory is allocated as needed. */
40  static struct ccs_profile *ccs_profile_ptr[CCS_MAX_PROFILES];  static struct ccs_profile *ccs_profile_ptr[CCS_MAX_PROFILES];
41    
 /* Lock for protecting "struct ccs_profile"->comment  */  
 static DEFINE_SPINLOCK(ccs_profile_comment_lock);  
   
42  /* String table for functionality that takes 4 modes. */  /* String table for functionality that takes 4 modes. */
43  static const char *ccs_mode_4[4] = {  static const char *ccs_mode_4[4] = {
44          "disabled", "learning", "permissive", "enforcing"          "disabled", "learning", "permissive", "enforcing"
# Line 92  static const char *ccs_mac_keywords[CCS_ Line 94  static const char *ccs_mac_keywords[CCS_
94          = "file::umount",          = "file::umount",
95          [CCS_MAC_FILE_PIVOT_ROOT]          [CCS_MAC_FILE_PIVOT_ROOT]
96          = "file::pivot_root",          = "file::pivot_root",
97            [CCS_MAC_FILE_TRANSIT]
98            = "file::transit",
99          [CCS_MAC_ENVIRON]          [CCS_MAC_ENVIRON]
100          = "misc::env",          = "misc::env",
101          [CCS_MAC_NETWORK_UDP_BIND]          [CCS_MAC_NETWORK_UDP_BIND]
# Line 258  static struct ccs_profile *ccs_find_or_a Line 262  static struct ccs_profile *ccs_find_or_a
262          ptr = ccs_profile_ptr[profile];          ptr = ccs_profile_ptr[profile];
263          if (ptr)          if (ptr)
264                  return ptr;                  return ptr;
265          entry = kzalloc(sizeof(*entry), GFP_KERNEL);          entry = kzalloc(sizeof(*entry), CCS_GFP_FLAGS);
266          mutex_lock(&ccs_policy_lock);          if (mutex_lock_interruptible(&ccs_policy_lock))
267                    goto out;
268          ptr = ccs_profile_ptr[profile];          ptr = ccs_profile_ptr[profile];
269          if (!ptr && ccs_memory_ok(entry, sizeof(*entry))) {          if (!ptr && ccs_memory_ok(entry, sizeof(*entry))) {
270                  ptr = entry;                  ptr = entry;
 #ifdef CONFIG_CCSECURITY_AUDIT  
271                  ptr->audit = &ccs_default_profile.preference;                  ptr->audit = &ccs_default_profile.preference;
 #endif  
272                  ptr->learning = &ccs_default_profile.preference;                  ptr->learning = &ccs_default_profile.preference;
273                  ptr->permissive = &ccs_default_profile.preference;                  ptr->permissive = &ccs_default_profile.preference;
274                  ptr->enforcing = &ccs_default_profile.preference;                  ptr->enforcing = &ccs_default_profile.preference;
# Line 278  static struct ccs_profile *ccs_find_or_a Line 281  static struct ccs_profile *ccs_find_or_a
281                  entry = NULL;                  entry = NULL;
282          }          }
283          mutex_unlock(&ccs_policy_lock);          mutex_unlock(&ccs_policy_lock);
284     out:
285          kfree(entry);          kfree(entry);
286          return ptr;          return ptr;
287  }  }
# Line 285  static struct ccs_profile *ccs_find_or_a Line 289  static struct ccs_profile *ccs_find_or_a
289  /**  /**
290   * ccs_check_profile - Check all profiles currently assigned to domains are defined.   * ccs_check_profile - Check all profiles currently assigned to domains are defined.
291   */   */
292  void ccs_check_profile(void)  static void ccs_check_profile(void)
293  {  {
294          struct ccs_domain_info *domain;          struct ccs_domain_info *domain;
295          ccs_policy_loaded = true;          ccs_policy_loaded = true;
# Line 296  void ccs_check_profile(void) Line 300  void ccs_check_profile(void)
300                  panic("Profile %u (used by '%s') not defined.\n",                  panic("Profile %u (used by '%s') not defined.\n",
301                        profile, domain->domainname->name);                        profile, domain->domainname->name);
302          }          }
303            if (ccs_profile_version != 20090903)
304                    panic("Profile version %u is not supported.\n",
305                          ccs_profile_version);
306            printk(KERN_INFO "CCSecurity: 1.7.2-pre   2010/03/21\n");
307            printk(KERN_INFO "Mandatory Access Control activated.\n");
308  }  }
309    
310  /**  /**
# Line 331  static int ccs_write_profile(struct ccs_ Line 340  static int ccs_write_profile(struct ccs_
340          bool use_default = false;          bool use_default = false;
341          char *cp;          char *cp;
342          struct ccs_profile *profile;          struct ccs_profile *profile;
343            if (sscanf(data, "PROFILE_VERSION=%u", &ccs_profile_version) == 1)
344                    return 0;
345          i = simple_strtoul(data, &cp, 10);          i = simple_strtoul(data, &cp, 10);
346          if (data == cp) {          if (data == cp) {
347                  profile = &ccs_default_profile;                  profile = &ccs_default_profile;
# Line 354  static int ccs_write_profile(struct ccs_ Line 365  static int ccs_write_profile(struct ccs_
365                  value = 0;                  value = 0;
366          else          else
367                  value = -1;                  value = -1;
 #ifdef CONFIG_CCSECURITY_AUDIT  
368          if (!strcmp(data, "PREFERENCE::audit")) {          if (!strcmp(data, "PREFERENCE::audit")) {
369    #ifdef CONFIG_CCSECURITY_AUDIT
370                  char *cp2;                  char *cp2;
371    #endif
372                  if (use_default) {                  if (use_default) {
373                          profile->audit = &ccs_default_profile.preference;                          profile->audit = &ccs_default_profile.preference;
374                          return 0;                          return 0;
375                  }                  }
376                  profile->audit = &profile->preference;                  profile->audit = &profile->preference;
377    #ifdef CONFIG_CCSECURITY_AUDIT
378                  cp2 = strstr(cp, "max_grant_log=");                  cp2 = strstr(cp, "max_grant_log=");
379                  if (cp2)                  if (cp2)
380                          sscanf(cp2 + 14, "%u",                          sscanf(cp2 + 14, "%u",
# Line 370  static int ccs_write_profile(struct ccs_ Line 383  static int ccs_write_profile(struct ccs_
383                  if (cp2)                  if (cp2)
384                          sscanf(cp2 + 15, "%u",                          sscanf(cp2 + 15, "%u",
385                                 &profile->preference.audit_max_reject_log);                                 &profile->preference.audit_max_reject_log);
386    #endif
387                    if (strstr(cp, "task_info=yes"))
