オープンソース・ソフトウェアの開発とダウンロード

TOMOYO

Subversion リポジトリの参照

/[tomoyo]/trunk/1.5.x/ccs-patch/fs/tomoyo_signal.c

Diff of /trunk/1.5.x/ccs-patch/fs/tomoyo_signal.c

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

trunk/ccs-patch/fs/tomoyo_signal.c revision 224 by kumaneko, Sun May 20 03:25:13 2007 UTC tags/ccs-patch/1.5.1-rc/fs/tomoyo_signal.c revision 590 by kumaneko, Thu Oct 18 11:53:00 2007 UTC
# Line 5  Line 5 
5   *   *
6   * Copyright (C) 2005-2007  NTT DATA CORPORATION   * Copyright (C) 2005-2007  NTT DATA CORPORATION
7   *   *
8   * Version: 1.4.1-rc1   2007/05/20   * Version: 1.5.2-pre   2007/10/19
9   *   *
10   * This file is applicable to both 2.4.30 and 2.6.11 and later.   * This file is applicable to both 2.4.30 and 2.6.11 and later.
11   * See README.ccs for ChangeLog.   * See README.ccs for ChangeLog.
# Line 26  extern struct semaphore domain_acl_lock; Line 26  extern struct semaphore domain_acl_lock;
26    
27  /*************************  AUDIT FUNCTIONS  *************************/  /*************************  AUDIT FUNCTIONS  *************************/
28    
29  #ifdef CONFIG_TOMOYO_AUDIT  static int AuditSignalLog(const int signal, const struct path_info *dest_domain, const u8 is_granted)
 static int AuditSignalLog(const int signal, const struct path_info *dest_domain, const int is_granted)  
30  {  {
31          char *buf;          char *buf;
32          int len;          int len;
# Line 37  static int AuditSignalLog(const int sign Line 36  static int AuditSignalLog(const int sign
36          snprintf(buf + strlen(buf), len - strlen(buf) - 1, KEYWORD_ALLOW_SIGNAL "%d %s\n", signal, dest_domain->name);          snprintf(buf + strlen(buf), len - strlen(buf) - 1, KEYWORD_ALLOW_SIGNAL "%d %s\n", signal, dest_domain->name);
37          return WriteAuditLog(buf, is_granted);          return WriteAuditLog(buf, is_granted);
38  }  }
 #else  
 static inline void AuditSignalLog(const int signal, const struct path_info *dest_domain, const int is_granted) {}  
 #endif  
39    
40  /*************************  SIGNAL ACL HANDLER  *************************/  /*************************  SIGNAL ACL HANDLER  *************************/
41    
42  static int AddSignalEntry(const int sig, const char *dest_pattern, struct domain_info *domain, const u8 is_add, const struct condition_list *condition)  static int AddSignalEntry(const int sig, const char *dest_pattern, struct domain_info *domain, const struct condition_list *condition, const u8 is_delete)
43  {  {
44          struct acl_info *ptr;          struct acl_info *ptr;
45          const struct path_info *saved_dest_pattern;          const struct path_info *saved_dest_pattern;
# Line 53  static int AddSignalEntry(const int sig, Line 49  static int AddSignalEntry(const int sig,
49          if (!dest_pattern || !IsCorrectDomain(dest_pattern, __FUNCTION__)) return -EINVAL;          if (!dest_pattern || !IsCorrectDomain(dest_pattern, __FUNCTION__)) return -EINVAL;
50          if ((saved_dest_pattern = SaveName(dest_pattern)) == NULL) return -ENOMEM;          if ((saved_dest_pattern = SaveName(dest_pattern)) == NULL) return -ENOMEM;
51          down(&domain_acl_lock);          down(&domain_acl_lock);
52          if (is_add) {          if (!is_delete) {
53                  if ((ptr = domain->first_acl_ptr) == NULL) goto first_entry;                  if ((ptr = domain->first_acl_ptr) == NULL) goto first_entry;
54                  while (1) {                  while (1) {
55                          struct signal_acl_record *new_ptr;                          struct signal_acl_record *new_ptr = (struct signal_acl_record *) ptr;
56                          if (ptr->type == TYPE_SIGNAL_ACL && ptr->u.w == hash && ptr->cond == condition) {                          if (ptr->type == TYPE_SIGNAL_ACL && new_ptr->sig == hash && ptr->cond == condition) {
