security/tomoyo/gc.c

   1 /*
   2  * security/tomoyo/gc.c
   3  *
   4  * Implementation of the Domain-Based Mandatory Access Control.
   5  *
   6  * Copyright (C) 2005-2010  NTT DATA CORPORATION
   7  *
   8  */
   9
  10 #include "common.h"
  11 #include <linux/kthread.h>
  12 #include <linux/slab.h>
  13
  14 /* The list for "struct tomoyo_io_buffer". */
  15 static LIST_HEAD(tomoyo_io_buffer_list);
  16 /* Lock for protecting tomoyo_io_buffer_list. */
  17 static DEFINE_SPINLOCK(tomoyo_io_buffer_list_lock);
  18
  19 /* Size of an element. */
  20 static const u8 tomoyo_element_size[TOMOYO_MAX_POLICY] = {
  21         [TOMOYO_ID_GROUP] = sizeof(struct tomoyo_group),
  22         [TOMOYO_ID_PATH_GROUP] = sizeof(struct tomoyo_path_group),
  23         [TOMOYO_ID_NUMBER_GROUP] = sizeof(struct tomoyo_number_group),
  24         [TOMOYO_ID_AGGREGATOR] = sizeof(struct tomoyo_aggregator),
  25         [TOMOYO_ID_TRANSITION_CONTROL] =
  26         sizeof(struct tomoyo_transition_control),
  27         [TOMOYO_ID_MANAGER] = sizeof(struct tomoyo_manager),
  28         /* [TOMOYO_ID_CONDITION] = "struct tomoyo_condition"->size, */
  29         /* [TOMOYO_ID_NAME] = "struct tomoyo_name"->size, */
  30         /* [TOMOYO_ID_ACL] =
  31            tomoyo_acl_size["struct tomoyo_acl_info"->type], */
  32         [TOMOYO_ID_DOMAIN] = sizeof(struct tomoyo_domain_info),
  33 };
  34
  35 /* Size of a domain ACL element. */
  36 static const u8 tomoyo_acl_size[] = {
  37         [TOMOYO_TYPE_PATH_ACL] = sizeof(struct tomoyo_path_acl),
  38         [TOMOYO_TYPE_PATH2_ACL] = sizeof(struct tomoyo_path2_acl),
  39         [TOMOYO_TYPE_PATH_NUMBER_ACL] = sizeof(struct tomoyo_path_number_acl),
  40         [TOMOYO_TYPE_MKDEV_ACL] = sizeof(struct tomoyo_mkdev_acl),
  41         [TOMOYO_TYPE_MOUNT_ACL] = sizeof(struct tomoyo_mount_acl),
  42 };
  43
  44 /**
  45  * tomoyo_struct_used_by_io_buffer - Check whether the list element is used by /sys/kernel/security/tomoyo/ users or not.
  46  *
  47  * @element: Pointer to "struct list_head".
  48  *
  49  * Returns true if @element is used by /sys/kernel/security/tomoyo/ users,
  50  * false otherwise.
  51  */
  52 static bool tomoyo_struct_used_by_io_buffer(const struct list_head *element)
  53 {
  54         struct tomoyo_io_buffer *head;
  55         bool in_use = false;
  56
  57         spin_lock(&tomoyo_io_buffer_list_lock);
  58         list_for_each_entry(head, &tomoyo_io_buffer_list, list) {
  59                 head->users++;
  60                 spin_unlock(&tomoyo_io_buffer_list_lock);
  61                 if (mutex_lock_interruptible(&head->io_sem)) {
  62                         in_use = true;
  63                         goto out;
  64                 }
  65                 if (head->r.domain == element || head->r.group == element ||
  66                     head->r.acl == element || &head->w.domain->list == element)
  67                         in_use = true;
  68                 mutex_unlock(&head->io_sem);
  69 out:
  70                 spin_lock(&tomoyo_io_buffer_list_lock);
  71                 head->users--;
  72                 if (in_use)
  73                         break;
  74         }
  75         spin_unlock(&tomoyo_io_buffer_list_lock);
  76         return in_use;
  77 }
  78
  79 /**
  80  * tomoyo_name_used_by_io_buffer - Check whether the string is used by /sys/kernel/security/tomoyo/ users or not.