388                            profile->preference.audit_task_info = true;
389                    else if (strstr(cp, "task_info=no"))
390                            profile->preference.audit_task_info = false;
391                    if (strstr(cp, "path_info=yes"))
392                            profile->preference.audit_path_info = true;
393                    else if (strstr(cp, "path_info=no"))
394                            profile->preference.audit_path_info = false;
395                  return 0;                  return 0;
396          }          }
 #endif  
397          if (!strcmp(data, "PREFERENCE::enforcing")) {          if (!strcmp(data, "PREFERENCE::enforcing")) {
398                  char *cp2;                  char *cp2;
399                  if (use_default) {                  if (use_default) {
# Line 428  static int ccs_write_profile(struct ccs_ Line 449  static int ccs_write_profile(struct ccs_
449          if (profile == &ccs_default_profile)          if (profile == &ccs_default_profile)
450                  return -EINVAL;                  return -EINVAL;
451          if (!strcmp(data, "COMMENT")) {          if (!strcmp(data, "COMMENT")) {
452                  const struct ccs_path_info *new_comment = ccs_get_name(cp);                  const struct ccs_path_info *old_comment = profile->comment;
453                  const struct ccs_path_info *old_comment;                  profile->comment = ccs_get_name(cp);
                 /* Protect reader from ccs_put_name(). */  
                 spin_lock(&ccs_profile_comment_lock);  
                 old_comment = profile->comment;  
                 profile->comment = new_comment;  
                 spin_unlock(&ccs_profile_comment_lock);  
454                  ccs_put_name(old_comment);                  ccs_put_name(old_comment);
455                  return 0;                  return 0;
456          }          }
# Line 501  static void ccs_read_profile(struct ccs_ Line 517  static void ccs_read_profile(struct ccs_
517          if (head->read_bit)          if (head->read_bit)
518                  goto body;                  goto body;
519          ccs_io_printf(head, "PROFILE_VERSION=%s\n", "20090903");          ccs_io_printf(head, "PROFILE_VERSION=%s\n", "20090903");
520            ccs_io_printf(head, "PREFERENCE::audit={ "
521    #ifdef CONFIG_CCSECURITY_AUDIT
522                          "max_grant_log=%u max_reject_log=%u "
523    #endif
524                          "task_info=%s path_info=%s }\n",
525  #ifdef CONFIG_CCSECURITY_AUDIT  #ifdef CONFIG_CCSECURITY_AUDIT
         ccs_io_printf(head, "PREFERENCE::audit={ max_grant_log=%u "  
                       "max_reject_log=%u }\n",  
526                        ccs_default_profile.preference.audit_max_grant_log,                        ccs_default_profile.preference.audit_max_grant_log,
527                        ccs_default_profile.preference.audit_max_reject_log);                        ccs_default_profile.preference.audit_max_reject_log,
528  #endif  #endif
529                          ccs_yesno(ccs_default_profile.preference.
530                                    audit_task_info),
531                          ccs_yesno(ccs_default_profile.preference.
532                                    audit_path_info));
533          ccs_io_printf(head, "PREFERENCE::learning={ verbose=%s max_entry=%u "          ccs_io_printf(head, "PREFERENCE::learning={ verbose=%s max_entry=%u "
534                        "exec.realpath=%s exec.argv0=%s symlink.target=%s }\n",                        "exec.realpath=%s exec.argv0=%s symlink.target=%s }\n",
535                        ccs_yesno(ccs_default_profile.preference.                        ccs_yesno(ccs_default_profile.preference.
# Line 534  static void ccs_read_profile(struct ccs_ Line 557  static void ccs_read_profile(struct ccs_
557                  int i;                  int i;
558                  int pos;                  int pos;
559                  const struct ccs_profile *profile = ccs_profile_ptr[index];                  const struct ccs_profile *profile = ccs_profile_ptr[index];
560                    const struct ccs_path_info *comment;
561                  head->read_step = index;                  head->read_step = index;
562                  if (!profile)                  if (!profile)
563                          continue;                          continue;
564                  pos = head->read_avail;                  pos = head->read_avail;
565                  spin_lock(&ccs_profile_comment_lock);                  comment = profile->comment;
566                  done = ccs_io_printf(head, "%u-COMMENT=%s\n", index,                  done = ccs_io_printf(head, "%u-COMMENT=%s\n", index,
567                                       profile->comment ? profile->comment->name                                       comment ? comment->name : "");
                                      : "");  
                 spin_unlock(&ccs_profile_comment_lock);  
568                  if (!done)                  if (!done)
569                          goto out;                          goto out;
570                  config = profile->default_config;                  config = profile->default_config;
# Line 584  static void ccs_read_profile(struct ccs_ Line 606  static void ccs_read_profile(struct ccs_
606                                  goto out;                                  goto out;
607  #endif  #endif
608                  }                  }
 #ifdef CONFIG_CCSECURITY_AUDIT  
609                  if (profile->audit != &ccs_default_profile.preference &&                  if (profile->audit != &ccs_default_profile.preference &&
610                      !ccs_io_printf(head, "%u-PREFERENCE::audit={ "                      !ccs_io_printf(head, "%u-PREFERENCE::audit={ "
611                                     "max_grant_log=%u max_reject_log=%u }\n",  #ifdef CONFIG_CCSECURITY_AUDIT
612                                     index,                                     "max_grant_log=%u max_reject_log=%u "
613    #endif
614                                       "task_info=%s path_info=%s }\n", index,
615    #ifdef CONFIG_CCSECURITY_AUDIT
616                                     profile->preference.audit_max_grant_log,                                     profile->preference.audit_max_grant_log,
617                                     profile->preference.audit_max_reject_log))                                     profile->preference.audit_max_reject_log,
                         goto out;  
618  #endif  #endif
619                                       ccs_yesno(profile->preference.
