オープンソース・ソフトウェアの開発とダウンロード

TOMOYO

Subversion リポジトリの参照

/[tomoyo]/branches/ccs-patch/security/ccsecurity/policy_io.c

Diff of /branches/ccs-patch/security/ccsecurity/policy_io.c

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 2911 by kumaneko, Sat Aug 15 12:21:38 2009 UTC revision 2915 by kumaneko, Mon Aug 17 10:56:21 2009 UTC
# Line 15  Line 15 
15  /* Lock for protecting ccs_profile->comment  */  /* Lock for protecting ccs_profile->comment  */
16  static DEFINE_SPINLOCK(ccs_profile_comment_lock);  static DEFINE_SPINLOCK(ccs_profile_comment_lock);
17    
18  static bool ccs_profile_entry_used[CCS_MAX_CONTROL_INDEX +  /* String table for functionality that takes 2 modes. */
19                                     CCS_MAX_CAPABILITY_INDEX + 1];  static const char *ccs_mode_2[2] = {
20            "disabled", "enabled"
21    };
22    
23  /* String table for functionality that takes 4 modes. */  static const char *ccs_keyword_mode[4] = {
24  static const char *ccs_mode_4[4] = {          "MAC_MODE_DISABLED", "MAC_MODE_LEARNING",
25          "disabled", "learning", "permissive", "enforcing"          "MAC_MODE_PERMISSIVE", "MAC_MODE_ENFORCING"
26  };  };
27  /* String table for functionality that takes 2 modes. */  
28  static const char *ccs_mode_2[4] = {  static const char *ccs_keyword_capability_mode[4] = {
29          "disabled", "enabled", "enabled", "enabled"          "MAC_MODE_CAPABILITY_DISABLED", "MAC_MODE_CAPABILITY_LEARNING",
30            "MAC_MODE_CAPABILITY_PERMISSIVE", "MAC_MODE_CAPABILITY_ENFORCING"
31    };
32    
33    static const char *ccs_mac_keywords[CCS_MAX_MAC_INDEX] = {
34            [CCS_MAC_EXECUTE]    = "execute",
35            [CCS_MAC_OPEN]       = "open",
36            [CCS_MAC_CREATE]     = "create",
37            [CCS_MAC_UNLINK]     = "unlink",
38            [CCS_MAC_MKDIR]      = "mkdir",
39            [CCS_MAC_RMDIR]      = "rmdir",
40            [CCS_MAC_MKFIFO]     = "mkfifo",
41            [CCS_MAC_MKSOCK]     = "mksock",
42            [CCS_MAC_TRUNCATE]   = "truncate",
43            [CCS_MAC_SYMLINK]    = "symlink",
44            [CCS_MAC_REWRITE]    = "rewrite",
45            [CCS_MAC_MKBLOCK]    = "mkblock",
46            [CCS_MAC_MKCHAR]     = "mkchar",
47            [CCS_MAC_LINK]       = "link",
48            [CCS_MAC_RENAME]     = "rename",
49            [CCS_MAC_CHMOD]      = "chmod",
50            [CCS_MAC_CHOWN]      = "chown",
51            [CCS_MAC_CHGRP]      = "chgrp",
52            [CCS_MAC_IOCTL]      = "ioctl",
53            [CCS_MAC_CHROOT]     = "chroot",
54            [CCS_MAC_MOUNT]      = "mount",
55            [CCS_MAC_UMOUNT]     = "umount",
56            [CCS_MAC_PIVOT_ROOT] = "pivot_root",
57            [CCS_MAC_ENVIRON]    = "env",
58            [CCS_MAC_NETWORK]    = "network",
59            [CCS_MAC_SIGNAL]     = "signal"
60  };  };
61    
62  /* Table for profile. */  /* Table for profile. */
# Line 33  static struct { Line 65  static struct {
65          unsigned int current_value;          unsigned int current_value;
66          const unsigned int max_value;          const unsigned int max_value;
67  } ccs_control_array[CCS_MAX_CONTROL_INDEX] = {  } ccs_control_array[CCS_MAX_CONTROL_INDEX] = {
         [CCS_MAC_FOR_FILE]        = { "MAC_FOR_FILE",        0, 3 },  
68          [CCS_AUTOLEARN_EXEC_REALPATH] = { "AUTOLEARN_EXEC_REALPATH", 0, 1 },          [CCS_AUTOLEARN_EXEC_REALPATH] = { "AUTOLEARN_EXEC_REALPATH", 0, 1 },
69          [CCS_AUTOLEARN_EXEC_ARGV0] = { "AUTOLEARN_EXEC_ARGV0", 0, 1 },          [CCS_AUTOLEARN_EXEC_ARGV0] = { "AUTOLEARN_EXEC_ARGV0", 0, 1 },
         [CCS_MAC_FOR_IOCTL]       = { "MAC_FOR_IOCTL",       0, 3 },  
         [CCS_MAC_FOR_FILEATTR]    = { "MAC_FOR_FILEATTR",    0, 3 },  
         [CCS_MAC_FOR_ENV]         = { "MAC_FOR_ENV",         0, 3 },  
         [CCS_MAC_FOR_NETWORK]     = { "MAC_FOR_NETWORK",     0, 3 },  
         [CCS_MAC_FOR_SIGNAL]      = { "MAC_FOR_SIGNAL",      0, 3 },  
         [CCS_MAC_FOR_NAMESPACE]   = { "MAC_FOR_NAMESPACE",   0, 3 },  
         [CCS_MAC_FOR_CAPABILITY]  = { "MAC_FOR_CAPABILITY",   0, 3 },  
70          [CCS_RESTRICT_AUTOBIND]   = { "RESTRICT_AUTOBIND",   0, 1 },          [CCS_RESTRICT_AUTOBIND]   = { "RESTRICT_AUTOBIND",   0, 1 },
71          [CCS_MAX_ACCEPT_ENTRY]          [CCS_MAX_ACCEPT_ENTRY]
72          = { "MAX_ACCEPT_ENTRY", CONFIG_CCSECURITY_MAX_ACCEPT_ENTRY, INT_MAX },          = { "MAX_ACCEPT_ENTRY", CONFIG_CCSECURITY_MAX_ACCEPT_ENTRY, INT_MAX },
# Line 127  static struct ccs_profile *ccs_find_or_a Line 151  static struct ccs_profile *ccs_find_or_a
151                  ptr = entry;                  ptr = entry;
152                  for (i = 0; i < CCS_MAX_CONTROL_INDEX; i++)                  for (i = 0; i < CCS_MAX_CONTROL_INDEX; i++)
153                          ptr->value[i] = ccs_control_array[i].current_value;                          ptr->value[i] = ccs_control_array[i].current_value;
                 /*  
                  * Needn't to initialize "ptr->capability_value"  
                  * because they are always 0.  