  81  *
  82  * @string: String to check.
  83  * @size:   Memory allocated for @string .
  84  *
  85  * Returns true if @string is used by /sys/kernel/security/tomoyo/ users,
  86  * false otherwise.
  87  */
  88 static bool tomoyo_name_used_by_io_buffer(const char *string,
  89                                           const size_t size)
  90 {
  91         struct tomoyo_io_buffer *head;
  92         bool in_use = false;
  93
  94         spin_lock(&tomoyo_io_buffer_list_lock);
  95         list_for_each_entry(head, &tomoyo_io_buffer_list, list) {
  96                 int i;
  97                 head->users++;
  98                 spin_unlock(&tomoyo_io_buffer_list_lock);
  99                 if (mutex_lock_interruptible(&head->io_sem)) {
 100                         in_use = true;
 101                         goto out;
 102                 }
 103                 for (i = 0; i < TOMOYO_MAX_IO_READ_QUEUE; i++) {
 104                         const char *w = head->r.w[i];
 105                         if (w < string || w > string + size)
 106                                 continue;
 107                         in_use = true;
 108                         break;
 109                 }
 110                 mutex_unlock(&head->io_sem);
 111 out:
 112                 spin_lock(&tomoyo_io_buffer_list_lock);
 113                 head->users--;
 114                 if (in_use)
 115                         break;
 116         }
 117         spin_unlock(&tomoyo_io_buffer_list_lock);
 118         return in_use;
 119 }
 120
 121 /* Structure for garbage collection. */
 122 struct tomoyo_gc {
 123         struct list_head list;
 124         enum tomoyo_policy_id type;
 125         size_t size;
 126         struct list_head *element;
 127 };
 128 /* List of entries to be deleted. */
 129 static LIST_HEAD(tomoyo_gc_list);
 130 /* Length of tomoyo_gc_list. */
 131 static int tomoyo_gc_list_len;
 132
 133 /**
 134  * tomoyo_add_to_gc - Add an entry to to be deleted list.
 135  *
 136  * @type:    One of values in "enum tomoyo_policy_id".
 137  * @element: Pointer to "struct list_head".
 138  *
 139  * Returns true on success, false otherwise.
 140  *
 141  * Caller holds tomoyo_policy_lock mutex.
 142  *
 143  * Adding an entry needs kmalloc(). Thus, if we try to add thousands of
 144  * entries at once, it will take too long time. Thus, do not add more than 128
 145  * entries per a scan. But to be able to handle worst case where all entries
 146  * are in-use, we accept one more entry per a scan.
 147  *
 148  * If we use singly linked list using "struct list_head"->prev (which is
 149  * LIST_POISON2), we can avoid kmalloc().
 150  */
 151 static bool tomoyo_add_to_gc(const int type, struct list_head *element)
 152 {
 153         struct tomoyo_gc *entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
 154         if (!entry)
 155                 return false;
 156         entry->type = type;
 157         if (type == TOMOYO_ID_ACL)
 158                 entry->size = tomoyo_acl_size[
 159                               container_of(element,
 160                                            typeof(struct tomoyo_acl_info),
 161                                            list)->type];
 162         else if (type == TOMOYO_ID_NAME)
 163                 entry->size = strlen(container_of(element,
 164                                                   typeof(struct tomoyo_name),
 165                                                   head.list)->entry.name) + 1;
 166         else if (type == TOMOYO_ID_CONDITION)
 167                 entry->size =
 168                         container_of(element, typeof(struct tomoyo_condition),
 169                                      head.list)->size;
 170         else
 171                 entry->size = tomoyo_element_size[type];
 172         entry->element = element;
 173         list_add(&entry->list, &tomoyo_gc_list);
 174         list_del_rcu(element);
 175         return tomoyo_gc_list_len++ < 128;
 176 }
 177
 178 /**
 179  * tomoyo_element_linked_by_gc - Validate next element of an entry.
 180  *
 181  * @element: Pointer to an element.
 182  * @size:    Size of @element in byte.
 183  *
 184  * Returns true if @element is linked by other elements in the garbage
 185  * collector's queue, false otherwise.