620                                                 audit_task_info),
621                                       ccs_yesno(profile->preference.
622                                                 audit_path_info)))
623                            goto out;
624                  if (profile->learning != &ccs_default_profile.preference &&                  if (profile->learning != &ccs_default_profile.preference &&
625                      !ccs_io_printf(head, "%u-PREFERENCE::learning={ "                      !ccs_io_printf(head, "%u-PREFERENCE::learning={ "
626                                     "verbose=%s max_entry=%u exec.realpath=%s "                                     "verbose=%s max_entry=%u exec.realpath=%s "
# Line 643  LIST_HEAD(ccs_policy_manager_list); Line 671  LIST_HEAD(ccs_policy_manager_list);
671   */   */
672  static int ccs_update_manager_entry(const char *manager, const bool is_delete)  static int ccs_update_manager_entry(const char *manager, const bool is_delete)
673  {  {
         struct ccs_policy_manager_entry *entry = NULL;  
674          struct ccs_policy_manager_entry *ptr;          struct ccs_policy_manager_entry *ptr;
675          struct ccs_policy_manager_entry e = { };          struct ccs_policy_manager_entry e = { };
676          int error = is_delete ? -ENOENT : -ENOMEM;          int error = is_delete ? -ENOENT : -ENOMEM;
# Line 658  static int ccs_update_manager_entry(cons Line 685  static int ccs_update_manager_entry(cons
685          e.manager = ccs_get_name(manager);          e.manager = ccs_get_name(manager);
686          if (!e.manager)          if (!e.manager)
687                  return -ENOMEM;                  return -ENOMEM;
688          if (!is_delete)          if (mutex_lock_interruptible(&ccs_policy_lock))
689                  entry = kmalloc(sizeof(e), GFP_KERNEL);                  goto out;
         mutex_lock(&ccs_policy_lock);  
690          list_for_each_entry_rcu(ptr, &ccs_policy_manager_list, list) {          list_for_each_entry_rcu(ptr, &ccs_policy_manager_list, list) {
691                  if (ptr->manager != e.manager)                  if (ptr->manager != e.manager)
692                          continue;                          continue;
# Line 668  static int ccs_update_manager_entry(cons Line 694  static int ccs_update_manager_entry(cons
694                  error = 0;                  error = 0;
695                  break;                  break;
696          }          }
697          if (!is_delete && error && ccs_commit_ok(entry, &e, sizeof(e))) {          if (!is_delete && error) {
698                  list_add_tail_rcu(&entry->list, &ccs_policy_manager_list);                  struct ccs_policy_manager_entry *entry =
699                  entry = NULL;                          ccs_commit_ok(&e, sizeof(e));
700                  error = 0;                  if (entry) {
701                            list_add_tail_rcu(&entry->list,
702                                              &ccs_policy_manager_list);
703                            error = 0;
704                    }
705          }          }
706          mutex_unlock(&ccs_policy_lock);          mutex_unlock(&ccs_policy_lock);
707     out:
708          ccs_put_name(e.manager);          ccs_put_name(e.manager);
         kfree(entry);  
709          return error;          return error;
710  }  }
711    
# Line 824  static bool ccs_is_select_one(struct ccs Line 854  static bool ccs_is_select_one(struct ccs
854          if (sscanf(data, "pid=%u", &pid) == 1 ||          if (sscanf(data, "pid=%u", &pid) == 1 ||
855              (global_pid = true, sscanf(data, "global-pid=%u", &pid) == 1)) {              (global_pid = true, sscanf(data, "global-pid=%u", &pid) == 1)) {
856                  struct task_struct *p;                  struct task_struct *p;
857                  read_lock(&tasklist_lock);                  ccs_tasklist_lock();
858  #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)  #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
859                  if (global_pid)                  if (global_pid)
860                          p = find_task_by_pid_ns(pid, &init_pid_ns);                          p = ccsecurity_exports.find_task_by_pid_ns(pid,
861                                                                   &init_pid_ns);
862                  else                  else
863                          p = find_task_by_vpid(pid);                          p = ccsecurity_exports.find_task_by_vpid(pid);
864  #else  #else
865                  p = find_task_by_pid(pid);                  p = find_task_by_pid(pid);
866  #endif  #endif
867                  if (p)                  if (p)
868                          domain = ccs_task_domain(p);                          domain = ccs_task_domain(p);
869                  read_unlock(&tasklist_lock);                  ccs_tasklist_unlock();
870          } else if (!strncmp(data, "domain=", 7)) {          } else if (!strncmp(data, "domain=", 7)) {
871                  if (ccs_is_domain_def(data + 7))                  if (ccs_is_domain_def(data + 7))
872                          domain = ccs_find_domain(data + 7);                          domain = ccs_find_domain(data + 7);
# Line 881  static int ccs_write_domain_policy2(char Line 912  static int ccs_write_domain_policy2(char
912                  return ccs_write_env_policy(data, domain, cond, is_delete);                  return ccs_write_env_policy(data, domain, cond, is_delete);
913          if (ccs_str_starts(&data, CCS_KEYWORD_ALLOW_MOUNT))          if (ccs_str_starts(&data, CCS_KEYWORD_ALLOW_MOUNT))
914                  return ccs_write_mount_policy(data, domain, cond, is_delete);                  return ccs_write_mount_policy(data, domain, cond, is_delete);
         if (ccs_str_starts(&data, CCS_KEYWORD_ALLOW_UNMOUNT))  
                 return ccs_write_umount_policy(data, domain, cond, is_delete);  
         if (ccs_str_starts(&data, CCS_KEYWORD_ALLOW_CHROOT))  
                 return ccs_write_chroot_policy(data, domain, cond, is_delete);  
         if (ccs_str_starts(&data, CCS_KEYWORD_ALLOW_PIVOT_ROOT))  
                 return ccs_write_pivot_root_policy(data, domain, cond,  
                                                    is_delete);  
915          return ccs_write_file_policy(data, domain, cond, is_delete);          return ccs_write_file_policy(data, domain, cond, is_delete);
916  }  }
917    
# Line 945  static int ccs_write_domain_policy(struc Line 969  static int ccs_write_domain_policy(struc
969                  domain->ignore_global_allow_env = !is_delete;                  domain->ignore_global_allow_env = !is_delete;
970                  return 0;                  return 0;
971          }          }
972            if (!strcmp(data, CCS_KEYWORD_QUOTA_EXCEEDED)) {
973                    domain->quota_warned = !is_delete;
974                    return 0;
975            }
976            if (!strcmp(data, CCS_KEYWORD_TRANSITION_FAILED)) {
977                    domain->domain_transition_failed = !is_delete;
978                    return 0;
979            }
980          cp = ccs_find_condition_part(data);          cp = ccs_find_condition_part(data);
981          if (cp) {          if (cp) {
982                  cond = ccs_get_condition(cp);                  cond = ccs_get_condition(cp);
# Line 1186  static bool ccs_print_condition(struct c Line 1218  static bool ccs_print_condition(struct c
1218  }  }
1219    
1220  /**  /**
1221   * ccs_print_path_acl - Print a single path ACL entry.   * ccs_print_path_acl - Print a path ACL entry.
