オープンソース・ソフトウェアの開発とダウンロード

TOMOYO

Subversion リポジトリの参照

/[tomoyo]/trunk/1.6.x/ccs-patch/fs/sakura_chroot.c

Diff of /trunk/1.6.x/ccs-patch/fs/sakura_chroot.c

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

trunk/ccs-patch/fs/sakura_chroot.c revision 141 by kumaneko, Mon Mar 19 13:29:09 2007 UTC trunk/1.5.x/ccs-patch/fs/sakura_chroot.c revision 512 by kumaneko, Thu Sep 27 08:52:16 2007 UTC
# Line 5  Line 5 
5   *   *
6   * Copyright (C) 2005-2007  NTT DATA CORPORATION   * Copyright (C) 2005-2007  NTT DATA CORPORATION
7   *   *
8   * Version: 1.3.3   2007/04/01   * Version: 1.5.0   2007/09/20
9   *   *
10   * This file is applicable to both 2.4.30 and 2.6.11 and later.   * This file is applicable to both 2.4.30 and 2.6.11 and later.
11   * See README.ccs for ChangeLog.   * See README.ccs for ChangeLog.
# Line 26  extern const char *ccs_log_level; Line 26  extern const char *ccs_log_level;
26    
27  /***** The structure for chroot restrictions. *****/  /***** The structure for chroot restrictions. *****/
28    
29  typedef struct chroot_entry {  struct chroot_entry {
30          struct chroot_entry *next;          struct chroot_entry *next;
31          const struct path_info *dir;          const struct path_info *dir;
32          int is_deleted;          u8 is_deleted;
33  } CHROOT_ENTRY;  };
34    
35  /*************************  CHROOT RESTRICTION HANDLER  *************************/  /*************************  CHROOT RESTRICTION HANDLER  *************************/
36    
37  static CHROOT_ENTRY *chroot_list = NULL;  static struct chroot_entry *chroot_list = NULL;
38    
39  static int AddChrootACL(const char *dir, const int is_delete)  static int AddChrootACL(const char *dir, const u8 is_delete)
40  {  {
41          CHROOT_ENTRY *new_entry, *ptr;          struct chroot_entry *new_entry, *ptr;
42          const struct path_info *saved_dir;          const struct path_info *saved_dir;
43          static DECLARE_MUTEX(lock);          static DECLARE_MUTEX(lock);
44          int error = -ENOMEM;          int error = -ENOMEM;
# Line 56  static int AddChrootACL(const char *dir, Line 56  static int AddChrootACL(const char *dir,
56                  error = -ENOENT;                  error = -ENOENT;
57                  goto out;                  goto out;
58          }          }
59          if ((new_entry = (CHROOT_ENTRY *) alloc_element(sizeof(CHROOT_ENTRY))) == NULL) goto out;          if ((new_entry = alloc_element(sizeof(*new_entry))) == NULL) goto out;
60          new_entry->dir = saved_dir;          new_entry->dir = saved_dir;
61          mb(); /* Instead of using spinlock. */          mb(); /* Instead of using spinlock. */
62          if ((ptr = chroot_list) != NULL) {          if ((ptr = chroot_list) != NULL) {
# Line 82  int CheckChRootPermission(struct nameida Line 82  int CheckChRootPermission(struct nameida
82                  dir.name = root_name;                  dir.name = root_name;
83                  fill_path_info(&dir);                  fill_path_info(&dir);
84                  if (dir.is_dir) {                  if (dir.is_dir) {
85                          CHROOT_ENTRY *ptr;                          struct chroot_entry *ptr;
86                          for (ptr = chroot_list; ptr; ptr = ptr->next) {                          for (ptr = chroot_list; ptr; ptr = ptr->next) {
87                                  if (ptr->is_deleted) continue;                                  if (ptr->is_deleted) continue;
88                                  if (PathMatchesToPattern(&dir, ptr->dir)) {                                  if (PathMatchesToPattern(&dir, ptr->dir)) {
# Line 93  int CheckChRootPermission(struct nameida Line 93  int CheckChRootPermission(struct nameida
93                  }                  }
94          }          }
95          if (error) {          if (error) {
96                  const int is_enforce = CheckCCSEnforce(CCS_SAKURA_RESTRICT_CHROOT);                  const u8 is_enforce = CheckCCSEnforce(CCS_SAKURA_RESTRICT_CHROOT);
97                  const char *exename = GetEXE();                  const char *exename = GetEXE();
98                  printk("SAKURA-%s: chroot %s (pid=%d:exe=%s): Permission denied.\n", GetMSG(is_enforce), root_name, current->pid, exename);                  printk("SAKURA-%s: chroot %s (pid=%d:exe=%s): Permission denied.\n", GetMSG(is_enforce), root_name, current->pid, exename);
99                  if (is_enforce && CheckSupervisor("# %s is requesting\nchroot %s\n", exename, root_name) == 0) error = 0;                  if (is_enforce && CheckSupervisor("# %s is requesting\nchroot %s\n", exename, root_name) == 0) error = 0;
100                  if (exename) ccs_free(exename);                  if (exename) ccs_free(exename);
101                  if (!is_enforce && CheckCCSAccept(CCS_SAKURA_RESTRICT_CHROOT) && root_name) {                  if (!is_enforce && CheckCCSAccept(CCS_SAKURA_RESTRICT_CHROOT, NULL) && root_name) {
102                          AddChrootACL(root_name, 0);                          AddChrootACL(root_name, 0);
103                          UpdateCounter(CCS_UPDATES_COUNTER_SYSTEM_POLICY);                          UpdateCounter(CCS_UPDATES_COUNTER_SYSTEM_POLICY);
104                  }                  }
# Line 107  int CheckChRootPermission(struct nameida Line 107  int CheckChRootPermission(struct nameida
107          ccs_free(root_name);          ccs_free(root_name);
108          return error;          return error;
109  }  }
110    EXPORT_SYMBOL(CheckChRootPermission);
111    
112  int AddChrootPolicy(char *data, const int is_delete)  int AddChrootPolicy(char *data, const u8 is_delete)
113  {  {
114          return AddChrootACL(data, is_delete);          return AddChrootACL(data, is_delete);
115  }  }
116    
117  int ReadChrootPolicy(IO_BUFFER *head)  int ReadChrootPolicy(struct io_buffer *head)
118  {  {
119          CHROOT_ENTRY *ptr = (CHROOT_ENTRY *) head->read_var2;          struct chroot_entry *ptr = head->read_var2;
120          if (!ptr) ptr = chroot_list;          if (!ptr) ptr = chroot_list;
121          while (ptr) {          while (ptr) {
122                  head->read_var2 = (void *) ptr;                  head->read_var2 = ptr;
123                  if (ptr->is_deleted == 0 && io_printf(head, KEYWORD_ALLOW_CHROOT "%s\n", ptr->dir->name)) break;                  if (ptr->is_deleted == 0 && io_printf(head, KEYWORD_ALLOW_CHROOT "%s\n", ptr->dir->name)) break;
124                  ptr = ptr->next;                  ptr = ptr->next;
125          }          }
126          return ptr ? -ENOMEM : 0;          return ptr ? -ENOMEM : 0;
127  }  }
128    
 EXPORT_SYMBOL(CheckChRootPermission);  
   
129  /***** SAKURA Linux end. *****/  /***** SAKURA Linux end. *****/
Legend:
Removed from v.141  
changed lines
  Added in v.512
Back to OSDN">Back to OSDN
 ViewVC Help
Powered by ViewVC 1.1.26  
サイト情報
ソフトウェアを探す
ソフトウェアを作る
コミュニティ
ヘルプ