 186  */
 187 static bool tomoyo_element_linked_by_gc(const u8 *element, const size_t size)
 188 {
 189         struct tomoyo_gc *p;
 190         list_for_each_entry(p, &tomoyo_gc_list, list) {
 191                 const u8 *ptr = (const u8 *) p->element->next;
 192                 if (ptr < element || element + size < ptr)
 193                         continue;
 194                 return true;
 195         }
 196         return false;
 197 }
 198
 199 /**
 200  * tomoyo_del_transition_control - Delete members in "struct tomoyo_transition_control".
 201  *
 202  * @element: Pointer to "struct list_head".
 203  *
 204  * Returns nothing.
 205  */
 206 static void tomoyo_del_transition_control(struct list_head *element)
 207 {
 208         struct tomoyo_transition_control *ptr =
 209                 container_of(element, typeof(*ptr), head.list);
 210         tomoyo_put_name(ptr->domainname);
 211         tomoyo_put_name(ptr->program);
 212 }
 213
 214 /**
 215  * tomoyo_del_aggregator - Delete members in "struct tomoyo_aggregator".
 216  *
 217  * @element: Pointer to "struct list_head".
 218  *
 219  * Returns nothing.
 220  */
 221 static void tomoyo_del_aggregator(struct list_head *element)
 222 {
 223         struct tomoyo_aggregator *ptr =
 224                 container_of(element, typeof(*ptr), head.list);
 225         tomoyo_put_name(ptr->original_name);
 226         tomoyo_put_name(ptr->aggregated_name);
 227 }
 228
 229 /**
 230  * tomoyo_del_manager - Delete members in "struct tomoyo_manager".
 231  *
 232  * @element: Pointer to "struct list_head".
 233  *
 234  * Returns nothing.
 235  */
 236 static void tomoyo_del_manager(struct list_head *element)
 237 {
 238         struct tomoyo_manager *ptr =
 239                 container_of(element, typeof(*ptr), head.list);
 240         tomoyo_put_name(ptr->manager);
 241 }
 242
 243 /**
 244  * tomoyo_del_acl - Delete members in "struct tomoyo_acl_info".
 245  *
 246  * @element: Pointer to "struct list_head".
 247  *
 248  * Returns nothing.
 249  */
 250 static void tomoyo_del_acl(struct list_head *element)
 251 {
 252         struct tomoyo_acl_info *acl =
 253                 container_of(element, typeof(*acl), list);
 254         tomoyo_put_condition(acl->cond);
 255         switch (acl->type) {
 256         case TOMOYO_TYPE_PATH_ACL:
 257                 {
 258                         struct tomoyo_path_acl *entry
 259                                 = container_of(acl, typeof(*entry), head);
 260                         tomoyo_put_name_union(&entry->name);
 261                 }
 262                 break;
 263         case TOMOYO_TYPE_PATH2_ACL:
 264                 {
 265                         struct tomoyo_path2_acl *entry
 266                                 = container_of(acl, typeof(*entry), head);
 267                         tomoyo_put_name_union(&entry->name1);
 268                         tomoyo_put_name_union(&entry->name2);
 269                 }
 270                 break;
 271         case TOMOYO_TYPE_PATH_NUMBER_ACL:
 272                 {
 273                         struct tomoyo_path_number_acl *entry
 274                                 = container_of(acl, typeof(*entry), head);
 275                         tomoyo_put_name_union(&entry->name);
 276                         tomoyo_put_number_union(&entry->number);
 277                 }
 278                 break;
 279         case TOMOYO_TYPE_MKDEV_ACL:
 280                 {
 281                         struct tomoyo_mkdev_acl *entry
 282                                 = container_of(acl, typeof(*entry), head);
 283                         tomoyo_put_name_union(&entry->name);
 284                         tomoyo_put_number_union(&entry->mode);
 285                         tomoyo_put_number_union(&entry->major);
 286                         tomoyo_put_number_union(&entry->minor);
 287                 }
 288                 break;
 289         case TOMOYO_TYPE_MOUNT_ACL:
 290                 {
 291                         struct tomoyo_mount_acl *entry
 292                                 = container_of(acl, typeof(*entry), head);
 293                         tomoyo_put_name_union(&entry->dev_name);
 294                         tomoyo_put_name_union(&entry->dir_name);
 295                         tomoyo_put_name_union(&entry->fs_type);
 296                         tomoyo_put_number_union(&entry->flags);
 297                 }
 298                 break;
 299         }
 300 }
 301
 302 /**
 303  * tomoyo_del_domain - Delete members in "struct tomoyo_domain_info".
