security/tomoyo/gc.c

   1 /*
   2  * security/tomoyo/gc.c
   3  *
   4  * Implementation of the Domain-Based Mandatory Access Control.
   5  *
   6  * Copyright (C) 2005-2010  NTT DATA CORPORATION
   7  *
   8  */
   9
  10 #include "common.h"
  11 #include <linux/kthread.h>
  12 #include <linux/slab.h>
  13
  14 enum tomoyo_gc_id {
  15         TOMOYO_ID_PATH_GROUP,
  16         TOMOYO_ID_PATH_GROUP_MEMBER,
  17         TOMOYO_ID_NUMBER_GROUP,
  18         TOMOYO_ID_NUMBER_GROUP_MEMBER,
  19         TOMOYO_ID_DOMAIN_INITIALIZER,
  20         TOMOYO_ID_DOMAIN_KEEPER,
  21         TOMOYO_ID_AGGREGATOR,
  22         TOMOYO_ID_ALIAS,
  23         TOMOYO_ID_GLOBALLY_READABLE,
  24         TOMOYO_ID_PATTERN,
  25         TOMOYO_ID_NO_REWRITE,
  26         TOMOYO_ID_MANAGER,
  27         TOMOYO_ID_NAME,
  28         TOMOYO_ID_ACL,
  29         TOMOYO_ID_DOMAIN
  30 };
  31
  32 struct tomoyo_gc_entry {
  33         struct list_head list;
  34         int type;
  35         void *element;
  36 };
  37 static LIST_HEAD(tomoyo_gc_queue);
  38 static DEFINE_MUTEX(tomoyo_gc_mutex);
  39
  40 /* Caller holds tomoyo_policy_lock mutex. */
  41 static bool tomoyo_add_to_gc(const int type, void *element)
  42 {
  43         struct tomoyo_gc_entry *entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
  44         if (!entry)
  45                 return false;
  46         entry->type = type;
  47         entry->element = element;
  48         list_add(&entry->list, &tomoyo_gc_queue);
  49         return true;
  50 }
  51
  52 static void tomoyo_del_allow_read
  53 (struct tomoyo_globally_readable_file_entry *ptr)
  54 {
  55         tomoyo_put_name(ptr->filename);
  56 }
  57
  58 static void tomoyo_del_file_pattern(struct tomoyo_pattern_entry *ptr)
  59 {
  60         tomoyo_put_name(ptr->pattern);
  61 }
  62
  63 static void tomoyo_del_no_rewrite(struct tomoyo_no_rewrite_entry *ptr)
  64 {
  65         tomoyo_put_name(ptr->pattern);
  66 }
  67
  68 static void tomoyo_del_domain_initializer
  69 (struct tomoyo_domain_initializer_entry *ptr)
  70 {
  71         tomoyo_put_name(ptr->domainname);
  72         tomoyo_put_name(ptr->program);
  73 }
  74
  75 static void tomoyo_del_domain_keeper(struct tomoyo_domain_keeper_entry *ptr)
  76 {
  77         tomoyo_put_name(ptr->domainname);
  78         tomoyo_put_name(ptr->program);
  79 }
  80
  81 static void tomoyo_del_aggregator(struct tomoyo_aggregator_entry *ptr)
  82 {
  83         tomoyo_put_name(ptr->original_name);
  84         tomoyo_put_name(ptr->aggregated_name);
  85 }
  86
  87 static void tomoyo_del_alias(struct tomoyo_alias_entry *ptr)
  88 {
  89         tomoyo_put_name(ptr->original_name);
  90         tomoyo_put_name(ptr->aliased_name);
  91 }
  92
  93 static void tomoyo_del_manager(struct tomoyo_policy_manager_entry *ptr)
  94 {
  95         tomoyo_put_name(ptr->manager);
  96 }
  97
  98 static void tomoyo_del_acl(struct tomoyo_acl_info *acl)
  99 {
 100         switch (acl->type) {
 101         case TOMOYO_TYPE_PATH_ACL:
 102                 {
 103                         struct tomoyo_path_acl *entry
 104                                 = container_of(acl, typeof(*entry), head);
 105                         tomoyo_put_name_union(&entry->name);
 106                 }
 107                 break;
 108         case TOMOYO_TYPE_PATH2_ACL:
 109                 {