                  */  
154                  mb(); /* Avoid out-of-order execution. */                  mb(); /* Avoid out-of-order execution. */
155                  ccs_profile_ptr[profile] = ptr;                  ccs_profile_ptr[profile] = ptr;
156                  entry = NULL;                  entry = NULL;
# Line 152  static int ccs_write_profile(struct ccs_ Line 172  static int ccs_write_profile(struct ccs_
172          char *data = head->write_buf;          char *data = head->write_buf;
173          unsigned int i;          unsigned int i;
174          unsigned int value;          unsigned int value;
175            int mode;
176          char *cp;          char *cp;
177          struct ccs_profile *ccs_profile;          struct ccs_profile *ccs_profile;
178          i = simple_strtoul(data, &cp, 10);          i = simple_strtoul(data, &cp, 10);
# Line 179  static int ccs_write_profile(struct ccs_ Line 200  static int ccs_write_profile(struct ccs_
200                  spin_unlock(&ccs_profile_comment_lock);                  spin_unlock(&ccs_profile_comment_lock);
201                  /***** CRITICAL SECTION END *****/                  /***** CRITICAL SECTION END *****/
202                  ccs_put_name(old_comment);                  ccs_put_name(old_comment);
                 ccs_profile_entry_used[0] = true;  
203                  return 0;                  return 0;
204          }          }
205          if (!strcmp(data, CCS_KEYWORD_CAPABILITIES)) {          for (mode = 0; mode < 4; mode++) {
206                  unsigned char capabilities[CCS_MAX_CAPABILITY_INDEX];                  if (strcmp(data, ccs_keyword_mode[mode]))
207                  memset(capabilities, 0, sizeof(capabilities));                          continue;
208                    cp++;
209                    while (1) {
210                            char *cp2 = strchr(cp, ' ');
211                            if (cp2)
212                                    *cp2 = '\0';
213                            for (i = 0; i < CCS_MAX_MAC_INDEX; i++) {
214                                    if (strcmp(cp, ccs_mac_keywords[i]))
215                                            continue;
216                                    ccs_profile->mac_mode[i] = mode;
217                            }
218                            if (!cp2)
219                                    break;
220                            cp = cp2 + 1;
221                    }
222                    return 0;
223            }
224            for (mode = 0; mode < 4; mode++) {
225                    if (strcmp(data, ccs_keyword_capability_mode[mode]))
226                            continue;
227                  cp++;                  cp++;
228                  while (1) {                  while (1) {
229                          char *cp2 = strchr(cp, ' ');                          char *cp2 = strchr(cp, ' ');
# Line 193  static int ccs_write_profile(struct ccs_ Line 232  static int ccs_write_profile(struct ccs_
232                          for (i = 0; i < CCS_MAX_CAPABILITY_INDEX; i++) {                          for (i = 0; i < CCS_MAX_CAPABILITY_INDEX; i++) {
233                                  if (strcmp(cp, ccs_capability_list[i]))                                  if (strcmp(cp, ccs_capability_list[i]))
234                                          continue;                                          continue;
235                                  capabilities[i] = 1;                                  ccs_profile->mac_capability_mode[i] = mode;
236                          }                          }
237                          if (!cp2)                          if (!cp2)
238                                  break;                                  break;
239                          cp = cp2 + 1;                          cp = cp2 + 1;
240                  }                  }
                 for (i = 0; i < CCS_MAX_CAPABILITY_INDEX; i++)  
                         ccs_profile->enabled_capabilities[i] = capabilities[i];  
241                  return 0;                  return 0;
242          }          }
243          for (i = 0; i < CCS_MAX_CONTROL_INDEX; i++) {          for (i = 0; i < CCS_MAX_CONTROL_INDEX; i++) {
# Line 208  static int ccs_write_profile(struct ccs_ Line 245  static int ccs_write_profile(struct ccs_
245                          continue;                          continue;
246                  if (sscanf(cp + 1, "%u", &value) != 1) {                  if (sscanf(cp + 1, "%u", &value) != 1) {
247                          int j;                          int j;
248                          const char **modes;                          for (j = 0; j < 2; j++) {
249                          switch (i) {                                  if (strcmp(cp + 1, ccs_mode_2[j]))
                         case CCS_AUTOLEARN_EXEC_REALPATH:  
                         case CCS_AUTOLEARN_EXEC_ARGV0:  
                         case CCS_RESTRICT_AUTOBIND:  
                         case CCS_VERBOSE:  
                                 modes = ccs_mode_2;  
                                 break;  
                         default:  
                                 modes = ccs_mode_4;  
                                 break;  
                         }  
                         for (j = 0; j < 4; j++) {  
                                 if (strcmp(cp + 1, modes[j]))  
250                                          continue;                                          continue;
251                                  value = j;                                  value = j;
252                                  break;                                  break;
# Line 232  static int ccs_write_profile(struct ccs_ Line 257  static int ccs_write_profile(struct ccs_
257                          value = ccs_control_array[i].max_value;                          value = ccs_control_array[i].max_value;
258                  }                  }
259                  ccs_profile->value[i] = value;                  ccs_profile->value[i] = value;
                 ccs_profile_entry_used[i + 1] = true;  
260                  return 0;                  return 0;
261          }          }
262          return -EINVAL;          return -EINVAL;
263  }  }
264    