 304  *
 305  * @element: Pointer to "struct list_head".
 306  *
 307  * Returns true if deleted, false otherwise.
 308  */
 309 static bool tomoyo_del_domain(struct list_head *element)
 310 {
 311         struct tomoyo_domain_info *domain =
 312                 container_of(element, typeof(*domain), list);
 313         struct tomoyo_acl_info *acl;
 314         struct tomoyo_acl_info *tmp;
 315         /*
 316          * Since we don't protect whole execve() operation using SRCU,
 317          * we need to recheck domain->users at this point.
 318          *
 319          * (1) Reader starts SRCU section upon execve().
 320          * (2) Reader traverses tomoyo_domain_list and finds this domain.
 321          * (3) Writer marks this domain as deleted.
 322          * (4) Garbage collector removes this domain from tomoyo_domain_list
 323          *     because this domain is marked as deleted and used by nobody.
 324          * (5) Reader saves reference to this domain into
 325          *     "struct linux_binprm"->cred->security .
 326          * (6) Reader finishes SRCU section, although execve() operation has
 327          *     not finished yet.
 328          * (7) Garbage collector waits for SRCU synchronization.
 329          * (8) Garbage collector kfree() this domain because this domain is
 330          *     used by nobody.
 331          * (9) Reader finishes execve() operation and restores this domain from
 332          *     "struct linux_binprm"->cred->security.
 333          *
 334          * By updating domain->users at (5), we can solve this race problem
 335          * by rechecking domain->users at (8).
 336          */
 337         if (atomic_read(&domain->users))
 338                 return false;
 339         list_for_each_entry_safe(acl, tmp, &domain->acl_info_list, list) {
 340                 tomoyo_del_acl(&acl->list);
 341                 tomoyo_memory_free(acl);
 342         }
 343         tomoyo_put_name(domain->domainname);
 344         return true;
 345 }
 346
 347 /**
 348  * tomoyo_del_condition - Delete members in "struct tomoyo_condition".
 349  *
 350  * @element: Pointer to "struct list_head".
 351  *
 352  * Returns nothing.
 353  */
 354 void tomoyo_del_condition(struct list_head *element)
 355 {
 356         struct tomoyo_condition *cond = container_of(element, typeof(*cond),
 357                                                      head.list);
 358         const u16 condc = cond->condc;
 359         const u16 numbers_count = cond->numbers_count;
 360         const u16 names_count = cond->names_count;
 361         unsigned int i;
 362         const struct tomoyo_condition_element *condp
 363                 = (const struct tomoyo_condition_element *) (cond + 1);
 364         struct tomoyo_number_union *numbers_p
 365                 = (struct tomoyo_number_union *) (condp + condc);
 366         struct tomoyo_name_union *names_p
 367                 = (struct tomoyo_name_union *) (numbers_p + numbers_count);
 368         for (i = 0; i < numbers_count; i++)
 369                 tomoyo_put_number_union(numbers_p++);
 370         for (i = 0; i < names_count; i++)
 371                 tomoyo_put_name_union(names_p++);
 372 }
 373
 374 /**
 375  * tomoyo_del_name - Delete members in "struct tomoyo_name".
 376  *
 377  * @element: Pointer to "struct list_head".
 378  *
 379  * Returns nothing.
 380  */
 381 static void tomoyo_del_name(struct list_head *element)
 382 {
 383         const struct tomoyo_name *ptr =
 384                 container_of(element, typeof(*ptr), head.list);
 385 }
 386
 387 /**
 388  * tomoyo_del_path_group - Delete members in "struct tomoyo_path_group".
 389  *
 390  * @element: Pointer to "struct list_head".
 391  *
 392  * Returns nothing.
