オープンソース・ソフトウェアの開発とダウンロード

TOMOYO

Subversion リポジトリの参照

/[tomoyo]/trunk/1.5.x/ccs-patch/fs/sakura_mount.c

Diff of /trunk/1.5.x/ccs-patch/fs/sakura_mount.c

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 324 by kumaneko, Mon Aug 6 12:39:49 2007 UTC revision 325 by kumaneko, Mon Aug 6 12:55:41 2007 UTC
# Line 5  Line 5 
5   *   *
6   * Copyright (C) 2005-2007  NTT DATA CORPORATION   * Copyright (C) 2005-2007  NTT DATA CORPORATION
7   *   *
8   * Version: 1.4.2   2007/07/13   * Version: 1.5.0-pre   2007/08/06
9   *   *
10   * This file is applicable to both 2.4.30 and 2.6.11 and later.   * This file is applicable to both 2.4.30 and 2.6.11 and later.
11   * See README.ccs for ChangeLog.   * See README.ccs for ChangeLog.
# Line 55  struct mount_entry { Line 55  struct mount_entry {
55          const struct path_info *dev_name;          const struct path_info *dev_name;
56          const struct path_info *dir_name;          const struct path_info *dir_name;
57          const struct path_info *fs_type;          const struct path_info *fs_type;
58          unsigned int disabled_options; /* Options to forcefully disable.        */          unsigned long flags;
         unsigned int enabled_options;  /* Options to forcefully enable.         */  
59          int is_deleted;          int is_deleted;
60  };  };
61    
62  /*************************  MOUNT RESTRICTION HANDLER  *************************/  /*************************  MOUNT RESTRICTION HANDLER  *************************/
63    
 static void ParseMountOptions(char *arg, unsigned int *enabled_options, unsigned int *disabled_options)  
 {  
         char *sp = arg, *cp;  
         unsigned int enable = 0, disable = 0;  
         while ((cp = strsep(&sp, " ,")) != NULL) {  
                 if (strcmp(cp, "rw") == 0)          disable |= MS_RDONLY;  
                 else if (strcmp(cp, "ro") == 0)     enable  |= MS_RDONLY;  
                 else if (strcmp(cp, "suid") == 0)   disable |= MS_NOSUID;  
                 else if (strcmp(cp, "nosuid") == 0) enable  |= MS_NOSUID;  
                 else if (strcmp(cp, "dev") == 0)    disable |= MS_NODEV;  
                 else if (strcmp(cp, "nodev") == 0)  enable  |= MS_NODEV;  
                 else if (strcmp(cp, "exec") == 0)   disable |= MS_NOEXEC;  
                 else if (strcmp(cp, "noexec") == 0) enable  |= MS_NOEXEC;  
                 else if (strcmp(cp, "atime") == 0)      disable |= MS_NOATIME;  
                 else if (strcmp(cp, "noatime") == 0)    enable  |= MS_NOATIME;  
                 else if (strcmp(cp, "diratime") == 0)   disable |= MS_NODIRATIME;  
                 else if (strcmp(cp, "nodiratime") == 0) enable  |= MS_NODIRATIME;  
                 else if (strcmp(cp, "norecurse") == 0)  disable |= MS_REC;  
                 else if (strcmp(cp, "recurse") == 0)    enable  |= MS_REC;  
         }  
         *enabled_options = enable;  
         *disabled_options = disable;  
 }  
   
 static void MakeMountOptions(char *buffer, const int buffer_len, const unsigned int enabled, const unsigned int disabled)  
 {  
         memset(buffer, 0, buffer_len);  
         if (enabled == 0 && disabled == 0) {  
                 snprintf(buffer, buffer_len - 1, "defaults");  
         } else {  
                 snprintf(buffer, buffer_len - 1, "%s%s%s%s%s%s%s",  
                                  enabled & MS_RDONLY     ? "ro "     :     (disabled & MS_RDONLY     ? "rw "        : ""),  
                                  enabled & MS_NOSUID     ? "nosuid " :     (disabled & MS_NOSUID     ? "suid "      : ""),  
                                  enabled & MS_NODEV      ? "nodev "  :     (disabled & MS_NODEV      ? "dev "       : ""),  
                                  enabled & MS_NOEXEC     ? "noexec " :     (disabled & MS_NOEXEC     ? "exec "      : ""),  
                                  enabled & MS_NOATIME    ? "noatime " :    (disabled & MS_NOATIME    ? "atime "     : ""),  