1222   *   *
1223   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
1224   * @ptr:  Pointer to "struct ccs_path_acl".   * @ptr:  Pointer to "struct ccs_path_acl".
# Line 1204  static bool ccs_print_path_acl(struct cc Line 1236  static bool ccs_print_path_acl(struct cc
1236          for (bit = head->read_bit; bit < CCS_MAX_PATH_OPERATION; bit++) {          for (bit = head->read_bit; bit < CCS_MAX_PATH_OPERATION; bit++) {
1237                  if (!(perm & (1 << bit)))                  if (!(perm & (1 << bit)))
1238                          continue;                          continue;
1239                  if (head->read_execute_only && bit != CCS_TYPE_EXECUTE)                  if (head->read_execute_only && bit != CCS_TYPE_EXECUTE
1240                        && bit != CCS_TYPE_TRANSIT)
1241                          continue;                          continue;
1242                  /* Print "read/write" instead of "read" and "write". */                  /* Print "read/write" instead of "read" and "write". */
1243                  if ((bit == CCS_TYPE_READ || bit == CCS_TYPE_WRITE)                  if ((bit == CCS_TYPE_READ || bit == CCS_TYPE_WRITE)
# Line 1537  static bool ccs_print_mount_acl(struct c Line 1570  static bool ccs_print_mount_acl(struct c
1570  }  }
1571    
1572  /**  /**
  * ccs_print_umount_acl - Print a mount ACL entry.  
  *  
  * @head: Pointer to "struct ccs_io_buffer".  
  * @ptr:  Pointer to "struct ccs_umount_acl".  
  * @cond: Pointer to "struct ccs_condition". May be NULL.  
  *  
  * Returns true on success, false otherwise.  
  */  
 static bool ccs_print_umount_acl(struct ccs_io_buffer *head,  
                                  struct ccs_umount_acl *ptr,  
                                  const struct ccs_condition *cond)  
 {  
         const int pos = head->read_avail;  
         if (!ccs_io_printf(head, CCS_KEYWORD_ALLOW_UNMOUNT) ||  
             !ccs_print_name_union(head, &ptr->dir) ||  
             !ccs_print_condition(head, cond)) {  
                 head->read_avail = pos;  
                 return false;  
         }  
         return true;  
 }  
   
 /**  
  * ccs_print_chroot_acl - Print a chroot ACL entry.  
  *  
  * @head: Pointer to "struct ccs_io_buffer".  
  * @ptr:  Pointer to "struct ccs_chroot_acl".  
  * @cond: Pointer to "struct ccs_condition". May be NULL.  
  *  
  * Returns true on success, false otherwise.  
  */  
 static bool ccs_print_chroot_acl(struct ccs_io_buffer *head,  
                                  struct ccs_chroot_acl *ptr,  
                                  const struct ccs_condition *cond)  
 {  
         const int pos = head->read_avail;  
         if (!ccs_io_printf(head, CCS_KEYWORD_ALLOW_CHROOT) ||  
             !ccs_print_name_union(head, &ptr->dir) ||  
             !ccs_print_condition(head, cond)) {  
                 head->read_avail = pos;  
                 return false;  
         }  
         return true;  
 }  
   
 /**  
  * ccs_print_pivot_root_acl - Print a pivot_root ACL entry.  
  *  
  * @head: Pointer to "struct ccs_io_buffer".  
  * @ptr:  Pointer to "struct ccs_pivot_root_acl".  
  * @cond: Pointer to "struct ccs_condition". May be NULL.  
  *  
  * Returns true on success, false otherwise.  
  */  
 static bool ccs_print_pivot_root_acl(struct ccs_io_buffer *head,  
                                      struct ccs_pivot_root_acl *ptr,  
                                      const struct ccs_condition *cond)  
 {  
         const int pos = head->read_avail;  
         if (!ccs_io_printf(head, CCS_KEYWORD_ALLOW_PIVOT_ROOT) ||  
             !ccs_print_name_union(head, &ptr->new_root) ||  
             !ccs_print_name_union(head, &ptr->old_root) ||  
             !ccs_print_condition(head, cond)) {  
                 head->read_avail = pos;  
                 return false;  
         }  
         return true;  
 }  
   
 /**  
1573   * ccs_print_entry - Print an ACL entry.   * ccs_print_entry - Print an ACL entry.