 110                         struct tomoyo_path2_acl *entry
 111                                 = container_of(acl, typeof(*entry), head);
 112                         tomoyo_put_name_union(&entry->name1);
 113                         tomoyo_put_name_union(&entry->name2);
 114                 }
 115                 break;
 116         case TOMOYO_TYPE_PATH_NUMBER_ACL:
 117                 {
 118                         struct tomoyo_path_number_acl *entry
 119                                 = container_of(acl, typeof(*entry), head);
 120                         tomoyo_put_name_union(&entry->name);
 121                         tomoyo_put_number_union(&entry->number);
 122                 }
 123                 break;
 124         case TOMOYO_TYPE_PATH_NUMBER3_ACL:
 125                 {
 126                         struct tomoyo_path_number3_acl *entry
 127                                 = container_of(acl, typeof(*entry), head);
 128                         tomoyo_put_name_union(&entry->name);
 129                         tomoyo_put_number_union(&entry->mode);
 130                         tomoyo_put_number_union(&entry->major);
 131                         tomoyo_put_number_union(&entry->minor);
 132                 }
 133                 break;
 134         case TOMOYO_TYPE_MOUNT_ACL:
 135                 {
 136                         struct tomoyo_mount_acl *entry
 137                                 = container_of(acl, typeof(*entry), head);
 138                         tomoyo_put_name_union(&entry->dev_name);
 139                         tomoyo_put_name_union(&entry->dir_name);
 140                         tomoyo_put_name_union(&entry->fs_type);
 141                         tomoyo_put_number_union(&entry->flags);
 142                 }
 143                 break;
 144         default:
 145                 printk(KERN_WARNING "Unknown type\n");
 146                 break;
 147         }
 148 }
 149
 150 static bool tomoyo_del_domain(struct tomoyo_domain_info *domain)
 151 {
 152         struct tomoyo_acl_info *acl;
 153         struct tomoyo_acl_info *tmp;
 154         /*
 155          * Since we don't protect whole execve() operation using SRCU,
 156          * we need to recheck domain->users at this point.
 157          *
 158          * (1) Reader starts SRCU section upon execve().
 159          * (2) Reader traverses tomoyo_domain_list and finds this domain.
 160          * (3) Writer marks this domain as deleted.
 161          * (4) Garbage collector removes this domain from tomoyo_domain_list
 162          *     because this domain is marked as deleted and used by nobody.
 163          * (5) Reader saves reference to this domain into
 164          *     "struct linux_binprm"->cred->security .
 165          * (6) Reader finishes SRCU section, although execve() operation has
 166          *     not finished yet.
 167          * (7) Garbage collector waits for SRCU synchronization.
 168          * (8) Garbage collector kfree() this domain because this domain is
 169          *     used by nobody.
 170          * (9) Reader finishes execve() operation and restores this domain from
 171          *     "struct linux_binprm"->cred->security.
 172          *
 173          * By updating domain->users at (5), we can solve this race problem
 174          * by rechecking domain->users at (8).