                                  enabled & MS_NODIRATIME ? "nodiratime " : (disabled & MS_NODIRATIME ? "diratime "  : ""),  
                                  enabled & MS_REC        ? "recurse " :    (disabled & MS_REC        ? "norecurse " : ""));  
         }  
 }  
   
64  static void put_filesystem(struct file_system_type *fs)  static void put_filesystem(struct file_system_type *fs)
65  {  {
66          module_put(fs->owner);          module_put(fs->owner);
# Line 110  static void put_filesystem(struct file_s Line 68  static void put_filesystem(struct file_s
68    
69  static struct mount_entry *mount_list = NULL;  static struct mount_entry *mount_list = NULL;
70    
71  static int AddMountACL(const char *dev_name, const char *dir_name, const char *fs_type, const unsigned int enable, const unsigned int disable, const int is_delete)  static int AddMountACL(const char *dev_name, const char *dir_name, const char *fs_type, const unsigned long flags, const int is_delete)
72  {  {
73          struct mount_entry *new_entry, *ptr;          struct mount_entry *new_entry, *ptr;
74          const struct path_info *fs, *dev, *dir;          const struct path_info *fs, *dev, *dir;
75          static DECLARE_MUTEX(lock);          static DECLARE_MUTEX(lock);
76          int error = -ENOMEM;          int error = -ENOMEM;
         if (enable & disable) return -EINVAL; /* options mismatch. */  
77          if ((fs = SaveName(fs_type)) == NULL) return -EINVAL;          if ((fs = SaveName(fs_type)) == NULL) return -EINVAL;
78          if (!dev_name) dev_name = "<NULL>"; /* Map dev_name to "<NULL>" for if no dev_name given. */          if (!dev_name) dev_name = "<NULL>"; /* Map dev_name to "<NULL>" for if no dev_name given. */
79          if (strcmp(fs->name, MOUNT_REMOUNT_KEYWORD) == 0) dev_name = "any"; /* Fix dev_name to "any" for remount permission. */          if (strcmp(fs->name, MOUNT_REMOUNT_KEYWORD) == 0) dev_name = "any"; /* Fix dev_name to "any" for remount permission. */
# Line 128  static int AddMountACL(const char *dev_n Line 85  static int AddMountACL(const char *dev_n
85          if ((dev = SaveName(dev_name)) == NULL || (dir = SaveName(dir_name)) == NULL) return -ENOMEM;          if ((dev = SaveName(dev_name)) == NULL || (dir = SaveName(dir_name)) == NULL) return -ENOMEM;
86          down(&lock);          down(&lock);
87          for (ptr = mount_list; ptr; ptr = ptr->next) {          for (ptr = mount_list; ptr; ptr = ptr->next) {
88                  if (pathcmp(ptr->dev_name, dev) || pathcmp(ptr->dir_name, dir) || pathcmp(ptr->fs_type, fs)) continue;                  if (ptr->flags != flags || pathcmp(ptr->dev_name, dev) || pathcmp(ptr->dir_name, dir) || pathcmp(ptr->fs_type, fs)) continue;
89                    error = 0;
90                  if (is_delete) {                  if (is_delete) {
                         if (ptr->disabled_options != disable || ptr->enabled_options != enable) continue;  
91                          ptr->is_deleted = 1;                          ptr->is_deleted = 1;
                         error = 0;  
92                          goto out;                          goto out;
93                  } else {                  } else {
94                          if (ptr->is_deleted) {                          if (ptr->is_deleted) {
                                 ptr->enabled_options = enable;  
                                 ptr->disabled_options = disable;  
95                                  ptr->is_deleted = 0;                                  ptr->is_deleted = 0;
96                          } else {                                  goto update;
                                 if ((ptr->enabled_options & disable) || (ptr->disabled_options | enable)) {  
                                         error = -EINVAL; goto out; /* options mismatch. */  
                                 }  
                                 if ((ptr->enabled_options & enable) == enable && (ptr->disabled_options & disable) == disable) {  