1574   *   *
1575   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
# Line 1623  static bool ccs_print_entry(struct ccs_i Line 1586  static bool ccs_print_entry(struct ccs_i
1586                  return true;                  return true;
1587          if (acl_type == CCS_TYPE_PATH_ACL) {          if (acl_type == CCS_TYPE_PATH_ACL) {
1588                  struct ccs_path_acl *acl                  struct ccs_path_acl *acl
1589                          = container_of(ptr, struct ccs_path_acl,                          = container_of(ptr, struct ccs_path_acl, head);
                                        head);  
1590                  return ccs_print_path_acl(head, acl, cond);                  return ccs_print_path_acl(head, acl, cond);
1591          }          }
1592          if (acl_type == CCS_TYPE_EXECUTE_HANDLER) {          if (acl_type == CCS_TYPE_EXECUTE_HANDLER) {
# Line 1650  static bool ccs_print_entry(struct ccs_i Line 1612  static bool ccs_print_entry(struct ccs_i
1612          }          }
1613          if (acl_type == CCS_TYPE_PATH2_ACL) {          if (acl_type == CCS_TYPE_PATH2_ACL) {
1614                  struct ccs_path2_acl *acl                  struct ccs_path2_acl *acl
1615                          = container_of(ptr, struct ccs_path2_acl,                          = container_of(ptr, struct ccs_path2_acl, head);
                                        head);  
1616                  return ccs_print_path2_acl(head, acl, cond);                  return ccs_print_path2_acl(head, acl, cond);
1617          }          }
1618          if (acl_type == CCS_TYPE_PATH_NUMBER_ACL) {          if (acl_type == CCS_TYPE_PATH_NUMBER_ACL) {
1619                  struct ccs_path_number_acl *acl                  struct ccs_path_number_acl *acl
1620                          = container_of(ptr, struct ccs_path_number_acl,                          = container_of(ptr, struct ccs_path_number_acl, head);
                                        head);  
1621                  return ccs_print_path_number_acl(head, acl, cond);                  return ccs_print_path_number_acl(head, acl, cond);
1622          }          }
1623          if (acl_type == CCS_TYPE_ENV_ACL) {          if (acl_type == CCS_TYPE_ENV_ACL) {
# Line 1667  static bool ccs_print_entry(struct ccs_i Line 1627  static bool ccs_print_entry(struct ccs_i
1627          }          }
1628          if (acl_type == CCS_TYPE_CAPABILITY_ACL) {          if (acl_type == CCS_TYPE_CAPABILITY_ACL) {
1629                  struct ccs_capability_acl *acl                  struct ccs_capability_acl *acl
1630                          = container_of(ptr, struct ccs_capability_acl,                          = container_of(ptr, struct ccs_capability_acl, head);
                                        head);  
1631                  return ccs_print_capability_acl(head, acl, cond);                  return ccs_print_capability_acl(head, acl, cond);
1632          }          }
1633          if (acl_type == CCS_TYPE_IP_NETWORK_ACL) {          if (acl_type == CCS_TYPE_IP_NETWORK_ACL) {
1634                  struct ccs_ip_network_acl *acl                  struct ccs_ip_network_acl *acl
1635                          = container_of(ptr, struct ccs_ip_network_acl,                          = container_of(ptr, struct ccs_ip_network_acl, head);
                                        head);  
1636                  return ccs_print_network_acl(head, acl, cond);                  return ccs_print_network_acl(head, acl, cond);
1637          }          }
1638          if (acl_type == CCS_TYPE_SIGNAL_ACL) {          if (acl_type == CCS_TYPE_SIGNAL_ACL) {
# Line 1687  static bool ccs_print_entry(struct ccs_i Line 1645  static bool ccs_print_entry(struct ccs_i
1645                          = container_of(ptr, struct ccs_mount_acl, head);                          = container_of(ptr, struct ccs_mount_acl, head);
1646                  return ccs_print_mount_acl(head, acl, cond);                  return ccs_print_mount_acl(head, acl, cond);
1647          }          }
         if (acl_type == CCS_TYPE_UMOUNT_ACL) {  
                 struct ccs_umount_acl *acl  
                         = container_of(ptr, struct ccs_umount_acl, head);  
                 return ccs_print_umount_acl(head, acl, cond);  
         }  
         if (acl_type == CCS_TYPE_CHROOT_ACL) {  
                 struct ccs_chroot_acl *acl  
                         = container_of(ptr, struct ccs_chroot_acl, head);  
                 return ccs_print_chroot_acl(head, acl, cond);  
         }  
         if (acl_type == CCS_TYPE_PIVOT_ROOT_ACL) {  
                 struct ccs_pivot_root_acl *acl  
                         = container_of(ptr, struct ccs_pivot_root_acl,  
                                        head);  
                 return ccs_print_pivot_root_acl(head, acl, cond);  
         }  
1648          BUG(); /* This must not happen. */          BUG(); /* This must not happen. */
1649          return false;          return false;
1650  }  }
# Line 1735  static void ccs_read_domain_policy(struc Line 1677  static void ccs_read_domain_policy(struc
1677                          continue;                          continue;
1678                  /* Print domainname and flags. */                  /* Print domainname and flags. */
1679                  if (domain->quota_warned)                  if (domain->quota_warned)
1680                          quota_exceeded = "quota_exceeded\n";                          quota_exceeded = CCS_KEYWORD_QUOTA_EXCEEDED "\n";
1681                  if (domain->domain_transition_failed)                  if (domain->domain_transition_failed)
1682                          transition_failed = "transition_failed\n";                          transition_failed = CCS_KEYWORD_TRANSITION_FAILED "\n";
1683                  if (domain->ignore_global_allow_read)                  if (domain->ignore_global_allow_read)
1684                          ignore_global_allow_read                          ignore_global_allow_read
1685                                  = CCS_KEYWORD_IGNORE_GLOBAL_ALLOW_READ "\n";                                  = CCS_KEYWORD_IGNORE_GLOBAL_ALLOW_READ "\n";