265  static bool ccs_print_capability_list(struct ccs_io_buffer *head, u8 index)  static bool ccs_print_mac_mode(struct ccs_io_buffer *head, u8 index)
266  {  {
267          const int pos = head->read_avail;          const int pos = head->read_avail;
268          int i;          int i;
269            int mode;
270          const struct ccs_profile *ccs_profile = ccs_profile_ptr[index];          const struct ccs_profile *ccs_profile = ccs_profile_ptr[index];
271          if (!ccs_io_printf(head, "%u-" CCS_KEYWORD_CAPABILITIES "={", index))          for (mode = 0; mode < 4; mode++) {
272                  return false;                  if (!ccs_io_printf(head, "%u-%s={", index, ccs_keyword_mode[mode]))
273          for (i = 0; i < CCS_MAX_CAPABILITY_INDEX; i++) {                          goto out;
274                  if (!ccs_profile->enabled_capabilities[i])                  for (i = 0; i < CCS_MAX_MAC_INDEX; i++) {
275                          continue;                          if (ccs_profile->mac_mode[i] != mode)
276                  if (!ccs_io_printf(head, " %s", ccs_capability_list[i]))                                  continue;
277                            if (!ccs_io_printf(head, " %s", ccs_mac_keywords[i]))
278                                    goto out;
279                    }
280                    if (!ccs_io_printf(head, " }\n"))
281                            goto out;
282            }
283            return true;
284     out:
285            head->read_avail = pos;
286            return false;
287    }
288    
289    static bool ccs_print_capability_mode(struct ccs_io_buffer *head, u8 index)
290    {
291            const int pos = head->read_avail;
292            int i;
293            int mode;
294            const struct ccs_profile *ccs_profile = ccs_profile_ptr[index];
295            for (mode = 0; mode < 4; mode++) {
296                    if (!ccs_io_printf(head, "%u-%s={", index, ccs_keyword_capability_mode[mode]))
297                            goto out;
298                    for (i = 0; i < CCS_MAX_CAPABILITY_INDEX; i++) {
299                            if (ccs_profile->mac_capability_mode[i] != mode)
300                                    continue;
301                            if (!ccs_io_printf(head, " %s", ccs_capability_list[i]))
302                                    goto out;
303                    }
304                    if (!ccs_io_printf(head, " }\n"))
305                          goto out;                          goto out;
306          }          }
         if (!ccs_io_printf(head, " }\n"))  
                 goto out;  
307          return true;          return true;
308   out:   out:
309          head->read_avail = pos;          head->read_avail = pos;
# Line 280  static int ccs_read_profile(struct ccs_i Line 331  static int ccs_read_profile(struct ccs_i
331                  head->read_step = step;                  head->read_step = step;
332                  if (!ccs_profile)                  if (!ccs_profile)
333                          continue;                          continue;
                 if (!ccs_profile_entry_used[type])  
                         continue;  
334                  if (!type) { /* Print profile' comment tag. */                  if (!type) { /* Print profile' comment tag. */
335                          bool done;                          bool done;
336                          /***** CRITICAL SECTION START *****/                          /***** CRITICAL SECTION START *****/
# Line 294  static int ccs_read_profile(struct ccs_i Line 343  static int ccs_read_profile(struct ccs_i
343                          if (!done)                          if (!done)
344                                  break;                                  break;
345                          continue;                          continue;
346                  }                  } else if (type == 1) {
347                  if (type == 1) {                          if (!ccs_print_mac_mode(head, index))
348                          if (!ccs_print_capability_list(head, index))                                  break;
349                            continue;
350                    } else if (type == 2) {
351                            if (!ccs_print_capability_mode(head, index))
352                                  break;                                  break;
353                          continue;                          continue;
354                  }                  }
355                  type -= 2;                  type -= 3;
356                  {                  {
357                          const unsigned int value = ccs_profile->value[type];                          const unsigned int value = ccs_profile->value[type];
                         const char **modes = NULL;  
358                          const char *keyword = ccs_control_array[type].keyword;                          const char *keyword = ccs_control_array[type].keyword;
359                          switch (ccs_control_array[type].max_value) {                          if (ccs_control_array[type].max_value == 1) {
                         case 3:  
                                 modes = ccs_mode_4;  
                                 break;  
                         case 1:  
                                 modes = ccs_mode_2;  
                                 break;  
                         }  
                         if (modes) {  
360                                  if (!ccs_io_printf(head, "%u-%s=%s\n", index,                                  if (!ccs_io_printf(head, "%u-%s=%s\n", index,
361                                                     keyword, modes[value]))                                                     keyword, ccs_mode_2[value]))
362                                          break;                                          break;
363                          } else {                          } else {
364                                  if (!ccs_io_printf(head, "%u-%s=%u\n", index,                                  if (!ccs_io_printf(head, "%u-%s=%u\n", index,
# Line 843  static bool ccs_print_condition(struct c Line 886  static bool ccs_print_condition(struct c
886  }  }
887    
888  /**  /**
889   * ccs_print_single_path_acl - Print a single path ACL entry.   * ccs_print_path_acl - Print a single path ACL entry.