                                         error = 0; goto out; /* No changes. */  
                                 }  
                                 ptr->enabled_options |= enable;  
                                 ptr->disabled_options |= disable;  
97                          }                          }
98                          error = 0;                          goto out; /* No changes. */
                         goto update;  
99                  }                  }
100          }          }
101          if (is_delete) {          if (is_delete) {
# Line 161  static int AddMountACL(const char *dev_n Line 106  static int AddMountACL(const char *dev_n
106          new_entry->dev_name = dev;          new_entry->dev_name = dev;
107          new_entry->dir_name = dir;          new_entry->dir_name = dir;
108          new_entry->fs_type = fs;          new_entry->fs_type = fs;
109          new_entry->enabled_options = enable;          new_entry->flags = flags;
         new_entry->disabled_options = disable;  
110          mb(); /* Instead of using spinlock. */          mb(); /* Instead of using spinlock. */
111          if ((ptr = mount_list) != NULL) {          if ((ptr = mount_list) != NULL) {
112                  while (ptr->next) ptr = ptr->next; ptr->next = new_entry;                  while (ptr->next) ptr = ptr->next; ptr->next = new_entry;
# Line 174  static int AddMountACL(const char *dev_n Line 118  static int AddMountACL(const char *dev_n
118   update:   update:
119          {          {
120                  struct file_system_type *type = NULL;                  struct file_system_type *type = NULL;
                 char options[64];  
                 MakeMountOptions(options, sizeof(options), ptr->enabled_options, ptr->disabled_options);  
121                  if (strcmp(fs->name, MOUNT_REMOUNT_KEYWORD) == 0) {                  if (strcmp(fs->name, MOUNT_REMOUNT_KEYWORD) == 0) {
122                          printk("%sAllow remount %s with options %s.\n", ccs_log_level, dir->name, options);                          printk("%sAllow remount %s with options 0x%lX.\n", ccs_log_level, dir->name, ptr->flags);
123                  } else if (strcmp(fs->name, MOUNT_BIND_KEYWORD) == 0 || strcmp(fs->name, MOUNT_MOVE_KEYWORD) == 0) {                  } else if (strcmp(fs->name, MOUNT_BIND_KEYWORD) == 0 || strcmp(fs->name, MOUNT_MOVE_KEYWORD) == 0) {
124                          printk("%sAllow mount %s %s %s\n", ccs_log_level, fs->name, dev->name, dir->name);                          printk("%sAllow mount %s %s %s with options 0x%lX\n", ccs_log_level, fs->name, dev->name, dir->name, ptr->flags);
125                  } else if (strcmp(fs->name, MOUNT_MAKE_UNBINDABLE_KEYWORD) == 0 ||                  } else if (strcmp(fs->name, MOUNT_MAKE_UNBINDABLE_KEYWORD) == 0 ||
126                                     strcmp(fs->name, MOUNT_MAKE_PRIVATE_KEYWORD) == 0 ||                                     strcmp(fs->name, MOUNT_MAKE_PRIVATE_KEYWORD) == 0 ||
127                                     strcmp(fs->name, MOUNT_MAKE_SLAVE_KEYWORD) == 0 ||                                     strcmp(fs->name, MOUNT_MAKE_SLAVE_KEYWORD) == 0 ||
128                                     strcmp(fs->name, MOUNT_MAKE_SHARED_KEYWORD) == 0) {                                     strcmp(fs->name, MOUNT_MAKE_SHARED_KEYWORD) == 0) {
129                          printk("%sAllow mount %s %s with options %s.\n", ccs_log_level, fs->name, dir->name, options);                          printk("%sAllow mount %s %s with options 0x%lX.\n", ccs_log_level, fs->name, dir->name, ptr->flags);
130                  } else if ((type = get_fs_type(fs->name)) != NULL && (type->fs_flags & FS_REQUIRES_DEV) != 0) {                  } else if ((type = get_fs_type(fs->name)) != NULL && (type->fs_flags & FS_REQUIRES_DEV) != 0) {
131                          printk("%sAllow mount -t %s %s %s with options %s.\n", ccs_log_level, fs->name, dev->name, dir->name, options);                          printk("%sAllow mount -t %s %s %s with options 0x%lX.\n", ccs_log_level, fs->name, dev->name, dir->name, ptr->flags);