 393  */
 394 static void tomoyo_del_path_group(struct list_head *element)
 395 {
 396         struct tomoyo_path_group *member =
 397                 container_of(element, typeof(*member), head.list);
 398         tomoyo_put_name(member->member_name);
 399 }
 400
 401 /**
 402  * tomoyo_del_group - Delete "struct tomoyo_group".
 403  *
 404  * @element: Pointer to "struct list_head".
 405  *
 406  * Returns nothing.
 407  */
 408 static void tomoyo_del_group(struct list_head *element)
 409 {
 410         struct tomoyo_group *group =
 411                 container_of(element, typeof(*group), head.list);
 412         tomoyo_put_name(group->group_name);
 413 }
 414
 415 /**
 416  * tomoyo_del_number_group - Delete members in "struct tomoyo_number_group".
 417  *
 418  * @element: Pointer to "struct list_head".
 419  *
 420  * Returns nothing.
 421  */
 422 static void tomoyo_del_number_group(struct list_head *element)
 423 {
 424         struct tomoyo_number_group *member =
 425                 container_of(element, typeof(*member), head.list);
 426 }
 427
 428 /**
 429  * tomoyo_collect_member - Delete elements with "struct tomoyo_acl_head".
 430  *
 431  * @id:          One of values in "enum tomoyo_policy_id".
 432  * @member_list: Pointer to "struct list_head".
 433  *
 434  * Returns true if some elements are deleted, false otherwise.
 435  */
 436 static bool tomoyo_collect_member(const enum tomoyo_policy_id id,
 437                                   struct list_head *member_list)
 438 {
 439         struct tomoyo_acl_head *member;
 440         list_for_each_entry(member, member_list, list) {
 441                 if (!member->is_deleted)
 442                         continue;
 443                 if (!tomoyo_add_to_gc(id, &member->list))
 444                         return false;
 445         }
 446         return true;
 447 }
 448
 449 /**
 450  * tomoyo_collect_acl - Delete elements in "struct tomoyo_domain_info".
 451  *
 452  * @list: Pointer to "struct list_head".
 453  *
 454  * Returns true if some elements are deleted, false otherwise.
 455  */
 456 static bool tomoyo_collect_acl(struct list_head *list)
 457 {
 458         struct tomoyo_acl_info *acl;
 459         list_for_each_entry(acl, list, list) {
 460                 if (!acl->is_deleted)
 461                         continue;
 462                 if (!tomoyo_add_to_gc(TOMOYO_ID_ACL, &acl->list))
 463                         return false;
 464         }
 465         return true;
 466 }
 467
 468 /**
 469  * tomoyo_collect_entry - Scan lists for deleted elements.
 470  *
 471  * Returns nothing.
 472  */
 473 static void tomoyo_collect_entry(void)
 474 {
 475         int i;
 476         enum tomoyo_policy_id id;
 477         struct tomoyo_policy_namespace *ns;
 478         int idx;
 479         if (mutex_lock_interruptible(&tomoyo_policy_lock))
 480                 return;
 481         idx = tomoyo_read_lock();
 482         {
 483                 struct tomoyo_domain_info *domain;
 484                 list_for_each_entry_rcu(domain, &tomoyo_domain_list, list) {
 485                         if (!tomoyo_collect_acl(&domain->acl_info_list))
 486                                 goto unlock;
 487                         if (!domain->is_deleted || atomic_read(&domain->users))
 488                                 continue;
 489                         /*
 490                          * Nobody is referring this domain. But somebody may
 491                          * refer this domain after successful execve().
 492                          * We recheck domain->users after SRCU synchronization.