890   *   *
891   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
892   * @ptr:  Pointer to "struct ccs_single_path_acl_record".   * @ptr:  Pointer to "struct ccs_path_acl".
893   * @cond: Pointer to "struct ccs_condition". May be NULL.   * @cond: Pointer to "struct ccs_condition". May be NULL.
894   *   *
895   * Returns true on success, false otherwise.   * Returns true on success, false otherwise.
896   */   */
897  static bool ccs_print_single_path_acl(struct ccs_io_buffer *head,  static bool ccs_print_path_acl(struct ccs_io_buffer *head,
898                                        struct ccs_single_path_acl_record *ptr,                                        struct ccs_path_acl *ptr,
899                                        const struct ccs_condition *cond)                                        const struct ccs_condition *cond)
900  {  {
901          int pos;          int pos;
902          u8 bit;          u8 bit;
903          const u16 perm = ptr->perm;          const u16 perm = ptr->perm;
904          for (bit = head->read_bit; bit < CCS_MAX_SINGLE_PATH_OPERATION; bit++) {          for (bit = head->read_bit; bit < CCS_MAX_PATH_OPERATION; bit++) {
905                  const char *msg;                  const char *msg;
906                  if (!(perm & (1 << bit)))                  if (!(perm & (1 << bit)))
907                          continue;                          continue;
908                  if (head->read_execute_only && bit != CCS_TYPE_EXECUTE_ACL)                  if (head->read_execute_only && bit != CCS_TYPE_EXECUTE)
909                          continue;                          continue;
910                  /* Print "read/write" instead of "read" and "write". */                  /* Print "read/write" instead of "read" and "write". */
911                  if ((bit == CCS_TYPE_READ_ACL || bit == CCS_TYPE_WRITE_ACL)                  if ((bit == CCS_TYPE_READ || bit == CCS_TYPE_WRITE)
912                      && (perm & (1 << CCS_TYPE_READ_WRITE_ACL)))                      && (perm & (1 << CCS_TYPE_READ_WRITE)))
913                          continue;                          continue;
914                  msg = ccs_sp2keyword(bit);                  msg = ccs_path2keyword(bit);
915                  pos = head->read_avail;                  pos = head->read_avail;
916                  if (!ccs_io_printf(head, "allow_%s", msg) ||                  if (!ccs_io_printf(head, "allow_%s", msg) ||
917                      !ccs_print_name_union(head, &ptr->name) ||                      !ccs_print_name_union(head, &ptr->name) ||
# Line 883  static bool ccs_print_single_path_acl(st Line 926  static bool ccs_print_single_path_acl(st
926  }  }
927    
928  /**  /**
929   * ccs_print_mkdev_acl - Print a mkdev ACL entry.   * ccs_print_path_number_number_acl - Print a path_number_number ACL entry.
930   *   *
931   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
932   * @ptr:  Pointer to "struct ccs_mkdev_acl_record".   * @ptr:  Pointer to "struct ccs_path_number_number_acl".
933   * @cond: Pointer to "struct ccs_condition". May be NULL.   * @cond: Pointer to "struct ccs_condition". May be NULL.
934   *   *
935   * Returns true on success, false otherwise.   * Returns true on success, false otherwise.
936   */   */
937  static bool ccs_print_mkdev_acl(struct ccs_io_buffer *head,  static bool ccs_print_path_number_number_acl(struct ccs_io_buffer *head,
938                                  struct ccs_mkdev_acl_record *ptr,                                  struct ccs_path_number_number_acl *ptr,
939                                  const struct ccs_condition *cond)                                  const struct ccs_condition *cond)
940  {  {
941          int pos;          int pos;
942          u8 bit;          u8 bit;
943          const u16 perm = ptr->perm;          const u16 perm = ptr->perm;
944          for (bit = head->read_bit; bit < CCS_MAX_MKDEV_OPERATION; bit++) {          for (bit = head->read_bit; bit < CCS_MAX_PATH_NUMBER_NUMBER_OPERATION; bit++) {
945                  const char *msg;                  const char *msg;
946                  if (!(perm & (1 << bit)))                  if (!(perm & (1 << bit)))
947                          continue;                          continue;
948                  msg = ccs_mkdev2keyword(bit);                  msg = ccs_path_number_number2keyword(bit);
949                  pos = head->read_avail;                  pos = head->read_avail;
950                  if (!ccs_io_printf(head, "allow_%s", msg) ||                  if (!ccs_io_printf(head, "allow_%s", msg) ||
951                      !ccs_print_name_union(head, &ptr->name) ||                      !ccs_print_name_union(head, &ptr->name) ||
# Line 919  static bool ccs_print_mkdev_acl(struct c Line 962  static bool ccs_print_mkdev_acl(struct c
962  }  }
963    
964  /**  /**
965   * ccs_print_double_path_acl - Print a double path ACL entry.   * ccs_print_path_path_acl - Print a double path ACL entry.