132                  } else {                  } else {
133                          printk("%sAllow mount %s on %s with options %s.\n", ccs_log_level, fs->name, dir->name, options);                          printk("%sAllow mount %s on %s with options 0x%lX.\n", ccs_log_level, fs->name, dir->name, ptr->flags);
134                  }                  }
135                  if (type) put_filesystem(type);                  if (type) put_filesystem(type);
136          }          }
# Line 197  static int AddMountACL(const char *dev_n Line 139  static int AddMountACL(const char *dev_n
139          return error;          return error;
140  }  }
141    
142  int CheckMountPermission(char *dev_name, char *dir_name, char *type, unsigned long *flags)  static int CheckMountPermission2(char *dev_name, char *dir_name, char *type, unsigned long flags)
143  {  {
144          const int is_enforce = CheckCCSEnforce(CCS_SAKURA_RESTRICT_MOUNT);          const int is_enforce = CheckCCSEnforce(CCS_SAKURA_RESTRICT_MOUNT);
145          int error_flag = 1;          int error_flag = 1;
146          if (!CheckCCSFlags(CCS_SAKURA_RESTRICT_MOUNT)) return 0;          if (!CheckCCSFlags(CCS_SAKURA_RESTRICT_MOUNT)) return 0;
147          if (!type) type = "<NULL>";          if (!type) type = "<NULL>";
148          if ((*flags & MS_MGC_MSK) == MS_MGC_VAL) *flags &= ~MS_MGC_MSK;          if ((flags & MS_MGC_MSK) == MS_MGC_VAL) flags &= ~MS_MGC_MSK;
149          switch (*flags & (MS_REMOUNT | MS_MOVE | MS_BIND)) {          switch (flags & (MS_REMOUNT | MS_MOVE | MS_BIND)) {
150          case MS_REMOUNT:          case MS_REMOUNT:
151          case MS_MOVE:          case MS_MOVE:
152          case MS_BIND:          case MS_BIND:
# Line 212  int CheckMountPermission(char *dev_name, Line 154  int CheckMountPermission(char *dev_name,
154                  break;                  break;
155          default:          default:
156                  printk("SAKURA-ERROR: %s%s%sare given for single mount operation.\n",                  printk("SAKURA-ERROR: %s%s%sare given for single mount operation.\n",
157                             *flags & MS_REMOUNT ? "'remount' " : "",                             flags & MS_REMOUNT ? "'remount' " : "",
158                             *flags & MS_MOVE    ? "'move' " : "",                             flags & MS_MOVE    ? "'move' " : "",
159                             *flags & MS_BIND    ? "'bind' " : "");                             flags & MS_BIND    ? "'bind' " : "");
160                  return -EINVAL;                  return -EINVAL;
161          }          }
162          switch (*flags & (MS_UNBINDABLE | MS_PRIVATE | MS_SLAVE | MS_SHARED)) {          switch (flags & (MS_UNBINDABLE | MS_PRIVATE | MS_SLAVE | MS_SHARED)) {
163          case MS_UNBINDABLE:          case MS_UNBINDABLE:
164          case MS_PRIVATE:          case MS_PRIVATE:
165          case MS_SLAVE:          case MS_SLAVE:
# Line 226  int CheckMountPermission(char *dev_name, Line 168  int CheckMountPermission(char *dev_name,
168                  break;                  break;
169          default:          default:
170                  printk("SAKURA-ERROR: %s%s%s%sare given for single mount operation.\n",                  printk("SAKURA-ERROR: %s%s%s%sare given for single mount operation.\n",
171                             *flags & MS_UNBINDABLE ? "'unbindable' " : "",                             flags & MS_UNBINDABLE ? "'unbindable' " : "",
172                             *flags & MS_PRIVATE    ? "'private' " : "",                             flags & MS_PRIVATE    ? "'private' " : "",
173                             *flags & MS_SLAVE      ? "'slave' " : "",                             flags & MS_SLAVE      ? "'slave' " : "",
174                             *flags & MS_SHARED     ? "'shared' " : "");                             flags & MS_SHARED     ? "'shared' " : "");