 175          */
 176         if (atomic_read(&domain->users))
 177                 return false;
 178         list_for_each_entry_safe(acl, tmp, &domain->acl_info_list, list) {
 179                 tomoyo_del_acl(acl);
 180                 tomoyo_memory_free(acl);
 181         }
 182         tomoyo_put_name(domain->domainname);
 183         return true;
 184 }
 185
 186
 187 static void tomoyo_del_name(const struct tomoyo_name_entry *ptr)
 188 {
 189 }
 190
 191 static void tomoyo_del_path_group_member(struct tomoyo_path_group_member
 192                                          *member)
 193 {
 194         tomoyo_put_name(member->member_name);
 195 }
 196
 197 static void tomoyo_del_path_group(struct tomoyo_path_group *group)
 198 {
 199         tomoyo_put_name(group->group_name);
 200 }
 201
 202 static void tomoyo_del_number_group_member(struct tomoyo_number_group_member
 203                                            *member)
 204 {
 205 }
 206
 207 static void tomoyo_del_number_group(struct tomoyo_number_group *group)
 208 {
 209         tomoyo_put_name(group->group_name);
 210 }
 211
 212 static void tomoyo_collect_entry(void)
 213 {
 214         if (mutex_lock_interruptible(&tomoyo_policy_lock))
 215                 return;
 216         {
 217                 struct tomoyo_globally_readable_file_entry *ptr;
 218                 list_for_each_entry_rcu(ptr, &tomoyo_globally_readable_list,
 219                                         list) {
 220                         if (!ptr->is_deleted)
 221                                 continue;
 222                         if (tomoyo_add_to_gc(TOMOYO_ID_GLOBALLY_READABLE, ptr))
 223                                 list_del_rcu(&ptr->list);
 224                         else
 225                                 break;
 226                 }
 227         }
 228         {
 229                 struct tomoyo_pattern_entry *ptr;
 230                 list_for_each_entry_rcu(ptr, &tomoyo_pattern_list, list) {
 231                         if (!ptr->is_deleted)
 232                                 continue;
 233                         if (tomoyo_add_to_gc(TOMOYO_ID_PATTERN, ptr))
 234                                 list_del_rcu(&ptr->list);
 235                         else
 236                                 break;
 237                 }
 238         }
 239         {
 240                 struct tomoyo_no_rewrite_entry *ptr;
 241                 list_for_each_entry_rcu(ptr, &tomoyo_no_rewrite_list, list) {
 242                         if (!ptr->is_deleted)
 243                                 continue;
 244                         if (tomoyo_add_to_gc(TOMOYO_ID_NO_REWRITE, ptr))
 245                                 list_del_rcu(&ptr->list);
 246                         else
 247                                 break;
 248                 }
 249         }
 250         {
 251                 struct tomoyo_domain_initializer_entry *ptr;
 252                 list_for_each_entry_rcu(ptr, &tomoyo_domain_initializer_list,
 253                                         list) {
 254                         if (!ptr->is_deleted)
 255                                 continue;
 256                         if (tomoyo_add_to_gc(TOMOYO_ID_DOMAIN_INITIALIZER, ptr))
 257                                 list_del_rcu(&ptr->list);
 258                         else
 259                                 break;
 260                 }
 261         }
 262         {
 263                 struct tomoyo_domain_keeper_entry *ptr;
 264                 list_for_each_entry_rcu(ptr, &tomoyo_domain_keeper_list, list) {
 265                         if (!ptr->is_deleted)
 266                                 continue;
 267                         if (tomoyo_add_to_gc(TOMOYO_ID_DOMAIN_KEEPER, ptr))
 268                                 list_del_rcu(&ptr->list);
 269                         else
 270                                 break;
 271                 }
 272         }
 273         {
 274                 struct tomoyo_aggregator_entry *ptr;
 275                 list_for_each_entry_rcu(ptr, &tomoyo_aggregator_list, list) {
 276                         if (!ptr->is_deleted)
 277                                 continue;
 278                         if (tomoyo_add_to_gc(TOMOYO_ID_AGGREGATOR, ptr))
 279                                 list_del_rcu(&ptr->list);
 280                         else
 281                                 break;
 282                 }
 283         }
 284         {
 285                 struct tomoyo_alias_entry *ptr;
 286                 list_for_each_entry_rcu(ptr, &tomoyo_alias_list, list) {
 287                         if (!ptr->is_deleted)
 288                                 continue;
 289                         if (tomoyo_add_to_gc(TOMOYO_ID_ALIAS, ptr))
 290                                 list_del_rcu(&ptr->list);
 291                         else
 292                                 break;
 293                 }
 294         }
 295         {
 296                 struct tomoyo_policy_manager_entry *ptr;
 297                 list_for_each_entry_rcu(ptr, &tomoyo_policy_manager_list,
 298                                         list) {
 299                         if (!ptr->is_deleted)
 300                                 continue;