57                                  if (!pathcmp(((struct signal_acl_record *) ptr)->domainname, saved_dest_pattern)) {                                  if (!pathcmp(new_ptr->domainname, saved_dest_pattern)) {
58                                          ptr->is_deleted = 0;                                          ptr->is_deleted = 0;
59                                          /* Found. Nothing to do. */                                          /* Found. Nothing to do. */
60                                          error = 0;                                          error = 0;
# Line 70  static int AddSignalEntry(const int sig, Line 66  static int AddSignalEntry(const int sig,
66                                  continue;                                  continue;
67                          }                          }
68                  first_entry: ;                  first_entry: ;
                         if (is_add == 1 && TooManyDomainACL(domain)) break;  
69                          /* Not found. Append it to the tail. */                          /* Not found. Append it to the tail. */
70                          if ((new_ptr = alloc_element(sizeof(*new_ptr))) == NULL) break;                          if ((new_ptr = alloc_element(sizeof(*new_ptr))) == NULL) break;
71                          new_ptr->head.type = TYPE_SIGNAL_ACL;                          new_ptr->head.type = TYPE_SIGNAL_ACL;
72                          new_ptr->head.u.w = hash;                          new_ptr->sig = hash;
73                          new_ptr->head.cond = condition;                          new_ptr->head.cond = condition;
74                          new_ptr->domainname = saved_dest_pattern;                          new_ptr->domainname = saved_dest_pattern;
75                          error = AddDomainACL(ptr, domain, (struct acl_info *) new_ptr);                          error = AddDomainACL(ptr, domain, (struct acl_info *) new_ptr);
# Line 83  static int AddSignalEntry(const int sig, Line 78  static int AddSignalEntry(const int sig,
78          } else {          } else {
79                  error = -ENOENT;                  error = -ENOENT;
80                  for (ptr = domain->first_acl_ptr; ptr; ptr = ptr->next) {                  for (ptr = domain->first_acl_ptr; ptr; ptr = ptr->next) {
81                          if (ptr->type != TYPE_SIGNAL_ACL || ptr->is_deleted || ptr->u.w != hash || ptr->cond != condition) continue;                          struct signal_acl_record *ptr2 = (struct signal_acl_record *) ptr;
82                          if (pathcmp(((struct signal_acl_record *) ptr)->domainname, saved_dest_pattern)) continue;                          if (ptr->type != TYPE_SIGNAL_ACL || ptr->is_deleted || ptr2->sig != hash || ptr->cond != condition) continue;
83                            if (pathcmp(ptr2->domainname, saved_dest_pattern)) continue;
84                          error = DelDomainACL(ptr);                          error = DelDomainACL(ptr);
85                          break;                          break;
86                  }                  }
# Line 100  int CheckSignalACL(const int sig, const Line 96  int CheckSignalACL(const int sig, const
96          const char *dest_pattern;          const char *dest_pattern;
97          struct acl_info *ptr;          struct acl_info *ptr;
98          const u16 hash = sig;          const u16 hash = sig;
99          const int is_enforce = CheckCCSEnforce(CCS_TOMOYO_MAC_FOR_SIGNAL);          const u8 is_enforce = CheckCCSEnforce(CCS_TOMOYO_MAC_FOR_SIGNAL);
100          if (!CheckCCSFlags(CCS_TOMOYO_MAC_FOR_SIGNAL)) return 0;          if (!CheckCCSFlags(CCS_TOMOYO_MAC_FOR_SIGNAL)) return 0;