# Line 1871  static void ccs_read_pid(struct ccs_io_b Line 1813  static void ccs_read_pid(struct ccs_io_b
1813          struct ccs_domain_info *domain = NULL;          struct ccs_domain_info *domain = NULL;
1814          u32 ccs_flags = 0;          u32 ccs_flags = 0;
1815          /* Accessing write_buf is safe because head->io_sem is held. */          /* Accessing write_buf is safe because head->io_sem is held. */
1816          if (!buf)          if (!buf) {
1817                    head->read_eof = true;
1818                  return; /* Do nothing if open(O_RDONLY). */                  return; /* Do nothing if open(O_RDONLY). */
1819            }
1820          if (head->read_avail || head->read_eof)          if (head->read_avail || head->read_eof)
1821                  return;                  return;
1822          head->read_eof = true;          head->read_eof = true;
# Line 1881  static void ccs_read_pid(struct ccs_io_b Line 1825  static void ccs_read_pid(struct ccs_io_b
1825          if (ccs_str_starts(&buf, "global-pid "))          if (ccs_str_starts(&buf, "global-pid "))
1826                  global_pid = true;                  global_pid = true;
1827          pid = (unsigned int) simple_strtoul(buf, NULL, 10);          pid = (unsigned int) simple_strtoul(buf, NULL, 10);
1828          read_lock(&tasklist_lock);          ccs_tasklist_lock();
1829  #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)  #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
1830          if (global_pid)          if (global_pid)
1831                  p = find_task_by_pid_ns(pid, &init_pid_ns);                  p = ccsecurity_exports.find_task_by_pid_ns(pid, &init_pid_ns);
1832          else          else
1833                  p = find_task_by_vpid(pid);                  p = ccsecurity_exports.find_task_by_vpid(pid);
1834  #else  #else
1835          p = find_task_by_pid(pid);          p = find_task_by_pid(pid);
1836  #endif  #endif
# Line 1894  static void ccs_read_pid(struct ccs_io_b Line 1838  static void ccs_read_pid(struct ccs_io_b
1838                  domain = ccs_task_domain(p);                  domain = ccs_task_domain(p);
1839                  ccs_flags = p->ccs_flags;                  ccs_flags = p->ccs_flags;
1840          }          }
1841          read_unlock(&tasklist_lock);          ccs_tasklist_unlock();
1842          if (!domain)          if (!domain)
1843                  return;                  return;
1844          if (!task_info)          if (!task_info)
# Line 2114  static struct ccs_condition *ccs_get_exe Line 2058  static struct ccs_condition *ccs_get_exe
2058                          len += strlen(argv0) + 16;                          len += strlen(argv0) + 16;
2059                  }                  }
2060          }          }
2061          buf = kmalloc(len, GFP_KERNEL);          buf = kmalloc(len, CCS_GFP_FLAGS);
2062          if (!buf) {          if (!buf) {
2063                  kfree(realpath);                  kfree(realpath);
2064                  return NULL;                  return NULL;
# Line 2160  static struct ccs_condition *ccs_get_sym Line 2104  static struct ccs_condition *ccs_get_sym
2104                  symlink = r->obj->symlink_target->name;                  symlink = r->obj->symlink_target->name;
2105                  len += strlen(symlink) + 18;                  len += strlen(symlink) + 18;
2106          }          }
2107          buf = kmalloc(len, GFP_KERNEL);          buf = kmalloc(len, CCS_GFP_FLAGS);
2108          if (!buf)          if (!buf)
2109                  return NULL;                  return NULL;
2110          snprintf(buf, len - 1, "if");          snprintf(buf, len - 1, "if");
# Line 2208  static atomic_t ccs_query_observers = AT Line 2152  static atomic_t ccs_query_observers = AT
2152   * @fmt:     The printf()'s format string, followed by parameters.   * @fmt:     The printf()'s format string, followed by parameters.
2153   *   *
2154   * Returns 0 if the supervisor decided to permit the access request which   * Returns 0 if the supervisor decided to permit the access request which
2155   * violated the policy in enforcing mode, 1 if the supervisor decided to   * violated the policy in enforcing mode, CCS_RETRY_REQUEST if the supervisor
2156   * retry the access request which violated the policy in enforcing mode,   * decided to retry the access request which violated the policy in enforcing
2157   * 0 if it is not in enforcing mode, -EPERM otherwise.   * mode, 0 if it is not in enforcing mode, -EPERM otherwise.
2158   */   */
2159  int ccs_supervisor(struct ccs_request_info *r, const char *fmt, ...)  int ccs_supervisor(struct ccs_request_info *r, const char *fmt, ...)
2160  {  {
# Line 2233  int ccs_supervisor(struct ccs_request_in Line 2177  int ccs_supervisor(struct ccs_request_in
2177                  va_start(args, fmt);                  va_start(args, fmt);
2178                  len = vsnprintf((char *) &pos, sizeof(pos) - 1, fmt, args) + 4;                  len = vsnprintf((char *) &pos, sizeof(pos) - 1, fmt, args) + 4;
2179                  va_end(args);                  va_end(args);
2180                  buffer = kmalloc(len, GFP_KERNEL);                  buffer = kmalloc(len, CCS_GFP_FLAGS);
2181                  if (!buffer)                  if (!buffer)
2182                          return 0;                          return 0;
2183                  va_start(args, fmt);                  va_start(args, fmt);
# Line 2273  int ccs_supervisor(struct ccs_request_in Line 2217  int ccs_supervisor(struct ccs_request_in
2217          header = ccs_init_audit_log(&len, r);          header = ccs_init_audit_log(&len, r);
2218          if (!header)          if (!header)
2219                  goto out;                  goto out;
2220          ccs_query_entry = kzalloc(sizeof(*ccs_query_entry), GFP_KERNEL);          ccs_query_entry = kzalloc(sizeof(*ccs_query_entry), CCS_GFP_FLAGS);
2221          if (!ccs_query_entry)          if (!ccs_query_entry)
2222                  goto out;                  goto out;
2223          len = ccs_round2(len);          len = ccs_round2(len);
2224          ccs_query_entry->query = kzalloc(len, GFP_KERNEL);          ccs_query_entry->query = kzalloc(len, CCS_GFP_FLAGS);
2225          if (!ccs_query_entry->query)          if (!ccs_query_entry->query)