966   *   *
967   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
968   * @ptr:  Pointer to "struct ccs_double_path_acl_record".   * @ptr:  Pointer to "struct ccs_path_path_acl".
969   * @cond: Pointer to "struct ccs_condition". May be NULL.   * @cond: Pointer to "struct ccs_condition". May be NULL.
970   *   *
971   * Returns true on success, false otherwise.   * Returns true on success, false otherwise.
972   */   */
973  static bool ccs_print_double_path_acl(struct ccs_io_buffer *head,  static bool ccs_print_path_path_acl(struct ccs_io_buffer *head,
974                                        struct ccs_double_path_acl_record *ptr,                                        struct ccs_path_path_acl *ptr,
975                                        const struct ccs_condition *cond)                                        const struct ccs_condition *cond)
976  {  {
977          int pos;          int pos;
978          u8 bit;          u8 bit;
979          const u8 perm = ptr->perm;          const u8 perm = ptr->perm;
980          for (bit = head->read_bit; bit < CCS_MAX_DOUBLE_PATH_OPERATION; bit++) {          for (bit = head->read_bit; bit < CCS_MAX_PATH_PATH_OPERATION; bit++) {
981                  const char *msg;                  const char *msg;
982                  if (!(perm & (1 << bit)))                  if (!(perm & (1 << bit)))
983                          continue;                          continue;
984                  msg = ccs_dp2keyword(bit);                  msg = ccs_path_path2keyword(bit);
985                  pos = head->read_avail;                  pos = head->read_avail;
986                  if (!ccs_io_printf(head, "allow_%s", msg) ||                  if (!ccs_io_printf(head, "allow_%s", msg) ||
987                      !ccs_print_name_union(head, &ptr->name1) ||                      !ccs_print_name_union(head, &ptr->name1) ||
# Line 957  static bool ccs_print_double_path_acl(st Line 1000  static bool ccs_print_double_path_acl(st
1000   * ccs_print_path_number_acl - Print an ioctl/chmod/chown/chgrp ACL entry.   * ccs_print_path_number_acl - Print an ioctl/chmod/chown/chgrp ACL entry.
1001   *   *
1002   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
1003   * @ptr:  Pointer to "struct ccs_path_number_acl_record".   * @ptr:  Pointer to "struct ccs_path_number_acl".
1004   * @cond: Pointer to "struct ccs_condition". May be NULL.   * @cond: Pointer to "struct ccs_condition". May be NULL.
1005   *   *
1006   * Returns true on success, false otherwise.   * Returns true on success, false otherwise.
1007   */   */
1008  static bool ccs_print_path_number_acl(struct ccs_io_buffer *head,  static bool ccs_print_path_number_acl(struct ccs_io_buffer *head,
1009                                        struct ccs_path_number_acl_record *ptr,                                        struct ccs_path_number_acl *ptr,
1010                                        const struct ccs_condition *cond)                                        const struct ccs_condition *cond)
1011  {  {
1012          int pos;          int pos;
# Line 992  static bool ccs_print_path_number_acl(st Line 1035  static bool ccs_print_path_number_acl(st
1035   * ccs_print_env_acl - Print an evironment variable name's ACL entry.   * ccs_print_env_acl - Print an evironment variable name's ACL entry.
1036   *   *
1037   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
1038   * @ptr:  Pointer to "struct ccs_env_acl_record".   * @ptr:  Pointer to "struct ccs_env_acl".
1039   * @cond: Pointer to "struct ccs_condition". May be NULL.   * @cond: Pointer to "struct ccs_condition". May be NULL.
1040   *   *
1041   * Returns true on success, false otherwise.   * Returns true on success, false otherwise.
1042   */   */
1043  static bool ccs_print_env_acl(struct ccs_io_buffer *head,  static bool ccs_print_env_acl(struct ccs_io_buffer *head,
1044                                struct ccs_env_acl_record *ptr,                                struct ccs_env_acl *ptr,
1045                                const struct ccs_condition *cond)                                const struct ccs_condition *cond)
1046  {  {
1047          const int pos = head->read_avail;          const int pos = head->read_avail;
# Line 1014  static bool ccs_print_env_acl(struct ccs Line 1057  static bool ccs_print_env_acl(struct ccs
1057   * ccs_print_capability_acl - Print a capability ACL entry.   * ccs_print_capability_acl - Print a capability ACL entry.
1058   *   *
1059   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
1060   * @ptr:  Pointer to "struct ccs_capability_acl_record".   * @ptr:  Pointer to "struct ccs_capability_acl".
1061   * @cond: Pointer to "struct ccs_condition". May be NULL.   * @cond: Pointer to "struct ccs_condition". May be NULL.
1062   *   *
1063   * Returns true on success, false otherwise.   * Returns true on success, false otherwise.
1064   */   */
1065  static bool ccs_print_capability_acl(struct ccs_io_buffer *head,  static bool ccs_print_capability_acl(struct ccs_io_buffer *head,
1066                                       struct ccs_capability_acl_record *ptr,                                       struct ccs_capability_acl *ptr,
1067                                       const struct ccs_condition *cond)                                       const struct ccs_condition *cond)
1068  {  {
1069          const int pos = head->read_avail;          const int pos = head->read_avail;
# Line 1037  static bool ccs_print_capability_acl(str Line 1080  static bool ccs_print_capability_acl(str
1080   * ccs_print_ipv4_entry - Print IPv4 address of a network ACL entry.   * ccs_print_ipv4_entry - Print IPv4 address of a network ACL entry.