 493                          */
 494                         if (!tomoyo_add_to_gc(TOMOYO_ID_DOMAIN, &domain->list))
 495                                 goto unlock;
 496                 }
 497         }
 498         list_for_each_entry_rcu(ns, &tomoyo_namespace_list, namespace_list) {
 499                 for (id = 0; id < TOMOYO_MAX_POLICY; id++)
 500                         if (!tomoyo_collect_member(id, &ns->policy_list[id]))
 501                                 goto unlock;
 502                 for (i = 0; i < TOMOYO_MAX_ACL_GROUPS; i++)
 503                         if (!tomoyo_collect_acl(&ns->acl_group[i]))
 504                                 goto unlock;
 505                 for (i = 0; i < TOMOYO_MAX_GROUP; i++) {
 506                         struct list_head *list = &ns->group_list[i];
 507                         struct tomoyo_group *group;
 508                         switch (i) {
 509                         case 0:
 510                                 id = TOMOYO_ID_PATH_GROUP;
 511                                 break;
 512                         default:
 513                                 id = TOMOYO_ID_NUMBER_GROUP;
 514                                 break;
 515                         }
 516                         list_for_each_entry(group, list, head.list) {
 517                                 if (!tomoyo_collect_member
 518                                     (id, &group->member_list))
 519                                         goto unlock;
 520                                 if (!list_empty(&group->member_list) ||
 521                                     atomic_read(&group->head.users))
 522                                         continue;
 523                                 if (!tomoyo_add_to_gc(TOMOYO_ID_GROUP,
 524                                                       &group->head.list))
 525                                         goto unlock;
 526                         }
 527                 }
 528         }
 529         id = TOMOYO_ID_CONDITION;
 530         for (i = 0; i < TOMOYO_MAX_HASH + 1; i++) {
 531                 struct list_head *list = !i ?
 532                         &tomoyo_condition_list : &tomoyo_name_list[i - 1];
 533                 struct tomoyo_shared_acl_head *ptr;
 534                 list_for_each_entry(ptr, list, list) {
 535                         if (atomic_read(&ptr->users))
 536                                 continue;
 537                         if (!tomoyo_add_to_gc(id, &ptr->list))
 538                                 goto unlock;
 539                 }
 540                 id = TOMOYO_ID_NAME;
 541         }
 542 unlock:
 543         tomoyo_read_unlock(idx);
 544         mutex_unlock(&tomoyo_policy_lock);
 545 }
 546
 547 /**
 548  * tomoyo_kfree_entry - Delete entries in tomoyo_gc_list.
 549  *
 550  * Returns true if some entries were kfree()d, false otherwise.
 551  */
 552 static bool tomoyo_kfree_entry(void)
 553 {
 554         struct tomoyo_gc *p;
 555         struct tomoyo_gc *tmp;
 556         bool result = false;
 557
 558         list_for_each_entry_safe(p, tmp, &tomoyo_gc_list, list) {
 559                 struct list_head *element = p->element;
 560
 561                 /*
 562                  * list_del_rcu() in tomoyo_add_to_gc() guarantees that the
 563                  * list element became no longer reachable from the list which
 564                  * the element was originally on (e.g. tomoyo_domain_list).
 565                  * Also, synchronize_srcu() in tomoyo_gc_thread() guarantees
 566                  * that the list element became no longer referenced by syscall
 567                  * users.
 568                  *
 569                  * However, there are three users which may still be using the
 570                  * list element. We need to defer until all of these users
 571                  * forget the list element.
 572                  *
 573                  * Firstly, defer until "struct tomoyo_io_buffer"->r.{domain,
 574                  * group,acl} and "struct tomoyo_io_buffer"->w.domain forget
 575                  * the list element.
 576                  */
 577                 if (tomoyo_struct_used_by_io_buffer(element))
 578                         continue;
 579                 /*
 580                  * Secondly, defer until all other elements in the
 581                  * tomoyo_gc_list list forget the list element.
 582                  */
 583                 if (tomoyo_element_linked_by_gc((const u8 *) element, p->size))
 584                         continue;
 585                 switch (p->type) {
 586                 case TOMOYO_ID_TRANSITION_CONTROL:
 587                         tomoyo_del_transition_control(element);
 588                         break;
 589                 case TOMOYO_ID_AGGREGATOR:
 590                         tomoyo_del_aggregator(element);
 591                         break;
 592                 case TOMOYO_ID_MANAGER:
 593                         tomoyo_del_manager(element);
 594                         break;
 595                 case TOMOYO_ID_CONDITION:
 596                         tomoyo_del_condition(element);
 597                         break;
 598                 case TOMOYO_ID_NAME:
 599                         /*
 600                          * Thirdly, defer until all "struct tomoyo_io_buffer"
 601                          * ->r.w[] forget the list element.