175                  return -EINVAL;                  return -EINVAL;
176          }          }
177          if (*flags & MS_REMOUNT) {          if (flags & MS_REMOUNT) {
178                  *flags &= ~MS_REMOUNT;                  error_flag = CheckMountPermission2(dev_name, dir_name, MOUNT_REMOUNT_KEYWORD, flags & ~MS_REMOUNT);
179                  error_flag = CheckMountPermission(dev_name, dir_name, MOUNT_REMOUNT_KEYWORD, flags);          } else if (flags & MS_MOVE) {
180                  *flags |= MS_REMOUNT;                  error_flag = CheckMountPermission2(dev_name, dir_name, MOUNT_MOVE_KEYWORD, flags & ~MS_MOVE);
181          } else if (*flags & MS_MOVE) {          } else if (flags & MS_BIND) {
182                  *flags &= ~MS_MOVE;                  error_flag = CheckMountPermission2(dev_name, dir_name, MOUNT_BIND_KEYWORD, flags & ~MS_BIND);
183                  error_flag = CheckMountPermission(dev_name, dir_name, MOUNT_MOVE_KEYWORD, flags);          } else if (flags & MS_UNBINDABLE) {
184                  *flags |= MS_MOVE;                  error_flag = CheckMountPermission2(dev_name, dir_name, MOUNT_MAKE_UNBINDABLE_KEYWORD, flags & ~MS_UNBINDABLE);
185          } else if (*flags & MS_BIND) {          } else if (flags & MS_PRIVATE) {
186                  *flags &= ~MS_BIND;                  error_flag = CheckMountPermission2(dev_name, dir_name, MOUNT_MAKE_PRIVATE_KEYWORD, flags & ~MS_PRIVATE);
187                  error_flag = CheckMountPermission(dev_name, dir_name, MOUNT_BIND_KEYWORD, flags);          } else if (flags & MS_SLAVE) {
188                  *flags |= MS_BIND;                  error_flag = CheckMountPermission2(dev_name, dir_name, MOUNT_MAKE_SLAVE_KEYWORD, flags & ~MS_SLAVE);
189          } else if (*flags & MS_UNBINDABLE) {          } else if (flags & MS_SHARED) {
190                  *flags &= ~MS_UNBINDABLE;                  error_flag = CheckMountPermission2(dev_name, dir_name, MOUNT_MAKE_SHARED_KEYWORD, flags & ~MS_SHARED);
                 error_flag = CheckMountPermission(dev_name, dir_name, MOUNT_MAKE_UNBINDABLE_KEYWORD, flags);  
                 *flags |= MS_UNBINDABLE;  
         } else if (*flags & MS_PRIVATE) {  
                 *flags &= ~MS_PRIVATE;  
                 error_flag = CheckMountPermission(dev_name, dir_name, MOUNT_MAKE_PRIVATE_KEYWORD, flags);  
                 *flags |= MS_PRIVATE;  
         } else if (*flags & MS_SLAVE) {  
                 *flags &= ~MS_SLAVE;  
                 error_flag = CheckMountPermission(dev_name, dir_name, MOUNT_MAKE_SLAVE_KEYWORD, flags);  
                 *flags |= MS_SLAVE;  
         } else if (*flags & MS_SHARED) {  
                 *flags &= ~MS_SHARED;  
                 error_flag = CheckMountPermission(dev_name, dir_name, MOUNT_MAKE_SHARED_KEYWORD, flags);  
                 *flags |= MS_SHARED;  
191          } else {          } else {
192                  goto normal_mount;                  goto normal_mount;
193          }          }
# Line 306  int CheckMountPermission(char *dev_name, Line 234  int CheckMountPermission(char *dev_name,
234                  for (ptr = mount_list; ptr; ptr = ptr->next) {                  for (ptr = mount_list; ptr; ptr = ptr->next) {
235                          if (ptr->is_deleted) continue;                          if (ptr->is_deleted) continue;
236                                                    
237                            /* Compare options */
238                            if (ptr->flags != flags) continue;
239    
240                          /* Compare fs name. */                          /* Compare fs name. */
241                          if (strcmp(type, ptr->fs_type->name)) continue;                          if (strcmp(type, ptr->fs_type->name)) continue;
242                                                    
# Line 317  int CheckMountPermission(char *dev_name, Line 248  int CheckMountPermission(char *dev_name,
248                                                    