 301                         if (tomoyo_add_to_gc(TOMOYO_ID_MANAGER, ptr))
 302                                 list_del_rcu(&ptr->list);
 303                         else
 304                                 break;
 305                 }
 306         }
 307         {
 308                 struct tomoyo_domain_info *domain;
 309                 list_for_each_entry_rcu(domain, &tomoyo_domain_list, list) {
 310                         struct tomoyo_acl_info *acl;
 311                         list_for_each_entry_rcu(acl, &domain->acl_info_list,
 312                                                 list) {
 313                                 switch (acl->type) {
 314                                 case TOMOYO_TYPE_PATH_ACL:
 315                                         if (container_of(acl,
 316                                          struct tomoyo_path_acl,
 317                                                          head)->perm)
 318                                                 continue;
 319                                         break;
 320                                 case TOMOYO_TYPE_PATH2_ACL:
 321                                         if (container_of(acl,
 322                                          struct tomoyo_path2_acl,
 323                                                          head)->perm)
 324                                                 continue;
 325                                         break;
 326                                 case TOMOYO_TYPE_PATH_NUMBER_ACL:
 327                                         if (container_of(acl,
 328                                          struct tomoyo_path_number_acl,
 329                                                          head)->perm)
 330                                                 continue;
 331                                         break;
 332                                 case TOMOYO_TYPE_PATH_NUMBER3_ACL:
 333                                         if (container_of(acl,
 334                                          struct tomoyo_path_number3_acl,
 335                                                          head)->perm)
 336                                                 continue;
 337                                         break;
 338                                 default:
 339                                         continue;
 340                                 }
 341                                 if (tomoyo_add_to_gc(TOMOYO_ID_ACL, acl))
 342                                         list_del_rcu(&acl->list);
 343                                 else
 344                                         break;
 345                         }
 346                         if (!domain->is_deleted || atomic_read(&domain->users))
 347                                 continue;
 348                         /*
 349                          * Nobody is referring this domain. But somebody may
 350                          * refer this domain after successful execve().
 351                          * We recheck domain->users after SRCU synchronization.
 352                          */
 353                         if (tomoyo_add_to_gc(TOMOYO_ID_DOMAIN, domain))
 354                                 list_del_rcu(&domain->list);
 355                         else
 356                                 break;
 357                 }
 358         }
 359         {
 360                 int i;
 361                 for (i = 0; i < TOMOYO_MAX_HASH; i++) {
 362                         struct tomoyo_name_entry *ptr;
 363                         list_for_each_entry_rcu(ptr, &tomoyo_name_list[i],
 364                                                 list) {
 365                                 if (atomic_read(&ptr->users))
 366                                         continue;
 367                                 if (tomoyo_add_to_gc(TOMOYO_ID_NAME, ptr))
 368                                         list_del_rcu(&ptr->list);
 369                                 else {
 370                                         i = TOMOYO_MAX_HASH;
 371                                         break;
 372                                 }
 373                         }
 374                 }
 375         }
 376         {
 377                 struct tomoyo_path_group *group;
 378                 list_for_each_entry_rcu(group, &tomoyo_path_group_list, list) {
 379                         struct tomoyo_path_group_member *member;
 380                         list_for_each_entry_rcu(member, &group->member_list,
 381                                                 list) {
 382                                 if (!member->is_deleted)
 383                                         continue;
 384                                 if (tomoyo_add_to_gc(TOMOYO_ID_PATH_GROUP_MEMBER,
 385                                                      member))
 386                                         list_del_rcu(&member->list);
 387                                 else
 388                                         break;
 389                         }
 390                         if (!list_empty(&group->member_list) ||
 391                             atomic_read(&group->users))
 392                                 continue;
 393                         if (tomoyo_add_to_gc(TOMOYO_ID_PATH_GROUP, group))
