オープンソース・ソフトウェアの開発とダウンロード

TOMOYO

Subversion リポジトリの参照

/[tomoyo]/trunk/1.7.x/ccs-patch/security/ccsecurity/domain.c

Diff of /trunk/1.7.x/ccs-patch/security/ccsecurity/domain.c

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 183 by kumaneko, Wed Apr 18 05:36:07 2007 UTC revision 214 by kumaneko, Wed May 16 10:04:31 2007 UTC
# Line 40  DECLARE_MUTEX(domain_acl_lock); Line 40  DECLARE_MUTEX(domain_acl_lock);
40    
41  /***** The structure for program files to force domain reconstruction. *****/  /***** The structure for program files to force domain reconstruction. *****/
42    
43  typedef struct domain_initializer_entry {  struct domain_initializer_entry {
44          struct domain_initializer_entry *next;          struct domain_initializer_entry *next;
45          const struct path_info *domainname;    /* This may be NULL */          const struct path_info *domainname;    /* This may be NULL */
46          const struct path_info *program;          const struct path_info *program;
# Line 48  typedef struct domain_initializer_entry Line 48  typedef struct domain_initializer_entry
48          u8 is_not;          u8 is_not;
49          u8 is_last_name;          u8 is_last_name;
50          u8 is_oldstyle;          u8 is_oldstyle;
51  } DOMAIN_INITIALIZER_ENTRY;  };
52    
53  /***** The structure for domains to not to transit domains. *****/  /***** The structure for domains to not to transit domains. *****/
54    
55  typedef struct domain_keeper_entry {  struct domain_keeper_entry {
56          struct domain_keeper_entry *next;          struct domain_keeper_entry *next;
57          const struct path_info *domainname;          const struct path_info *domainname;
58          const struct path_info *program;       /* This may be NULL */          const struct path_info *program;       /* This may be NULL */
59          u8 is_deleted;          u8 is_deleted;
60          u8 is_not;          u8 is_not;
61          u8 is_last_name;          u8 is_last_name;
62  } DOMAIN_KEEPER_ENTRY;  };
63    
64  /***** The structure for program files that should be aggregated. *****/  /***** The structure for program files that should be aggregated. *****/
65    
66  typedef struct aggregator_entry {  struct aggregator_entry {
67          struct aggregator_entry *next;          struct aggregator_entry *next;
68          const struct path_info *original_name;          const struct path_info *original_name;
69          const struct path_info *aggregated_name;          const struct path_info *aggregated_name;
70          int is_deleted;          int is_deleted;
71  } AGGREGATOR_ENTRY;  };
72    
73  /***** The structure for program files that should be aliased. *****/  /***** The structure for program files that should be aliased. *****/
74    
75  typedef struct alias_entry {  struct alias_entry {
76          struct alias_entry *next;          struct alias_entry *next;
77          const struct path_info *original_name;          const struct path_info *original_name;
78          const struct path_info *aliased_name;          const struct path_info *aliased_name;
79          int is_deleted;          int is_deleted;
80  } ALIAS_ENTRY;  };
81    
82  /*************************  VARIABLES  *************************/  /*************************  VARIABLES  *************************/
83    
# Line 99  const char *GetLastName(const struct dom Line 99  const char *GetLastName(const struct dom
99          return cp0;          return cp0;
100  }  }
101    
102  int ReadSelfDomain(IO_BUFFER *head)  int ReadSelfDomain(struct io_buffer *head)
103  {  {
104          if (!head->read_eof) {          if (!head->read_eof) {
105                  io_printf(head, "%s", current->domain_info->domainname->name);                  io_printf(head, "%s", current->domain_info->domainname->name);
# Line 142  int TooManyDomainACL(struct domain_info Line 142  int TooManyDomainACL(struct domain_info
142    