 602                          */
 603                         if (tomoyo_name_used_by_io_buffer(
 604                             container_of(element, typeof(struct tomoyo_name),
 605                                          head.list)->entry.name, p->size))
 606                                 continue;
 607                         tomoyo_del_name(element);
 608                         break;
 609                 case TOMOYO_ID_ACL:
 610                         tomoyo_del_acl(element);
 611                         break;
 612                 case TOMOYO_ID_DOMAIN:
 613                         if (!tomoyo_del_domain(element))
 614                                 continue;
 615                         break;
 616                 case TOMOYO_ID_PATH_GROUP:
 617                         tomoyo_del_path_group(element);
 618                         break;
 619                 case TOMOYO_ID_GROUP:
 620                         tomoyo_del_group(element);
 621                         break;
 622                 case TOMOYO_ID_NUMBER_GROUP:
 623                         tomoyo_del_number_group(element);
 624                         break;
 625                 case TOMOYO_MAX_POLICY:
 626                         break;
 627                 }
 628                 tomoyo_memory_free(element);
 629                 list_del(&p->list);
 630                 kfree(p);
 631                 tomoyo_gc_list_len--;
 632                 result = true;
 633         }
 634         return result;
 635 }
 636
 637 /**
 638  * tomoyo_gc_thread - Garbage collector thread function.
 639  *
 640  * @unused: Unused.
 641  *
 642  * In case OOM-killer choose this thread for termination, we create this thread
 643  * as a short live thread whenever /sys/kernel/security/tomoyo/ interface was
 644  * close()d.
 645  *
 646  * Returns 0.
 647  */
 648 static int tomoyo_gc_thread(void *unused)
 649 {
 650         /* Garbage collector thread is exclusive. */
 651         static DEFINE_MUTEX(tomoyo_gc_mutex);
 652         if (!mutex_trylock(&tomoyo_gc_mutex))
 653                 goto out;
 654         daemonize("GC for TOMOYO");
 655         do {
 656                 tomoyo_collect_entry();
 657                 if (list_empty(&tomoyo_gc_list))
 658                         break;
 659                 synchronize_srcu(&tomoyo_ss);
 660         } while (tomoyo_kfree_entry());
 661         {
 662                 struct tomoyo_io_buffer *head;
 663                 struct tomoyo_io_buffer *tmp;
 664
 665                 spin_lock(&tomoyo_io_buffer_list_lock);
 666                 list_for_each_entry_safe(head, tmp, &tomoyo_io_buffer_list,
 667                                          list) {
 668                         if (head->users)
 669                                 continue;
 670                         list_del(&head->list);
 671                         kfree(head->read_buf);
 672                         kfree(head->write_buf);
 673                         kfree(head);
 674                 }
 675                 spin_unlock(&tomoyo_io_buffer_list_lock);
 676         }
 677         mutex_unlock(&tomoyo_gc_mutex);
 678 out:
 679         /* This acts as do_exit(0). */
 680         return 0;
 681 }
 682
 683 /**
 684  * tomoyo_notify_gc - Register/unregister /sys/kernel/security/tomoyo/ users.
 685  *
 686  * @head:        Pointer to "struct tomoyo_io_buffer".
 687  * @is_register: True if register, false if unregister.
 688  *
 689  * Returns nothing.
 690  */
 691 void tomoyo_notify_gc(struct tomoyo_io_buffer *head, const bool is_register)
 692 {
 693         bool is_write = false;
 694
 695         spin_lock(&tomoyo_io_buffer_list_lock);
 696         if (is_register) {
 697                 head->users = 1;
 698                 list_add(&head->list, &tomoyo_io_buffer_list);
 699         } else {
 700                 is_write = head->write_buf != NULL;
 701                 if (!--head->users) {
 702                         list_del(&head->list);
 703                         kfree(head->read_buf);
 704                         kfree(head->write_buf);
 705                         kfree(head);
 706                 }
 707         }
 708         spin_unlock(&tomoyo_io_buffer_list_lock);
 709         if (is_write) {
 710                 struct task_struct *task = kthread_create(tomoyo_gc_thread,
 711                                                           NULL,
 712                                                           "GC for TOMOYO");
 713                 if (!IS_ERR(task))
 714                         wake_up_process(task);
 715         }
 716 }