249                          /* OK. */                          /* OK. */
250                          error_flag = 0;                          error_flag = 0;
251                          *flags &= ~ptr->disabled_options;                                                  
                         *flags |= ptr->enabled_options;  
                           
252                          if (need_dev > 0) {                          if (need_dev > 0) {
253                                  printk(KERN_DEBUG "SAKURA-NOTICE: 'mount -t %s %s %s' accepted.\n", type, requested_dev_name, requested_dir_name);                                  printk(KERN_DEBUG "SAKURA-NOTICE: 'mount -t %s %s %s 0x%lX' accepted.\n", type, requested_dev_name, requested_dir_name, flags);
254                          } else if (need_dev < 0) {                          } else if (need_dev < 0) {
255                                  printk(KERN_DEBUG "SAKURA-NOTICE: 'mount %s %s %s' accepted.\n", type, requested_dev_name, requested_dir_name);                                  printk(KERN_DEBUG "SAKURA-NOTICE: 'mount %s %s %s 0x%lX' accepted.\n", type, requested_dev_name, requested_dir_name, flags);
256                          } else if (strcmp(type, MOUNT_REMOUNT_KEYWORD) == 0) {                          } else if (strcmp(type, MOUNT_REMOUNT_KEYWORD) == 0) {
257                                  printk(KERN_DEBUG "SAKURA-NOTICE: 'mount -o remount %s' accepted.\n", requested_dir_name);                                  printk(KERN_DEBUG "SAKURA-NOTICE: 'mount -o remount %s 0x%lX' accepted.\n", requested_dir_name, flags);
258                          } else if (strcmp(type, MOUNT_MAKE_UNBINDABLE_KEYWORD) == 0 ||                          } else if (strcmp(type, MOUNT_MAKE_UNBINDABLE_KEYWORD) == 0 ||
259                                             strcmp(type, MOUNT_MAKE_PRIVATE_KEYWORD) == 0 ||                                             strcmp(type, MOUNT_MAKE_PRIVATE_KEYWORD) == 0 ||
260                                             strcmp(type, MOUNT_MAKE_SLAVE_KEYWORD) == 0 ||                                             strcmp(type, MOUNT_MAKE_SLAVE_KEYWORD) == 0 ||
261                                             strcmp(type, MOUNT_MAKE_SHARED_KEYWORD) == 0) {                                             strcmp(type, MOUNT_MAKE_SHARED_KEYWORD) == 0) {
262                                  printk(KERN_DEBUG "SAKURA-NOTICE: 'mount %s %s' accepted.\n", type, requested_dir_name);                                  printk(KERN_DEBUG "SAKURA-NOTICE: 'mount %s %s 0x%lX' accepted.\n", type, requested_dir_name, flags);
263                          } else {                          } else {
264                                  printk(KERN_DEBUG "SAKURA-NOTICE: 'mount %s on %s' accepted.\n", type, requested_dir_name);                                  printk(KERN_DEBUG "SAKURA-NOTICE: 'mount %s on %s 0x%lX' accepted.\n", type, requested_dir_name, flags);
265                          }                          }
266                          break;                          break;
267                  }                  }
268                  if (error_flag && !is_enforce && CheckCCSAccept(CCS_SAKURA_RESTRICT_MOUNT)) {                  if (error_flag && !is_enforce && CheckCCSAccept(CCS_SAKURA_RESTRICT_MOUNT)) {
269                          AddMountACL(need_dev ? requested_dev_name : dev_name, requested_dir_name, type, 0, 0, 0);                          AddMountACL(need_dev ? requested_dev_name : dev_name, requested_dir_name, type, flags, 0);
270                          UpdateCounter(CCS_UPDATES_COUNTER_SYSTEM_POLICY);                          UpdateCounter(CCS_UPDATES_COUNTER_SYSTEM_POLICY);
271                  }                  }
272          cleanup:          cleanup:
# Line 351  int CheckMountPermission(char *dev_name, Line 280  int CheckMountPermission(char *dev_name,
280                  const int is_enforce = CheckCCSEnforce(CCS_SAKURA_RESTRICT_MOUNT);                  const int is_enforce = CheckCCSEnforce(CCS_SAKURA_RESTRICT_MOUNT);