143  /*************************  DOMAIN INITIALIZER HANDLER  *************************/  /*************************  DOMAIN INITIALIZER HANDLER  *************************/
144    
145  static DOMAIN_INITIALIZER_ENTRY *domain_initializer_list = NULL;  static struct domain_initializer_entry *domain_initializer_list = NULL;
146    
147  static int AddDomainInitializerEntry(const char *domainname, const char *program, const int is_not, const int is_delete, const int is_oldstyle)  static int AddDomainInitializerEntry(const char *domainname, const char *program, const int is_not, const int is_delete, const int is_oldstyle)
148  {  {
149          DOMAIN_INITIALIZER_ENTRY *new_entry, *ptr;          struct domain_initializer_entry *new_entry, *ptr;
150          static DECLARE_MUTEX(lock);          static DECLARE_MUTEX(lock);
151          const struct path_info *saved_program, *saved_domainname = NULL;          const struct path_info *saved_program, *saved_domainname = NULL;
152          int error = -ENOMEM;          int error = -ENOMEM;
# Line 173  static int AddDomainInitializerEntry(con Line 173  static int AddDomainInitializerEntry(con
173                  error = -ENOENT;                  error = -ENOENT;
174                  goto out;                  goto out;
175          }          }
176          if ((new_entry = (DOMAIN_INITIALIZER_ENTRY *) alloc_element(sizeof(DOMAIN_INITIALIZER_ENTRY))) == NULL) goto out;          if ((new_entry = alloc_element(sizeof(*new_entry))) == NULL) goto out;
177          new_entry->domainname = saved_domainname;          new_entry->domainname = saved_domainname;
178          new_entry->program = saved_program;          new_entry->program = saved_program;
179          new_entry->is_not = is_not;          new_entry->is_not = is_not;
# Line 191  static int AddDomainInitializerEntry(con Line 191  static int AddDomainInitializerEntry(con
191          return error;          return error;
192  }  }
193    
194  int ReadDomainInitializerPolicy(IO_BUFFER *head)  int ReadDomainInitializerPolicy(struct io_buffer *head)
195  {  {
196          DOMAIN_INITIALIZER_ENTRY *ptr = (DOMAIN_INITIALIZER_ENTRY *) head->read_var2;          struct domain_initializer_entry *ptr = head->read_var2;
197          if (!ptr) ptr = domain_initializer_list;          if (!ptr) ptr = domain_initializer_list;
198          while (ptr) {          while (ptr) {
199                  head->read_var2 = (void *) ptr;                  head->read_var2 = ptr;
200                  if (!ptr->is_deleted) {                  if (!ptr->is_deleted) {
201                          if (ptr->domainname) {                          if (ptr->domainname) {
202                                  if (io_printf(head, "%s%s%s from %s\n", ptr->is_not ? "no_" : "", ptr->is_oldstyle ? KEYWORD_INITIALIZER : KEYWORD_INITIALIZE_DOMAIN, ptr->program->name, ptr->domainname->name)) break;                                  if (io_printf(head, "%s%s%s from %s\n", ptr->is_not ? "no_" : "", ptr->is_oldstyle ? KEYWORD_INITIALIZER : KEYWORD_INITIALIZE_DOMAIN, ptr->program->name, ptr->domainname->name)) break;
# Line 222  int AddDomainInitializerPolicy(char *dat Line 222  int AddDomainInitializerPolicy(char *dat
222    
223  static int IsDomainInitializer(const struct path_info *domainname, const struct path_info *program, const struct path_info *last_name)  static int IsDomainInitializer(const struct path_info *domainname, const struct path_info *program, const struct path_info *last_name)
224  {  {
225          DOMAIN_INITIALIZER_ENTRY *ptr;          struct domain_initializer_entry *ptr;
226          int flag = 0;          int flag = 0;
227          for (ptr = domain_initializer_list; ptr; ptr = ptr->next) {          for (ptr = domain_initializer_list; ptr; ptr = ptr->next) {
228                  if (ptr->is_deleted ) continue;                  if (ptr->is_deleted ) continue;
# Line 242  static int IsDomainInitializer(const str Line 242  static int IsDomainInitializer(const str
242    
