Diff of /trunk/1.7.x/ccs-patch/security/ccsecurity/domain.c

TOMOYO

 Subversion リポジトリの参照



/[tomoyo]/trunk/1.7.x/ccs-patch/security/ccsecurity/domain.c




Diff of /trunk/1.7.x/ccs-patch/security/ccsecurity/domain.c



 Parent Directory

|  Revision Log



|  Patch














revision 2049 by kumaneko,
Thu Jan  8 07:36:34 2009 UTC




revision 2075 by kumaneko,
Mon Jan 26 05:08:14 2009 UTC






#

Line 941 
 static bool ccs_get_argv0(struct ccs_exe


Line 941 
 static bool ccs_get_argv0(struct ccs_exe












941
 /**
 /**

















942
  * ccs_find_next_domain - Find a domain.
  * ccs_find_next_domain - Find a domain.

















943
  *
  *















944


  * @ee:      Pointer to "struct ccs_request_info".


  * @ee: Pointer to "struct ccs_execve_entry".















945
  *
  *

















946
  * Returns 0 on success, negative value otherwise.
  * Returns 0 on success, negative value otherwise.

















947
  */
  */











#

Line 952 
 static int ccs_find_next_domain(struct c


Line 952 
 static int ccs_find_next_domain(struct c












952
         struct domain_info *domain = NULL;
         struct domain_info *domain = NULL;

















953
         const char *old_domain_name = r->domain->domainname->name;
         const char *old_domain_name = r->domain->domainname->name;

















954
         struct linux_binprm *bprm = ee->bprm;
         struct linux_binprm *bprm = ee->bprm;














         const char *original_name = bprm->filename;
 













955
         const u8 mode = r->mode;
         const u8 mode = r->mode;

















956
         const bool is_enforce = (mode == 3);
         const bool is_enforce = (mode == 3);

















957
         const u32 tomoyo_flags = current->tomoyo_flags;
         const u32 tomoyo_flags = current->tomoyo_flags;











#

Line 982 
 static int ccs_find_next_domain(struct c


Line 981 
 static int ccs_find_next_domain(struct c












981
  retry:
  retry:

















982
         current->tomoyo_flags = tomoyo_flags;
         current->tomoyo_flags = tomoyo_flags;

















983
         r->cond = NULL;
         r->cond = NULL;















984


         /* Get ccs_realpath of program and symbolic link. */


         /* Get realpath of program and symbolic link. */













985


         retval = -ENOENT; /* I hope ccs_realpath() won't fail with -ENOMEM. */


         retval = ccs_realpath_both(bprm->filename, ee);













986


         if (!ccs_realpath_both(original_name, ee))


         if (retval < 0)















987
                 goto out;
                 goto out;

















988
 
 

















989
         rn.name = ee->program_path;
         rn.name = ee->program_path;











#

Line 1207 
 static int ccs_check_environ(struct ccs_


Line 1206 
 static int ccs_check_environ(struct ccs_












1206
 /**
 /**

















1207
  * ccs_unescape - Unescape escaped string.
  * ccs_unescape - Unescape escaped string.

















1208
  *
  *















1209


  * @dest: String to ccs_unescape.


  * @dest: String to unescape.















1210
  *
  *

















1211
  * Returns nothing.
  * Returns nothing.

















1212
  */
  */











#

Line 1387 
 static void ccs_free_execve_entry(struct


Line 1386 
 static void ccs_free_execve_entry(struct












1386
 /**
 /**

















1387
  * ccs_try_alt_exec - Try to start execute handler.
  * ccs_try_alt_exec - Try to start execute handler.

















1388
  *
  *















1389


  * @ee:          Pointer to "struct ccs_execve_entry".


  * @ee: Pointer to "struct ccs_execve_entry".















1390
  *
  *

















1391
  * Returns 0 on success, negative value otherwise.
  * Returns 0 on success, negative value otherwise.

