2226                  goto out;                  goto out;
2227          INIT_LIST_HEAD(&ccs_query_entry->list);          INIT_LIST_HEAD(&ccs_query_entry->list);
# Line 2319  int ccs_supervisor(struct ccs_request_in Line 2263  int ccs_supervisor(struct ccs_request_in
2263          spin_unlock(&ccs_query_list_lock);          spin_unlock(&ccs_query_list_lock);
2264          switch (ccs_query_entry->answer) {          switch (ccs_query_entry->answer) {
2265          case 3: /* Asked to retry by administrator. */          case 3: /* Asked to retry by administrator. */
2266                  error = 1;                  error = CCS_RETRY_REQUEST;
2267                  r->retry++;                  r->retry++;
2268                  break;                  break;
2269          case 1:          case 1:
# Line 2410  static void ccs_read_query(struct ccs_io Line 2354  static void ccs_read_query(struct ccs_io
2354                  head->read_step = 0;                  head->read_step = 0;
2355                  return;                  return;
2356          }          }
2357          buf = kzalloc(len, GFP_KERNEL);          buf = kzalloc(len, CCS_GFP_FLAGS);
2358          if (!buf)          if (!buf)
2359                  return;                  return;
2360          pos = 0;          pos = 0;
# Line 2486  static void ccs_read_version(struct ccs_ Line 2430  static void ccs_read_version(struct ccs_
2430  {  {
2431          if (head->read_eof)          if (head->read_eof)
2432                  return;                  return;
2433          ccs_io_printf(head, "1.7.0");          ccs_io_printf(head, "1.7.1");
2434          head->read_eof = true;          head->read_eof = true;
2435  }  }
2436    
# Line 2517  static void ccs_read_self_domain(struct Line 2461  static void ccs_read_self_domain(struct
2461   */   */
2462  int ccs_open_control(const u8 type, struct file *file)  int ccs_open_control(const u8 type, struct file *file)
2463  {  {
2464          struct ccs_io_buffer *head = kzalloc(sizeof(*head), GFP_KERNEL);          struct ccs_io_buffer *head = kzalloc(sizeof(*head), CCS_GFP_FLAGS);
2465          if (!head)          if (!head)
2466                  return -ENOMEM;                  return -ENOMEM;
2467          mutex_init(&head->io_sem);          mutex_init(&head->io_sem);
# Line 2533  int ccs_open_control(const u8 type, stru Line 2477  int ccs_open_control(const u8 type, stru
2477                  break;                  break;
2478  #ifdef CONFIG_CCSECURITY_AUDIT  #ifdef CONFIG_CCSECURITY_AUDIT
2479          case CCS_GRANTLOG: /* /proc/ccs/grant_log */          case CCS_GRANTLOG: /* /proc/ccs/grant_log */
                 head->poll = ccs_poll_grant_log;  
                 head->read = ccs_read_grant_log;  
                 break;  
2480          case CCS_REJECTLOG: /* /proc/ccs/reject_log */          case CCS_REJECTLOG: /* /proc/ccs/reject_log */
2481                  head->poll = ccs_poll_reject_log;                  head->poll = ccs_poll_audit_log;
2482                  head->read = ccs_read_reject_log;                  head->read = ccs_read_audit_log;
2483                  break;                  break;
2484  #endif  #endif
2485          case CCS_SELFDOMAIN: /* /proc/ccs/self_domain */          case CCS_SELFDOMAIN: /* /proc/ccs/self_domain */
# Line 2593  int ccs_open_control(const u8 type, stru Line 2534  int ccs_open_control(const u8 type, stru
2534                  /* Don't allocate read_buf for poll() access. */                  /* Don't allocate read_buf for poll() access. */
2535                  if (!head->readbuf_size)                  if (!head->readbuf_size)
2536                          head->readbuf_size = 4096;                          head->readbuf_size = 4096;
2537                  head->read_buf = kzalloc(head->readbuf_size, GFP_KERNEL);                  head->read_buf = kzalloc(head->readbuf_size, CCS_GFP_FLAGS);
2538                  if (!head->read_buf) {                  if (!head->read_buf) {
2539                          kfree(head);                          kfree(head);
2540                          return -ENOMEM;                          return -ENOMEM;
# Line 2607  int ccs_open_control(const u8 type, stru Line 2548  int ccs_open_control(const u8 type, stru
2548                  head->write = NULL;                  head->write = NULL;
2549          } else if (head->write) {          } else if (head->write) {
2550                  head->writebuf_size = 4096;                  head->writebuf_size = 4096;
2551                  head->write_buf = kzalloc(head->writebuf_size, GFP_KERNEL);                  head->write_buf = kzalloc(head->writebuf_size, CCS_GFP_FLAGS);
2552                  if (!head->write_buf) {                  if (!head->write_buf) {
2553                          kfree(head->read_buf);                          kfree(head->read_buf);
2554                          kfree(head);                          kfree(head);
# Line 2615  int ccs_open_control(const u8 type, stru Line 2556  int ccs_open_control(const u8 type, stru
2556                  }                  }
2557          }          }
2558          if (type != CCS_QUERY &&          if (type != CCS_QUERY &&
2559              type != CCS_GRANTLOG && type != CCS_REJECTLOG)              type != CCS_GRANTLOG && type != CCS_REJECTLOG) {
2560                  head->reader_idx = ccs_read_lock();                  spin_lock(&ccs_io_buffer_list_lock);
2561                    list_add(&head->list, &ccs_io_buffer_list);
2562                    spin_unlock(&ccs_io_buffer_list_lock);
2563            }
2564          file->private_data = head;          file->private_data = head;
2565          /*          /*
2566           * Call the handler now if the file is /proc/ccs/self_domain           * Call the handler now if the file is /proc/ccs/self_domain
# Line 2644  int ccs_open_control(const u8 type, stru Line 2588  int ccs_open_control(const u8 type, stru
2588   * Waits for read readiness.   * Waits for read readiness.
2589   * /proc/ccs/query is handled by /usr/sbin/ccs-queryd and   * /proc/ccs/query is handled by /usr/sbin/ccs-queryd and
2590   * /proc/ccs/grant_log and /proc/ccs/reject_log are handled by   * /proc/ccs/grant_log and /proc/ccs/reject_log are handled by
2591   * /usr/sbin/ccs-auditd.   * /usr/sbin/ccs-auditd .