243  /*************************  DOMAIN KEEPER HANDLER  *************************/  /*************************  DOMAIN KEEPER HANDLER  *************************/
244    
245  static DOMAIN_KEEPER_ENTRY *domain_keeper_list = NULL;  static struct domain_keeper_entry *domain_keeper_list = NULL;
246    
247  static int AddDomainKeeperEntry(const char *domainname, const char *program, const int is_not, const int is_delete)  static int AddDomainKeeperEntry(const char *domainname, const char *program, const int is_not, const int is_delete)
248  {  {
249          DOMAIN_KEEPER_ENTRY *new_entry, *ptr;          struct domain_keeper_entry *new_entry, *ptr;
250          const struct path_info *saved_domainname, *saved_program = NULL;          const struct path_info *saved_domainname, *saved_program = NULL;
251          static DECLARE_MUTEX(lock);          static DECLARE_MUTEX(lock);
252          int error = -ENOMEM;          int error = -ENOMEM;
# Line 273  static int AddDomainKeeperEntry(const ch Line 273  static int AddDomainKeeperEntry(const ch
273                  error = -ENOENT;                  error = -ENOENT;
274                  goto out;                  goto out;
275          }          }
276          if ((new_entry = (DOMAIN_KEEPER_ENTRY *) alloc_element(sizeof(DOMAIN_KEEPER_ENTRY))) == NULL) goto out;          if ((new_entry = alloc_element(sizeof(*new_entry))) == NULL) goto out;
277          new_entry->domainname = saved_domainname;          new_entry->domainname = saved_domainname;
278          new_entry->program = saved_program;          new_entry->program = saved_program;
279          new_entry->is_not = is_not;          new_entry->is_not = is_not;
# Line 301  int AddDomainKeeperPolicy(char *data, co Line 301  int AddDomainKeeperPolicy(char *data, co
301          }          }
302  }  }
303    
304  int ReadDomainKeeperPolicy(IO_BUFFER *head)  int ReadDomainKeeperPolicy(struct io_buffer *head)
305  {  {
306          DOMAIN_KEEPER_ENTRY *ptr = (DOMAIN_KEEPER_ENTRY *) head->read_var2;          struct domain_keeper_entry *ptr = head->read_var2;
307          if (!ptr) ptr = domain_keeper_list;          if (!ptr) ptr = domain_keeper_list;
308          while (ptr) {          while (ptr) {
309                  head->read_var2 = (void *) ptr;                  head->read_var2 = ptr;
310                  if (!ptr->is_deleted) {                  if (!ptr->is_deleted) {
311                          if (ptr->program) {                          if (ptr->program) {
312                                  if (io_printf(head, "%s" KEYWORD_KEEP_DOMAIN "%s from %s\n", ptr->is_not ? "no_" : "", ptr->program->name, ptr->domainname->name)) break;                                  if (io_printf(head, "%s" KEYWORD_KEEP_DOMAIN "%s from %s\n", ptr->is_not ? "no_" : "", ptr->program->name, ptr->domainname->name)) break;
# Line 321  int ReadDomainKeeperPolicy(IO_BUFFER *he Line 321  int ReadDomainKeeperPolicy(IO_BUFFER *he
321    
322  static int IsDomainKeeper(const struct path_info *domainname, const struct path_info *program, const struct path_info *last_name)  static int IsDomainKeeper(const struct path_info *domainname, const struct path_info *program, const struct path_info *last_name)
323  {  {
324          DOMAIN_KEEPER_ENTRY *ptr;          struct domain_keeper_entry *ptr;
325          int flag = 0;          int flag = 0;
326          for (ptr = domain_keeper_list; ptr; ptr = ptr->next) {          for (ptr = domain_keeper_list; ptr; ptr = ptr->next) {
327                  if (ptr->is_deleted) continue;                  if (ptr->is_deleted) continue;
# Line 339  static int IsDomainKeeper(const struct p Line 339  static int IsDomainKeeper(const struct p
339    
340  /*************************  SYMBOLIC LINKED PROGRAM HANDLER  *************************/  /*************************  SYMBOLIC LINKED PROGRAM HANDLER  *************************/
341    
342  static ALIAS_ENTRY *alias_list = NULL;  static struct alias_entry *alias_list = NULL;