 394                                 list_del_rcu(&group->list);
 395                         else
 396                                 break;
 397                 }
 398         }
 399         {
 400                 struct tomoyo_number_group *group;
 401                 list_for_each_entry_rcu(group, &tomoyo_number_group_list, list) {
 402                         struct tomoyo_number_group_member *member;
 403                         list_for_each_entry_rcu(member, &group->member_list,
 404                                                 list) {
 405                                 if (!member->is_deleted)
 406                                         continue;
 407                                 if (tomoyo_add_to_gc(TOMOYO_ID_NUMBER_GROUP_MEMBER,
 408                                                      member))
 409                                         list_del_rcu(&member->list);
 410                                 else
 411                                         break;
 412                         }
 413                         if (!list_empty(&group->member_list) ||
 414                             atomic_read(&group->users))
 415                                 continue;
 416                         if (tomoyo_add_to_gc(TOMOYO_ID_NUMBER_GROUP, group))
 417                                 list_del_rcu(&group->list);
 418                         else
 419                                 break;
 420                 }
 421         }
 422         mutex_unlock(&tomoyo_policy_lock);
 423 }
 424
 425 static void tomoyo_kfree_entry(void)
 426 {
 427         struct tomoyo_gc_entry *p;
 428         struct tomoyo_gc_entry *tmp;
 429
 430         list_for_each_entry_safe(p, tmp, &tomoyo_gc_queue, list) {
 431                 switch (p->type) {
 432                 case TOMOYO_ID_DOMAIN_INITIALIZER:
 433                         tomoyo_del_domain_initializer(p->element);
 434                         break;
 435                 case TOMOYO_ID_DOMAIN_KEEPER:
 436                         tomoyo_del_domain_keeper(p->element);
 437                         break;
 438                 case TOMOYO_ID_AGGREGATOR:
 439                         tomoyo_del_aggregator(p->element);
 440                         break;
 441                 case TOMOYO_ID_ALIAS:
 442                         tomoyo_del_alias(p->element);
 443                         break;
 444                 case TOMOYO_ID_GLOBALLY_READABLE:
 445                         tomoyo_del_allow_read(p->element);
 446                         break;
 447                 case TOMOYO_ID_PATTERN:
 448                         tomoyo_del_file_pattern(p->element);
 449                         break;
 450                 case TOMOYO_ID_NO_REWRITE:
 451                         tomoyo_del_no_rewrite(p->element);
 452                         break;
 453                 case TOMOYO_ID_MANAGER:
 454                         tomoyo_del_manager(p->element);
 455                         break;
 456                 case TOMOYO_ID_NAME:
 457                         tomoyo_del_name(p->element);
 458                         break;
 459                 case TOMOYO_ID_ACL:
 460                         tomoyo_del_acl(p->element);
 461                         break;
 462                 case TOMOYO_ID_DOMAIN:
 463                         if (!tomoyo_del_domain(p->element))
 464                                 continue;
 465                         break;
 466                 case TOMOYO_ID_PATH_GROUP_MEMBER:
 467                         tomoyo_del_path_group_member(p->element);
 468                         break;
 469                 case TOMOYO_ID_PATH_GROUP:
 470                         tomoyo_del_path_group(p->element);
 471                         break;
 472                 case TOMOYO_ID_NUMBER_GROUP_MEMBER:
 473                         tomoyo_del_number_group_member(p->element);
 474                         break;
 475                 case TOMOYO_ID_NUMBER_GROUP:
 476                         tomoyo_del_number_group(p->element);
 477                         break;
 478                 default:
 479                         printk(KERN_WARNING "Unknown type\n");
 480                         break;
 481                 }
 482                 tomoyo_memory_free(p->element);
 483                 list_del(&p->list);
 484                 kfree(p);
 485         }
 486 }
 487
 488 static int tomoyo_gc_thread(void *unused)
 489 {
 490         daemonize("GC for TOMOYO");
 491         if (mutex_trylock(&tomoyo_gc_mutex)) {
 492                 int i;
 493                 for (i = 0; i < 10; i++) {
 494                         tomoyo_collect_entry();
 495                         if (list_empty(&tomoyo_gc_queue))
 496                                 break;
 497                         synchronize_srcu(&tomoyo_ss);
 498                         tomoyo_kfree_entry();
 499                 }
 500                 mutex_unlock(&tomoyo_gc_mutex);
 501         }
 502         do_exit(0);
 503 }
 504
 505 void tomoyo_run_gc(void)
 506 {
 507         struct task_struct *task = kthread_create(tomoyo_gc_thread, NULL,
 508                                                   "GC for TOMOYO");
 509         if (!IS_ERR(task))
 510                 wake_up_process(task);
 511 }