2592   */   */
2593  int ccs_poll_control(struct file *file, poll_table *wait)  int ccs_poll_control(struct file *file, poll_table *wait)
2594  {  {
# Line 2669  int ccs_read_control(struct file *file, Line 2613  int ccs_read_control(struct file *file,
2613          int len = 0;          int len = 0;
2614          struct ccs_io_buffer *head = file->private_data;          struct ccs_io_buffer *head = file->private_data;
2615          char *cp;          char *cp;
2616            int idx;
2617          if (!head->read)          if (!head->read)
2618                  return -ENOSYS;                  return -ENOSYS;
2619          if (!access_ok(VERIFY_WRITE, buffer, buffer_len))          if (!access_ok(VERIFY_WRITE, buffer, buffer_len))
2620                  return -EFAULT;                  return -EFAULT;
2621          if (mutex_lock_interruptible(&head->io_sem))          if (mutex_lock_interruptible(&head->io_sem))
2622                  return -EINTR;                  return -EINTR;
2623            idx = ccs_read_lock();
2624          while (1) {          while (1) {
2625                  /* Call the policy handler. */                  /* Call the policy handler. */
2626                  head->read(head);                  head->read(head);
# Line 2683  int ccs_read_control(struct file *file, Line 2629  int ccs_read_control(struct file *file,
2629                  if (len || head->poll || head->read_eof)                  if (len || head->poll || head->read_eof)
2630                          break;                          break;
2631                  len = head->readbuf_size * 2;                  len = head->readbuf_size * 2;
2632                  cp = kzalloc(len, GFP_KERNEL);                  cp = kzalloc(len, CCS_GFP_FLAGS);
2633                  if (!cp) {                  if (!cp) {
2634                          len = -ENOMEM;                          len = -ENOMEM;
2635                          goto out;                          goto out;
# Line 2705  int ccs_read_control(struct file *file, Line 2651  int ccs_read_control(struct file *file,
2651          head->read_avail -= len;          head->read_avail -= len;
2652          memmove(cp, cp + len, head->read_avail);          memmove(cp, cp + len, head->read_avail);
2653   out:   out:
2654            ccs_read_unlock(idx);
2655          mutex_unlock(&head->io_sem);          mutex_unlock(&head->io_sem);
2656          return len;          return len;
2657  }  }
# Line 2725  int ccs_write_control(struct file *file, Line 2672  int ccs_write_control(struct file *file,
2672          int error = buffer_len;          int error = buffer_len;
2673          int avail_len = buffer_len;          int avail_len = buffer_len;
2674          char *cp0 = head->write_buf;          char *cp0 = head->write_buf;
2675            int idx;
2676          if (!head->write)          if (!head->write)
2677                  return -ENOSYS;                  return -ENOSYS;
2678          if (!access_ok(VERIFY_READ, buffer, buffer_len))          if (!access_ok(VERIFY_READ, buffer, buffer_len))
# Line 2736  int ccs_write_control(struct file *file, Line 2684  int ccs_write_control(struct file *file,
2684                  return -EPERM;                  return -EPERM;
2685          if (mutex_lock_interruptible(&head->io_sem))          if (mutex_lock_interruptible(&head->io_sem))
2686                  return -EINTR;                  return -EINTR;
2687            idx = ccs_read_lock();
2688          /* Read a line and dispatch it to the policy handler. */          /* Read a line and dispatch it to the policy handler. */
2689          while (avail_len > 0) {          while (avail_len > 0) {
2690                  char c;                  char c;
2691                  if (head->write_avail >= head->writebuf_size - 1) {                  if (head->write_avail >= head->writebuf_size - 1) {
2692                          const int len = head->writebuf_size * 2;                          const int len = head->writebuf_size * 2;
2693                          char *cp = kzalloc(len, GFP_KERNEL);                          char *cp = kzalloc(len, CCS_GFP_FLAGS);
2694                          if (!cp) {                          if (!cp) {
2695                                  error = -ENOMEM;                                  error = -ENOMEM;
2696                                  break;                                  break;
# Line 2766  int ccs_write_control(struct file *file, Line 2715  int ccs_write_control(struct file *file,
2715                  ccs_normalize_line(cp0);                  ccs_normalize_line(cp0);
2716                  head->write(head);                  head->write(head);
2717          }          }
2718            ccs_read_unlock(idx);
2719          mutex_unlock(&head->io_sem);          mutex_unlock(&head->io_sem);
2720          return error;          return error;
2721  }  }
# Line 2788  int ccs_close_control(struct file *file) Line 2738  int ccs_close_control(struct file *file)
2738          if (type == CCS_QUERY)          if (type == CCS_QUERY)
2739                  atomic_dec(&ccs_query_observers);                  atomic_dec(&ccs_query_observers);
2740          if (type != CCS_QUERY &&          if (type != CCS_QUERY &&
2741              type != CCS_GRANTLOG && type != CCS_REJECTLOG)              type != CCS_GRANTLOG && type != CCS_REJECTLOG) {
2742                  ccs_read_unlock(head->reader_idx);                  spin_lock(&ccs_io_buffer_list_lock);
2743                    list_del(&head->list);
2744                    spin_unlock(&ccs_io_buffer_list_lock);
2745            }
2746          /* Release memory used for policy I/O. */          /* Release memory used for policy I/O. */
2747          kfree(head->read_buf);          kfree(head->read_buf);
2748          head->read_buf = NULL;          head->read_buf = NULL;
# Line 2802  int ccs_close_control(struct file *file) Line 2755  int ccs_close_control(struct file *file)
2755                  ccs_run_gc();                  ccs_run_gc();
2756          return 0;          return 0;
2757  }  }
2758    
2759    void __init ccs_policy_io_init(void)
2760    {
2761            ccsecurity_ops.check_profile = ccs_check_profile;
2762    }
Legend:
Removed from v.2991  
changed lines
  Added in v.3534
Back to OSDN">Back to OSDN
 ViewVC Help
Powered by ViewVC 1.1.26  
サイト情報
ソフトウェアを探す
ソフトウェアを作る
コミュニティ
ヘルプ