1081   *   *
1082   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
1083   * @ptr:  Pointer to "struct ccs_ip_network_acl_record".   * @ptr:  Pointer to "struct ccs_ip_network_acl".
1084   *   *
1085   * Returns true on success, false otherwise.   * Returns true on success, false otherwise.
1086   */   */
1087  static bool ccs_print_ipv4_entry(struct ccs_io_buffer *head,  static bool ccs_print_ipv4_entry(struct ccs_io_buffer *head,
1088                                   struct ccs_ip_network_acl_record *ptr)                                   struct ccs_ip_network_acl *ptr)
1089  {  {
1090          const u32 min_address = ptr->address.ipv4.min;          const u32 min_address = ptr->address.ipv4.min;
1091          const u32 max_address = ptr->address.ipv4.max;          const u32 max_address = ptr->address.ipv4.max;
# Line 1058  static bool ccs_print_ipv4_entry(struct Line 1101  static bool ccs_print_ipv4_entry(struct
1101   * ccs_print_ipv6_entry - Print IPv6 address of a network ACL entry.   * ccs_print_ipv6_entry - Print IPv6 address of a network ACL entry.
1102   *   *
1103   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
1104   * @ptr:  Pointer to "struct ccs_ip_network_acl_record".   * @ptr:  Pointer to "struct ccs_ip_network_acl".
1105   *   *
1106   * Returns true on success, false otherwise.   * Returns true on success, false otherwise.
1107   */   */
1108  static bool ccs_print_ipv6_entry(struct ccs_io_buffer *head,  static bool ccs_print_ipv6_entry(struct ccs_io_buffer *head,
1109                                   struct ccs_ip_network_acl_record *ptr)                                   struct ccs_ip_network_acl *ptr)
1110  {  {
1111          char buf[64];          char buf[64];
1112          const struct in6_addr *min_address = ptr->address.ipv6.min;          const struct in6_addr *min_address = ptr->address.ipv6.min;
# Line 1083  static bool ccs_print_ipv6_entry(struct Line 1126  static bool ccs_print_ipv6_entry(struct
1126   * ccs_print_network_acl - Print a network ACL entry.   * ccs_print_network_acl - Print a network ACL entry.
1127   *   *
1128   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
1129   * @ptr:  Pointer to "struct ccs_ip_network_acl_record".   * @ptr:  Pointer to "struct ccs_ip_network_acl".
1130   * @cond: Pointer to "struct ccs_condition". May be NULL.   * @cond: Pointer to "struct ccs_condition". May be NULL.
1131   *   *
1132   * Returns true on success, false otherwise.   * Returns true on success, false otherwise.
1133   */   */
1134  static bool ccs_print_network_acl(struct ccs_io_buffer *head,  static bool ccs_print_network_acl(struct ccs_io_buffer *head,
1135                                    struct ccs_ip_network_acl_record *ptr,                                    struct ccs_ip_network_acl *ptr,
1136                                    const struct ccs_condition *cond)                                    const struct ccs_condition *cond)
1137  {  {
1138          const int pos = head->read_avail;          const int pos = head->read_avail;
# Line 1124  static bool ccs_print_network_acl(struct Line 1167  static bool ccs_print_network_acl(struct
1167   * ccs_print_signal_acl - Print a signal ACL entry.   * ccs_print_signal_acl - Print a signal ACL entry.
1168   *   *
1169   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
1170   * @ptr:  Pointer to "struct signale_acl_record".   * @ptr:  Pointer to "struct signale_acl".
1171   * @cond: Pointer to "struct ccs_condition". May be NULL.   * @cond: Pointer to "struct ccs_condition". May be NULL.
1172   *   *
1173   * Returns true on success, false otherwise.   * Returns true on success, false otherwise.
1174   */   */
1175  static bool ccs_print_signal_acl(struct ccs_io_buffer *head,  static bool ccs_print_signal_acl(struct ccs_io_buffer *head,
1176                                   struct ccs_signal_acl_record *ptr,                                   struct ccs_signal_acl *ptr,
1177                                   const struct ccs_condition *cond)                                   const struct ccs_condition *cond)
1178  {  {
1179          const int pos = head->read_avail;          const int pos = head->read_avail;
# Line 1164  static bool ccs_print_execute_handler_re Line 1207  static bool ccs_print_execute_handler_re
1207   * ccs_print_mount_acl - Print a mount ACL entry.   * ccs_print_mount_acl - Print a mount ACL entry.
1208   *   *
1209   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
1210   * @ptr:  Pointer to "struct ccs_mount_acl_record".   * @ptr:  Pointer to "struct ccs_mount_acl".
1211   * @cond: Pointer to "struct ccs_condition". May be NULL.   * @cond: Pointer to "struct ccs_condition". May be NULL.
1212   *   *
1213   * Returns true on success, false otherwise.   * Returns true on success, false otherwise.
1214   */   */
1215  static bool ccs_print_mount_acl(struct ccs_io_buffer *head,  static bool ccs_print_mount_acl(struct ccs_io_buffer *head,
1216                                  struct ccs_mount_acl_record *ptr,                                  struct ccs_mount_acl *ptr,
1217                                  const struct ccs_condition *cond)                                  const struct ccs_condition *cond)
1218  {  {
1219          const int pos = head->read_avail;          const int pos = head->read_avail;
# Line 1190  static bool ccs_print_mount_acl(struct c Line 1233  static bool ccs_print_mount_acl(struct c
1233   * ccs_print_umount_acl - Print a mount ACL entry.   * ccs_print_umount_acl - Print a mount ACL entry.