281                  const char *realname1 = realpath(dev_name), *realname2 = realpath(dir_name), *exename = GetEXE();                  const char *realname1 = realpath(dev_name), *realname2 = realpath(dir_name), *exename = GetEXE();
282                  if (strcmp(type, MOUNT_REMOUNT_KEYWORD) == 0) {                  if (strcmp(type, MOUNT_REMOUNT_KEYWORD) == 0) {
283                          printk("SAKURA-%s: mount -o remount %s (pid=%d:exe=%s): Permission denied.\n", GetMSG(is_enforce), realname2 ? realname2 : dir_name, current->pid, exename);                          printk("SAKURA-%s: mount -o remount %s 0x%lX (pid=%d:exe=%s): Permission denied.\n", GetMSG(is_enforce), realname2 ? realname2 : dir_name, flags, current->pid, exename);
284                          if (is_enforce && CheckSupervisor("# %s is requesting\nmount -o remount %s\n", exename, realname2 ? realname2 : dir_name) == 0) error = 0;                          if (is_enforce && CheckSupervisor("# %s is requesting\nmount -o remount %s\n", exename, realname2 ? realname2 : dir_name) == 0) error = 0;
285                  } else if (strcmp(type, MOUNT_BIND_KEYWORD) == 0 || strcmp(type, MOUNT_MOVE_KEYWORD) == 0) {                  } else if (strcmp(type, MOUNT_BIND_KEYWORD) == 0 || strcmp(type, MOUNT_MOVE_KEYWORD) == 0) {
286                          printk("SAKURA-%s: mount %s %s %s (pid=%d:exe=%s): Permission denied.\n", GetMSG(is_enforce), type, realname1 ? realname1 : dev_name, realname2 ? realname2 : dir_name, current->pid, exename);                          printk("SAKURA-%s: mount %s %s %s 0x%lX (pid=%d:exe=%s): Permission denied.\n", GetMSG(is_enforce), type, realname1 ? realname1 : dev_name, realname2 ? realname2 : dir_name, flags, current->pid, exename);
287                          if (is_enforce && CheckSupervisor("# %s is requesting\nmount %s %s %s\n", exename, type, realname1 ? realname1 : dev_name, realname2 ? realname2 : dir_name) == 0) error = 0;                          if (is_enforce && CheckSupervisor("# %s is requesting\nmount %s %s %s 0x%lX\n", exename, type, realname1 ? realname1 : dev_name, realname2 ? realname2 : dir_name, flags) == 0) error = 0;
288                  } else if (strcmp(type, MOUNT_MAKE_UNBINDABLE_KEYWORD) == 0 ||                  } else if (strcmp(type, MOUNT_MAKE_UNBINDABLE_KEYWORD) == 0 ||
289                                     strcmp(type, MOUNT_MAKE_PRIVATE_KEYWORD) == 0 ||                                     strcmp(type, MOUNT_MAKE_PRIVATE_KEYWORD) == 0 ||
290                                     strcmp(type, MOUNT_MAKE_SLAVE_KEYWORD) == 0 ||                                     strcmp(type, MOUNT_MAKE_SLAVE_KEYWORD) == 0 ||
291                                     strcmp(type, MOUNT_MAKE_SHARED_KEYWORD) == 0) {                                     strcmp(type, MOUNT_MAKE_SHARED_KEYWORD) == 0) {
292                          printk("SAKURA-%s: mount %s %s (pid=%d:exe=%s): Permission denied.\n", GetMSG(is_enforce), type, realname2 ? realname2 : dir_name, current->pid, exename);                          printk("SAKURA-%s: mount %s %s 0x%lX (pid=%d:exe=%s): Permission denied.\n", GetMSG(is_enforce), type, realname2 ? realname2 : dir_name, flags, current->pid, exename);
293                          if (is_enforce && CheckSupervisor("# %s is requesting\nmount %s %s", exename, type, realname2 ? realname2 : dir_name) == 0) error = 0;                          if (is_enforce && CheckSupervisor("# %s is requesting\nmount %s %s 0x%lX", exename, type, realname2 ? realname2 : dir_name, flags) == 0) error = 0;
294                  } else {                  } else {
295                          printk("SAKURA-%s: mount -t %s %s %s (pid=%d:exe=%s): Permission denied.\n", GetMSG(is_enforce), type, realname1 ? realname1 : dev_name, realname2 ? realname2 : dir_name, current->pid, exename);                          printk("SAKURA-%s: mount -t %s %s %s 0x%lX (pid=%d:exe=%s): Permission denied.\n", GetMSG(is_enforce), type, realname1 ? realname1 : dev_name, realname2 ? realname2 : dir_name, flags, current->pid, exename);