101          if (!sig) return 0;                               /* No check for NULL signal. */          if (!sig) return 0;                               /* No check for NULL signal. */
102          if (current->pid == pid) {          if (current->pid == pid) {
# Line 124  int CheckSignalACL(const int sig, const Line 120  int CheckSignalACL(const int sig, const
120          }          }
121          dest_pattern = dest->domainname->name;          dest_pattern = dest->domainname->name;
122          for (ptr = domain->first_acl_ptr; ptr; ptr = ptr->next) {          for (ptr = domain->first_acl_ptr; ptr; ptr = ptr->next) {
123                  if (ptr->type == TYPE_SIGNAL_ACL && ptr->is_deleted == 0 && ptr->u.w == hash && CheckCondition(ptr->cond, NULL) == 0) {                  struct signal_acl_record *ptr2 = (struct signal_acl_record *) ptr;
124                          const int len = ((struct signal_acl_record *) ptr)->domainname->total_len;                  if (ptr->type == TYPE_SIGNAL_ACL && ptr->is_deleted == 0 && ptr2->sig == hash && CheckCondition(ptr->cond, NULL) == 0) {
125                          if (strncmp(((struct signal_acl_record *) ptr)->domainname->name, dest_pattern, len) == 0 && (dest_pattern[len] == ' ' || dest_pattern[len] == '\0')) break;                          const int len = ptr2->domainname->total_len;
126                            if (strncmp(ptr2->domainname->name, dest_pattern, len) == 0 && (dest_pattern[len] == ' ' || dest_pattern[len] == '\0')) break;
127                  }                  }
128          }          }
129          if (ptr) {          if (ptr) {
# Line 138  int CheckSignalACL(const int sig, const Line 135  int CheckSignalACL(const int sig, const
135          }          }
136          AuditSignalLog(sig, dest->domainname, 0);          AuditSignalLog(sig, dest->domainname, 0);
137          if (is_enforce) return CheckSupervisor("%s\n" KEYWORD_ALLOW_SIGNAL "%d %s\n", domain->domainname->name, sig, dest_pattern);          if (is_enforce) return CheckSupervisor("%s\n" KEYWORD_ALLOW_SIGNAL "%d %s\n", domain->domainname->name, sig, dest_pattern);
138          if (CheckCCSAccept(CCS_TOMOYO_MAC_FOR_SIGNAL)) AddSignalEntry(sig, dest_pattern, domain, 1, NULL);          if (CheckCCSAccept(CCS_TOMOYO_MAC_FOR_SIGNAL, domain)) AddSignalEntry(sig, dest_pattern, domain, NULL, 0);
139          return 0;          return 0;
140  }  }
141  EXPORT_SYMBOL(CheckSignalACL);  EXPORT_SYMBOL(CheckSignalACL);
142    
143  int AddSignalPolicy(char *data, struct domain_info *domain, const int is_delete)  int AddSignalPolicy(char *data, struct domain_info *domain, const struct condition_list *condition, const u8 is_delete)
144  {  {
145          int sig;          int sig;
146          char *domainname = strchr(data, ' ');          char *domainname = strchr(data, ' ');
147          if (sscanf(data, "%d", &sig) == 1 && domainname && IsDomainDef(domainname + 1)) {          if (sscanf(data, "%d", &sig) == 1 && domainname && IsDomainDef(domainname + 1)) {
148                  const struct condition_list *condition = NULL;                  return AddSignalEntry(sig, domainname + 1, domain, condition, is_delete);
                 const char *cp = FindConditionPart(domainname + 1);  
                 if (cp && (condition = FindOrAssignNewCondition(cp)) == NULL) return -EINVAL;  
                 return AddSignalEntry(sig, domainname + 1, domain, is_delete ? 0 : -1, condition);  
149          }          }
150          return -EINVAL;          return -EINVAL;
151  }  }
Legend:
Removed from v.224  
changed lines
  Added in v.590
Back to OSDN">Back to OSDN
 ViewVC Help
Powered by ViewVC 1.1.26  
サイト情報
ソフトウェアを探す
ソフトウェアを作る
コミュニティ
ヘルプ