1234   *   *
1235   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
1236   * @ptr:  Pointer to "struct ccs_umount_acl_record".   * @ptr:  Pointer to "struct ccs_umount_acl".
1237   * @cond: Pointer to "struct ccs_condition". May be NULL.   * @cond: Pointer to "struct ccs_condition". May be NULL.
1238   *   *
1239   * Returns true on success, false otherwise.   * Returns true on success, false otherwise.
1240   */   */
1241  static bool ccs_print_umount_acl(struct ccs_io_buffer *head,  static bool ccs_print_umount_acl(struct ccs_io_buffer *head,
1242                                   struct ccs_umount_acl_record *ptr,                                   struct ccs_umount_acl *ptr,
1243                                   const struct ccs_condition *cond)                                   const struct ccs_condition *cond)
1244  {  {
1245          const int pos = head->read_avail;          const int pos = head->read_avail;
# Line 1213  static bool ccs_print_umount_acl(struct Line 1256  static bool ccs_print_umount_acl(struct
1256   * ccs_print_chroot_acl - Print a chroot ACL entry.   * ccs_print_chroot_acl - Print a chroot ACL entry.
1257   *   *
1258   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
1259   * @ptr:  Pointer to "struct ccs_chroot_acl_record".   * @ptr:  Pointer to "struct ccs_chroot_acl".
1260   * @cond: Pointer to "struct ccs_condition". May be NULL.   * @cond: Pointer to "struct ccs_condition". May be NULL.
1261   *   *
1262   * Returns true on success, false otherwise.   * Returns true on success, false otherwise.
1263   */   */
1264  static bool ccs_print_chroot_acl(struct ccs_io_buffer *head,  static bool ccs_print_chroot_acl(struct ccs_io_buffer *head,
1265                                   struct ccs_chroot_acl_record *ptr,                                   struct ccs_chroot_acl *ptr,
1266                                   const struct ccs_condition *cond)                                   const struct ccs_condition *cond)
1267  {  {
1268          const int pos = head->read_avail;          const int pos = head->read_avail;
# Line 1236  static bool ccs_print_chroot_acl(struct Line 1279  static bool ccs_print_chroot_acl(struct
1279   * ccs_print_pivot_root_acl - Print a pivot_root ACL entry.   * ccs_print_pivot_root_acl - Print a pivot_root ACL entry.
1280   *   *
1281   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
1282   * @ptr:  Pointer to "struct ccs_pivot_root_acl_record".   * @ptr:  Pointer to "struct ccs_pivot_root_acl".
1283   * @cond: Pointer to "struct ccs_condition". May be NULL.   * @cond: Pointer to "struct ccs_condition". May be NULL.
1284   *   *
1285   * Returns true on success, false otherwise.   * Returns true on success, false otherwise.
1286   */   */
1287  static bool ccs_print_pivot_root_acl(struct ccs_io_buffer *head,  static bool ccs_print_pivot_root_acl(struct ccs_io_buffer *head,
1288                                       struct ccs_pivot_root_acl_record *ptr,                                       struct ccs_pivot_root_acl *ptr,
1289                                       const struct ccs_condition *cond)                                       const struct ccs_condition *cond)
1290  {  {
1291          const int pos = head->read_avail;          const int pos = head->read_avail;
# Line 1271  static bool ccs_print_entry(struct ccs_i Line 1314  static bool ccs_print_entry(struct ccs_i
1314          const u8 acl_type = ptr->type;          const u8 acl_type = ptr->type;
1315          if (ptr->is_deleted)          if (ptr->is_deleted)
1316                  return true;                  return true;
1317          if (acl_type == CCS_TYPE_SINGLE_PATH_ACL) {          if (acl_type == CCS_TYPE_PATH_ACL) {
1318                  struct ccs_single_path_acl_record *acl                  struct ccs_path_acl *acl
1319                          = container_of(ptr, struct ccs_single_path_acl_record,                          = container_of(ptr, struct ccs_path_acl,
1320                                         head);                                         head);
1321                  return ccs_print_single_path_acl(head, acl, cond);                  return ccs_print_path_acl(head, acl, cond);
1322          }          }
1323          if (acl_type == CCS_TYPE_EXECUTE_HANDLER) {          if (acl_type == CCS_TYPE_EXECUTE_HANDLER) {
1324                  struct ccs_execute_handler_record *acl                  struct ccs_execute_handler_record *acl
# Line 1293  static bool ccs_print_entry(struct ccs_i Line 1336  static bool ccs_print_entry(struct ccs_i
1336          }          }
1337          if (head->read_execute_only)          if (head->read_execute_only)
1338                  return true;                  return true;
1339          if (acl_type == CCS_TYPE_MKDEV_ACL) {          if (acl_type == CCS_TYPE_PATH_NUMBER_NUMBER_ACL) {
1340                  struct ccs_mkdev_acl_record *acl                  struct ccs_path_number_number_acl *acl
1341                          = container_of(ptr, struct ccs_mkdev_acl_record, head);                          = container_of(ptr, struct ccs_path_number_number_acl, head);
1342                  return ccs_print_mkdev_acl(head, acl, cond);                  return ccs_print_path_number_number_acl(head, acl, cond);
1343          }          }
1344          if (acl_type == CCS_TYPE_DOUBLE_PATH_ACL) {          if (acl_type == CCS_TYPE_PATH_PATH_ACL) {
1345                  struct ccs_double_path_acl_record *acl                  struct ccs_path_path_acl *acl
1346                          = container_of(ptr, struct ccs_double_path_acl_record,                          = container_of(ptr, struct ccs_path_path_acl,