296                          if (is_enforce && CheckSupervisor("# %s is requesting\nmount -t %s %s %s\n", exename, type, realname1 ? realname1 : dev_name, realname2 ? realname2 : dir_name) == 0) error = 0;                          if (is_enforce && CheckSupervisor("# %s is requesting\nmount -t %s %s %s 0x%lX\n", exename, type, realname1 ? realname1 : dev_name, realname2 ? realname2 : dir_name, flags) == 0) error = 0;
297                  }                  }
298                  if (exename) ccs_free(exename);                  if (exename) ccs_free(exename);
299                  if (realname2) ccs_free(realname2);                  if (realname2) ccs_free(realname2);
# Line 373  int CheckMountPermission(char *dev_name, Line 302  int CheckMountPermission(char *dev_name,
302          }          }
303          return 0;          return 0;
304  }  }
305    
306    int CheckMountPermission(char *dev_name, char *dir_name, char *type, unsigned long *flags)
307    {
308            return CheckMountPermission2(dev_name, dir_name, type, *flags);
309    }
310    
311  EXPORT_SYMBOL(CheckMountPermission);  EXPORT_SYMBOL(CheckMountPermission);
312    
313  int AddMountPolicy(char *data, const int is_delete)  int AddMountPolicy(char *data, const int is_delete)
314  {  {
315          char *cp, *cp2;          char *cp, *cp2;
316          const char *fs, *dev, *dir;          const char *fs, *dev, *dir;
317          unsigned int enable = 0, disable = 0;          unsigned long flags = 0;
318          cp2 = data; if ((cp = strchr(cp2, ' ')) == NULL) return -EINVAL; *cp = '\0'; dev = cp2;          cp2 = data; if ((cp = strchr(cp2, ' ')) == NULL) return -EINVAL; *cp = '\0'; dev = cp2;
319          cp2 = cp + 1; if ((cp = strchr(cp2, ' ')) == NULL) return -EINVAL; *cp = '\0'; dir = cp2;          cp2 = cp + 1; if ((cp = strchr(cp2, ' ')) == NULL) return -EINVAL; *cp = '\0'; dir = cp2;
320          cp2 = cp + 1;          cp2 = cp + 1; if ((cp = strchr(cp2, ' ')) == NULL) return -EINVAL; *cp = '\0'; fs = cp2;
321          if ((cp = strchr(cp2, ' ')) != NULL) {          flags = simple_strtoul(cp + 1, NULL, 0);
322                  *cp = '\0';          return AddMountACL(dev, dir, fs, flags, is_delete);
                 ParseMountOptions(cp + 1, &enable, &disable);  
         }  
         fs = cp2;  
         return AddMountACL(dev, dir, fs, enable, disable, is_delete);  
323  }  }
324    
325  int ReadMountPolicy(struct io_buffer *head)  int ReadMountPolicy(struct io_buffer *head)
# Line 396  int ReadMountPolicy(struct io_buffer *he Line 327  int ReadMountPolicy(struct io_buffer *he
327          struct mount_entry *ptr = head->read_var2;          struct mount_entry *ptr = head->read_var2;
328          if (!ptr) ptr = mount_list;          if (!ptr) ptr = mount_list;
329          while (ptr) {          while (ptr) {
                 char options[64];  
330                  head->read_var2 = ptr;                  head->read_var2 = ptr;
331                  MakeMountOptions(options, sizeof(options), ptr->enabled_options, ptr->disabled_options);                  if (ptr->is_deleted == 0 && io_printf(head, KEYWORD_ALLOW_MOUNT "%s %s %s 0x%lX\n", ptr->dev_name->name, ptr->dir_name->name, ptr->fs_type->name, ptr->flags)) break;
                 if (ptr->is_deleted == 0 && io_printf(head, KEYWORD_ALLOW_MOUNT "%s %s %s %s\n", ptr->dev_name->name, ptr->dir_name->name, ptr->fs_type->name, options)) break;  
332                  ptr = ptr->next;                  ptr = ptr->next;
333          }          }
334          return ptr ? -ENOMEM : 0;          return ptr ? -ENOMEM : 0;
Legend:
Removed from v.324  
changed lines
  Added in v.325
Back to OSDN">Back to OSDN
 ViewVC Help
Powered by ViewVC 1.1.26  
サイト情報
ソフトウェアを探す
ソフトウェアを作る
コミュニティ
ヘルプ