343    
344  static int AddAliasEntry(const char *original_name, const char *aliased_name, const int is_delete)  static int AddAliasEntry(const char *original_name, const char *aliased_name, const int is_delete)
345  {  {
346          ALIAS_ENTRY *new_entry, *ptr;          struct alias_entry *new_entry, *ptr;
347          static DECLARE_MUTEX(lock);          static DECLARE_MUTEX(lock);
348          const struct path_info *saved_original_name, *saved_aliased_name;          const struct path_info *saved_original_name, *saved_aliased_name;
349          int error = -ENOMEM;          int error = -ENOMEM;
# Line 361  static int AddAliasEntry(const char *ori Line 361  static int AddAliasEntry(const char *ori
361                  error = -ENOENT;                  error = -ENOENT;
362                  goto out;                  goto out;
363          }          }
364          if ((new_entry = (ALIAS_ENTRY *) alloc_element(sizeof(ALIAS_ENTRY))) == NULL) goto out;          if ((new_entry = alloc_element(sizeof(*new_entry))) == NULL) goto out;
365          new_entry->original_name = saved_original_name;          new_entry->original_name = saved_original_name;
366          new_entry->aliased_name = saved_aliased_name;          new_entry->aliased_name = saved_aliased_name;
367          mb(); /* Instead of using spinlock. */          mb(); /* Instead of using spinlock. */
# Line 376  static int AddAliasEntry(const char *ori Line 376  static int AddAliasEntry(const char *ori
376          return error;          return error;
377  }  }
378    
379  int ReadAliasPolicy(IO_BUFFER *head)  int ReadAliasPolicy(struct io_buffer *head)
380  {  {
381          ALIAS_ENTRY *ptr = (ALIAS_ENTRY *) head->read_var2;          struct alias_entry *ptr = head->read_var2;
382          if (!ptr) ptr = alias_list;          if (!ptr) ptr = alias_list;
383          while (ptr) {          while (ptr) {
384                  head->read_var2 = (void *) ptr;                  head->read_var2 = ptr;
385                  if (!ptr->is_deleted && io_printf(head, KEYWORD_ALIAS "%s %s\n", ptr->original_name->name, ptr->aliased_name->name)) break;                  if (!ptr->is_deleted && io_printf(head, KEYWORD_ALIAS "%s %s\n", ptr->original_name->name, ptr->aliased_name->name)) break;
386                  ptr = ptr->next;                  ptr = ptr->next;
387          }          }
# Line 398  int AddAliasPolicy(char *data, const int Line 398  int AddAliasPolicy(char *data, const int
398    
399  /*************************  DOMAIN AGGREGATOR HANDLER  *************************/  /*************************  DOMAIN AGGREGATOR HANDLER  *************************/
400    
401  static AGGREGATOR_ENTRY *aggregator_list = NULL;  static struct aggregator_entry *aggregator_list = NULL;
402    
403  static int AddAggregatorEntry(const char *original_name, const char *aggregated_name, const int is_delete)  static int AddAggregatorEntry(const char *original_name, const char *aggregated_name, const int is_delete)
404  {  {
405          AGGREGATOR_ENTRY *new_entry, *ptr;          struct aggregator_entry *new_entry, *ptr;
406          static DECLARE_MUTEX(lock);          static DECLARE_MUTEX(lock);
407          const struct path_info *saved_original_name, *saved_aggregated_name;          const struct path_info *saved_original_name, *saved_aggregated_name;
408          int error = -ENOMEM;          int error = -ENOMEM;
# Line 420  static int AddAggregatorEntry(const char Line 420  static int AddAggregatorEntry(const char
420                  error = -ENOENT;                  error = -ENOENT;
421                  goto out;                  goto out;
422          }          }
423          if ((new_entry = (AGGREGATOR_ENTRY *) alloc_element(sizeof(AGGREGATOR_ENTRY))) == NULL) goto out;          if ((new_entry = alloc_element(sizeof(*new_entry))) == NULL) goto out;
424          new_entry->original_name = saved_original_name;          new_entry->original_name = saved_original_name;