1392
  */
  */











#

Line 1470 
 static int ccs_try_alt_exec(struct ccs_e


Line 1469 
 static int ccs_try_alt_exec(struct ccs_e












1469
 
 

















1470
         /* Set argv[4] */
         /* Set argv[4] */

















1471
         {
         {















1472


                 retval = copy_strings_kernel(1, (char **) &bprm->filename,


                 retval = copy_strings_kernel(1, &bprm->filename, bprm);
















                                              bprm);


 















1473
                 if (retval < 0)
                 if (retval < 0)

















1474
                         goto out;
                         goto out;

















1475
                 bprm->argc++;
                 bprm->argc++;











#

Line 1566 
 static int ccs_try_alt_exec(struct ccs_e


Line 1564 
 static int ccs_try_alt_exec(struct ccs_e












1564
         retval = prepare_binprm(bprm);
         retval = prepare_binprm(bprm);

















1565
         if (retval < 0)
         if (retval < 0)

















1566
                 goto out;
                 goto out;















1567


         /*


         {













1568


          * Backup ee->propgram_path for ccs_find_next_domain().


                 /* Backup ee->program_path for ccs_find_next_domain(). */













1569


          * ee->program_path will be overwritten by ccs_find_next_domain().


                 const int len = strlen(ee->program_path) + 1;













1570


          * But ee->tmp won't be overwritten by ccs_find_next_domain()


                 char *cp = kmalloc(len, GFP_KERNEL);













1571


          * because ee->handler != NULL.


                 if (!cp) {













1572


          */


                         retval = -ENOMEM;













1573


         strncpy(ee->tmp, ee->program_path, CCS_EXEC_TMPSIZE - 1);


                         goto out;













1574


         task->tomoyo_flags |= CCS_DONT_SLEEP_ON_ENFORCE_ERROR;


                 }













1575


         retval = ccs_find_next_domain(ee);


                 memmove(cp, ee->program_path, len);













1576


         task->tomoyo_flags &= ~CCS_DONT_SLEEP_ON_ENFORCE_ERROR;


                 task->tomoyo_flags |= CCS_DONT_SLEEP_ON_ENFORCE_ERROR;













1577


         /*


                 retval = ccs_find_next_domain(ee);













1578


          * Restore ee->program_path for search_binary_handler().


                 task->tomoyo_flags &= ~CCS_DONT_SLEEP_ON_ENFORCE_ERROR;













1579


          */


                 /* Restore ee->program_path for search_binary_handler(). */













1580


         strncpy(ee->program_path, ee->tmp, CCS_MAX_PATHNAME_LEN - 1);


                 memmove(ee->program_path, cp, len);













1581


 


                 kfree(cp);













1582


 


         }















1583
  out:
  out:

















1584
         return retval;
         return retval;

















1585
 }
 }











#

Line 1590 
 static int ccs_try_alt_exec(struct ccs_e


Line 1590 
 static int ccs_try_alt_exec(struct ccs_e












1590
  * @ee:   Pointer to "struct ccs_execve_entry".
  * @ee:   Pointer to "struct ccs_execve_entry".

















1591
  * @type: Type of execute handler.
  * @type: Type of execute handler.

















1592
  *
  *















1593


  * Returns bool if found, false otherwise.


  * Returns true if found, false otherwise.















1594
  */
  */

















1595
 static bool ccs_find_execute_handler(struct ccs_execve_entry *ee,
 static bool ccs_find_execute_handler(struct ccs_execve_entry *ee,

















1596
                                      const u8 type)
                                      const u8 type)





























Legend:



Removed from v.2049
 


changed lines


 
Added in v.2075













Back to OSDN">Back to OSDN
ViewVC Help


Powered by ViewVC 1.1.26
 /[tomoyo]/trunk/1.7.x/ccs-patch/security/ccsecurity/domain.c
-revision 2049 by kumaneko,
Thu Jan  8 07:36:34 2009 UTC
+revision 2075 by kumaneko,
Mon Jan 26 05:08:14 2009 UTC
 Line 941 
 static bool ccs_get_argv0(struct ccs_exe
  /**
   * ccs_find_next_domain - Find a domain.
   *
-  * @ee:      Pointer to "struct ccs_request_info".
+  * @ee: Pointer to "struct ccs_execve_entry".
   *
   * Returns 0 on success, negative value otherwise.
   */
 Line 952 
 static int ccs_find_next_domain(struct c
          struct domain_info *domain = NULL;
          const char *old_domain_name = r->domain->domainname->name;
          struct linux_binprm *bprm = ee->bprm;
-         const char *original_name = bprm->filename;
          const u8 mode = r->mode;
          const bool is_enforce = (mode == 3);
          const u32 tomoyo_flags = current->tomoyo_flags;
-Line 982 
 static int ccs_find_next_domain(struct c
+Line 981 
 static int ccs_find_next_domain(struct c
   retry:
          current->tomoyo_flags = tomoyo_flags;
          r->cond = NULL;
-         /* Get ccs_realpath of program and symbolic link. */
+         /* Get realpath of program and symbolic link. */
-         retval = -ENOENT; /* I hope ccs_realpath() won't fail with -ENOMEM. */
+         retval = ccs_realpath_both(bprm->filename, ee);
-         if (!ccs_realpath_both(original_name, ee))
+         if (retval < 0)
                  goto out;
          rn.name = ee->program_path;
-Line 1207 
 static int ccs_check_environ(struct ccs_
+Line 1206 
 static int ccs_check_environ(struct ccs_
  /**
   * ccs_unescape - Unescape escaped string.
   *
-  * @dest: String to ccs_unescape.
+  * @dest: String to unescape.
   *
   * Returns nothing.
   */
-Line 1387 
 static void ccs_free_execve_entry(struct
+Line 1386 
 static void ccs_free_execve_entry(struct
  /**
   * ccs_try_alt_exec - Try to start execute handler.
   *
-  * @ee:          Pointer to "struct ccs_execve_entry".
+  * @ee: Pointer to "struct ccs_execve_entry".
   *
   * Returns 0 on success, negative value otherwise.
   */
-Line 1470 
 static int ccs_try_alt_exec(struct ccs_e
+Line 1469 
 static int ccs_try_alt_exec(struct ccs_e
          /* Set argv[4] */
          {
-                 retval = copy_strings_kernel(1, (char **) &bprm->filename,
+                 retval = copy_strings_kernel(1, &bprm->filename, bprm);
-                                              bprm);
                  if (retval < 0)
                          goto out;
                  bprm->argc++;
-Line 1566 
 static int ccs_try_alt_exec(struct ccs_e
+Line 1564 
 static int ccs_try_alt_exec(struct ccs_e
          retval = prepare_binprm(bprm);
          if (retval < 0)
                  goto out;
-         /*
+         {
-          * Backup ee->propgram_path for ccs_find_next_domain().
+                 /* Backup ee->program_path for ccs_find_next_domain(). */
-          * ee->program_path will be overwritten by ccs_find_next_domain().
+                 const int len = strlen(ee->program_path) + 1;
-          * But ee->tmp won't be overwritten by ccs_find_next_domain()
+                 char *cp = kmalloc(len, GFP_KERNEL);
-          * because ee->handler != NULL.
+                 if (!cp) {
-          */
+                         retval = -ENOMEM;
-         strncpy(ee->tmp, ee->program_path, CCS_EXEC_TMPSIZE - 1);
+                         goto out;
-         task->tomoyo_flags |= CCS_DONT_SLEEP_ON_ENFORCE_ERROR;
+                 }
-         retval = ccs_find_next_domain(ee);
+                 memmove(cp, ee->program_path, len);
-         task->tomoyo_flags &= ~CCS_DONT_SLEEP_ON_ENFORCE_ERROR;
+                 task->tomoyo_flags |= CCS_DONT_SLEEP_ON_ENFORCE_ERROR;
-         /*
+                 retval = ccs_find_next_domain(ee);
-          * Restore ee->program_path for search_binary_handler().
+                 task->tomoyo_flags &= ~CCS_DONT_SLEEP_ON_ENFORCE_ERROR;
-          */
+                 /* Restore ee->program_path for search_binary_handler(). */
-         strncpy(ee->program_path, ee->tmp, CCS_MAX_PATHNAME_LEN - 1);
+                 memmove(ee->program_path, cp, len);
+                 kfree(cp);
+         }
   out:
          return retval;
  }
 Line 1590 
 static int ccs_try_alt_exec(struct ccs_e
   * @ee:   Pointer to "struct ccs_execve_entry".
   * @type: Type of execute handler.
   *
-  * Returns bool if found, false otherwise.
+  * Returns true if found, false otherwise.
   */
  static bool ccs_find_execute_handler(struct ccs_execve_entry *ee,
                                       const u8 type)
 Legend:



Removed from v.2049
 


changed lines


 
Added in v.2075
 Legend:



Removed from v.2049
 


changed lines


 
Added in v.2075
-Removed from v.2049
+Added in v.2075
-Back to OSDN">Back to OSDN
+ViewVC Help
 Powered by ViewVC 1.1.26

オープンソース・ソフトウェアの開発とダウンロード

TOMOYO

Subversion リポジトリの参照