1347                                         head);                                         head);
1348                  return ccs_print_double_path_acl(head, acl, cond);                  return ccs_print_path_path_acl(head, acl, cond);
1349          }          }
1350          if (acl_type == CCS_TYPE_PATH_NUMBER_ACL) {          if (acl_type == CCS_TYPE_PATH_NUMBER_ACL) {
1351                  struct ccs_path_number_acl_record *acl                  struct ccs_path_number_acl *acl
1352                          = container_of(ptr, struct ccs_path_number_acl_record,                          = container_of(ptr, struct ccs_path_number_acl,
1353                                         head);                                         head);
1354                  return ccs_print_path_number_acl(head, acl, cond);                  return ccs_print_path_number_acl(head, acl, cond);
1355          }          }
1356          if (acl_type == CCS_TYPE_ENV_ACL) {          if (acl_type == CCS_TYPE_ENV_ACL) {
1357                  struct ccs_env_acl_record *acl                  struct ccs_env_acl *acl
1358                          = container_of(ptr, struct ccs_env_acl_record, head);                          = container_of(ptr, struct ccs_env_acl, head);
1359                  return ccs_print_env_acl(head, acl, cond);                  return ccs_print_env_acl(head, acl, cond);
1360          }          }
1361          if (acl_type == CCS_TYPE_CAPABILITY_ACL) {          if (acl_type == CCS_TYPE_CAPABILITY_ACL) {
1362                  struct ccs_capability_acl_record *acl                  struct ccs_capability_acl *acl
1363                          = container_of(ptr, struct ccs_capability_acl_record,                          = container_of(ptr, struct ccs_capability_acl,
1364                                         head);                                         head);
1365                  return ccs_print_capability_acl(head, acl, cond);                  return ccs_print_capability_acl(head, acl, cond);
1366          }          }
1367          if (acl_type == CCS_TYPE_IP_NETWORK_ACL) {          if (acl_type == CCS_TYPE_IP_NETWORK_ACL) {
1368                  struct ccs_ip_network_acl_record *acl                  struct ccs_ip_network_acl *acl
1369                          = container_of(ptr, struct ccs_ip_network_acl_record,                          = container_of(ptr, struct ccs_ip_network_acl,
1370                                         head);                                         head);
1371                  return ccs_print_network_acl(head, acl, cond);                  return ccs_print_network_acl(head, acl, cond);
1372          }          }
1373          if (acl_type == CCS_TYPE_SIGNAL_ACL) {          if (acl_type == CCS_TYPE_SIGNAL_ACL) {
1374                  struct ccs_signal_acl_record *acl                  struct ccs_signal_acl *acl
1375                          = container_of(ptr, struct ccs_signal_acl_record, head);                          = container_of(ptr, struct ccs_signal_acl, head);
1376                  return ccs_print_signal_acl(head, acl, cond);                  return ccs_print_signal_acl(head, acl, cond);
1377          }          }
1378          if (acl_type == CCS_TYPE_MOUNT_ACL) {          if (acl_type == CCS_TYPE_MOUNT_ACL) {
1379                  struct ccs_mount_acl_record *acl                  struct ccs_mount_acl *acl
1380                          = container_of(ptr, struct ccs_mount_acl_record, head);                          = container_of(ptr, struct ccs_mount_acl, head);
1381                  return ccs_print_mount_acl(head, acl, cond);                  return ccs_print_mount_acl(head, acl, cond);
1382          }          }
1383          if (acl_type == CCS_TYPE_UMOUNT_ACL) {          if (acl_type == CCS_TYPE_UMOUNT_ACL) {
1384                  struct ccs_umount_acl_record *acl                  struct ccs_umount_acl *acl
1385                          = container_of(ptr, struct ccs_umount_acl_record, head);                          = container_of(ptr, struct ccs_umount_acl, head);
1386                  return ccs_print_umount_acl(head, acl, cond);                  return ccs_print_umount_acl(head, acl, cond);
1387          }          }
1388          if (acl_type == CCS_TYPE_CHROOT_ACL) {          if (acl_type == CCS_TYPE_CHROOT_ACL) {
1389                  struct ccs_chroot_acl_record *acl                  struct ccs_chroot_acl *acl
1390                          = container_of(ptr, struct ccs_chroot_acl_record, head);                          = container_of(ptr, struct ccs_chroot_acl, head);
1391                  return ccs_print_chroot_acl(head, acl, cond);                  return ccs_print_chroot_acl(head, acl, cond);
1392          }          }
1393          if (acl_type == CCS_TYPE_PIVOT_ROOT_ACL) {          if (acl_type == CCS_TYPE_PIVOT_ROOT_ACL) {
1394                  struct ccs_pivot_root_acl_record *acl                  struct ccs_pivot_root_acl *acl
1395                          = container_of(ptr, struct ccs_pivot_root_acl_record,                          = container_of(ptr, struct ccs_pivot_root_acl,
1396                                         head);                                         head);
1397                  return ccs_print_pivot_root_acl(head, acl, cond);                  return ccs_print_pivot_root_acl(head, acl, cond);
1398          }          }
Legend:
Removed from v.2911  
changed lines
  Added in v.2915
Back to OSDN">Back to OSDN
 ViewVC Help
Powered by ViewVC 1.1.26  
サイト情報
ソフトウェアを探す
ソフトウェアを作る
コミュニティ
ヘルプ