425          new_entry->aggregated_name = saved_aggregated_name;          new_entry->aggregated_name = saved_aggregated_name;
426          mb(); /* Instead of using spinlock. */          mb(); /* Instead of using spinlock. */
# Line 435  static int AddAggregatorEntry(const char Line 435  static int AddAggregatorEntry(const char
435          return error;          return error;
436  }  }
437    
438  int ReadAggregatorPolicy(IO_BUFFER *head)  int ReadAggregatorPolicy(struct io_buffer *head)
439  {  {
440          AGGREGATOR_ENTRY *ptr = (AGGREGATOR_ENTRY *) head->read_var2;          struct aggregator_entry *ptr = head->read_var2;
441          if (!ptr) ptr = aggregator_list;          if (!ptr) ptr = aggregator_list;
442          while (ptr) {          while (ptr) {
443                  head->read_var2 = (void *) ptr;                  head->read_var2 = ptr;
444                  if (!ptr->is_deleted && io_printf(head, KEYWORD_AGGREGATOR "%s %s\n", ptr->original_name->name, ptr->aggregated_name->name)) break;                  if (!ptr->is_deleted && io_printf(head, KEYWORD_AGGREGATOR "%s %s\n", ptr->original_name->name, ptr->aggregated_name->name)) break;
445                  ptr = ptr->next;                  ptr = ptr->next;
446          }          }
# Line 588  struct domain_info *FindOrAssignNewDomai Line 588  struct domain_info *FindOrAssignNewDomai
588                  goto out;                  goto out;
589          }          }
590          /* No memory reusable. Create using new memory. */          /* No memory reusable. Create using new memory. */
591          if ((domain = (struct domain_info *) alloc_element(sizeof(struct domain_info))) != NULL) {          if ((domain = alloc_element(sizeof(*domain))) != NULL) {
592                  struct domain_info *ptr = &KERNEL_DOMAIN;                  struct domain_info *ptr = &KERNEL_DOMAIN;
593                  domain->domainname = saved_domainname;                  domain->domainname = saved_domainname;
594                  domain->profile = profile;                  domain->profile = profile;
# Line 703  static int FindNextDomain(struct linux_b Line 703  static int FindNextDomain(struct linux_b
703    
704          /* Check 'alias' directive. */          /* Check 'alias' directive. */
705          if (pathcmp(&r, &s)) {          if (pathcmp(&r, &s)) {
706                  ALIAS_ENTRY *ptr;                  struct alias_entry *ptr;
707                  /* Is this program allowed to be called via symbolic links? */                  /* Is this program allowed to be called via symbolic links? */
708                  for (ptr = alias_list; ptr; ptr = ptr->next) {                  for (ptr = alias_list; ptr; ptr = ptr->next) {
709                          if (ptr->is_deleted || pathcmp(&r, ptr->original_name) || pathcmp(&s, ptr->aliased_name)) continue;                          if (ptr->is_deleted || pathcmp(&r, ptr->original_name) || pathcmp(&s, ptr->aliased_name)) continue;
# Line 736  static int FindNextDomain(struct linux_b Line 736  static int FindNextDomain(struct linux_b
736                    
737          /* Check 'aggregator' directive. */          /* Check 'aggregator' directive. */
738          {          {
739                  AGGREGATOR_ENTRY *ptr;                  struct aggregator_entry *ptr;
740                  /* Is this program allowed to be aggregated? */                  /* Is this program allowed to be aggregated? */
741                  for (ptr = aggregator_list; ptr; ptr = ptr->next) {                  for (ptr = aggregator_list; ptr; ptr = ptr->next) {
742                          if (ptr->is_deleted || !PathMatchesToPattern(&r, ptr->original_name)) continue;                          if (ptr->is_deleted || !PathMatchesToPattern(&r, ptr->original_name)) continue;
Legend:
Removed from v.183  
changed lines
  Added in v.214
Back to OSDN">Back to OSDN
 ViewVC Help
Powered by ViewVC 1.1.26  
サイト情報
ソフトウェアを探す
ソフトウェアを作る
コミュニティ
ヘルプ