Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

[~andy/linux] / security / tomoyo / common.h

diff --git a/security/tomoyo/common.h b/security/tomoyo/common.h
index 5a0fcedb332b7d8b1379667fd10b1d37f4d821a8..f7fbaa66e443dcd95aaa4002eedd49f87ffedde1 100644 (file)
--- a/security/tomoyo/common.h
+++ b/security/tomoyo/common.h
@@ -54,6 +54,8 @@ enum tomoyo_conditions_index {
        TOMOYO_TASK_FSGID,           /* current_fsgid() */
        TOMOYO_TASK_PID,             /* sys_getpid()   */
        TOMOYO_TASK_PPID,            /* sys_getppid()  */
+       TOMOYO_EXEC_ARGC,            /* "struct linux_binprm *"->argc */
+       TOMOYO_EXEC_ENVC,            /* "struct linux_binprm *"->envc */
        TOMOYO_TYPE_IS_SOCKET,       /* S_IFSOCK */
        TOMOYO_TYPE_IS_SYMLINK,      /* S_IFLNK */
        TOMOYO_TYPE_IS_FILE,         /* S_IFREG */
@@ -73,6 +75,8 @@ enum tomoyo_conditions_index {
        TOMOYO_MODE_OTHERS_READ,     /* S_IROTH */
        TOMOYO_MODE_OTHERS_WRITE,    /* S_IWOTH */
        TOMOYO_MODE_OTHERS_EXECUTE,  /* S_IXOTH */
+       TOMOYO_EXEC_REALPATH,
+       TOMOYO_SYMLINK_TARGET,
        TOMOYO_PATH1_UID,
        TOMOYO_PATH1_GID,
        TOMOYO_PATH1_INO,
@@ -101,6 +105,9 @@ enum tomoyo_conditions_index {
        TOMOYO_PATH2_PARENT_PERM,
        TOMOYO_MAX_CONDITION_KEYWORD,
        TOMOYO_NUMBER_UNION,
+       TOMOYO_NAME_UNION,
+       TOMOYO_ARGV_ENTRY,
+       TOMOYO_ENVP_ENTRY,
 };
 
 
@@ -351,6 +358,11 @@ struct tomoyo_request_info {
         * NULL if not dealing files.
         */
        struct tomoyo_obj_info *obj;
+       /*
+        * For holding parameters specific to execve() request.
+        * NULL if not dealing do_execve().
+        */
+       struct tomoyo_execve *ee;
        struct tomoyo_domain_info *domain;
        /* For holding parameters. */
        union {
@@ -459,6 +471,12 @@ struct tomoyo_mini_stat {
        dev_t rdev;
 };
 
+/* Structure for dumping argv[] and envp[] of "struct linux_binprm". */
+struct tomoyo_page_dump {
+       struct page *page;    /* Previously dumped page. */
+       char *data;           /* Contents of "page". Size is PAGE_SIZE. */
+};
+
 /* Structure for attribute checks in addition to pathname checks. */
 struct tomoyo_obj_info {
        /*
@@ -476,13 +494,52 @@ struct tomoyo_obj_info {
         * parent directory.
         */
        struct tomoyo_mini_stat stat[TOMOYO_MAX_PATH_STAT];
+       /*
+        * Content of symbolic link to be created. NULL for operations other
+        * than symlink().
+        */
+       struct tomoyo_path_info *symlink_target;
+};
+
+/* Structure for argv[]. */
+struct tomoyo_argv {
+       unsigned long index;
+       const struct tomoyo_path_info *value;
+       bool is_not;
+};
+
+/* Structure for envp[]. */
+struct tomoyo_envp {
+       const struct tomoyo_path_info *name;
+       const struct tomoyo_path_info *value;
+       bool is_not;
+};
+
+/* Structure for execve() operation. */
+struct tomoyo_execve {
+       struct tomoyo_request_info r;
+       struct tomoyo_obj_info obj;
+       struct linux_binprm *bprm;
+       /* For dumping argv[] and envp[]. */
+       struct tomoyo_page_dump dump;
+       /* For temporary use. */
+       char *tmp; /* Size is TOMOYO_EXEC_TMPSIZE bytes */
 };
 
 /* Structure for entries which follows "struct tomoyo_condition". */
 struct tomoyo_condition_element {
-       /* Left hand operand. */
+       /*
+        * Left hand operand. A "struct tomoyo_argv" for TOMOYO_ARGV_ENTRY, a
+        * "struct tomoyo_envp" for TOMOYO_ENVP_ENTRY is attached to the tail
+        * of the array of this struct.
+        */
        u8 left;
-       /* Right hand operand. */
+       /*
+        * Right hand operand. A "struct tomoyo_number_union" for
+        * TOMOYO_NUMBER_UNION, a "struct tomoyo_name_union" for
+        * TOMOYO_NAME_UNION is attached to the tail of the array of this
+        * struct.
+        */
        u8 right;
        /* Equation operator. True if equals or overlaps, false otherwise. */
        bool equals;
@@ -494,9 +551,15 @@ struct tomoyo_condition {
        u32 size; /* Memory size allocated for this entry. */
        u16 condc; /* Number of conditions in this struct. */
        u16 numbers_count; /* Number of "struct tomoyo_number_union values". */
+       u16 names_count; /* Number of "struct tomoyo_name_union names". */
+       u16 argc; /* Number of "struct tomoyo_argv". */
+       u16 envc; /* Number of "struct tomoyo_envp". */
        /*
         * struct tomoyo_condition_element condition[condc];
         * struct tomoyo_number_union values[numbers_count];
+        * struct tomoyo_name_union names[names_count];
+        * struct tomoyo_argv argv[argc];
+        * struct tomoyo_envp envp[envc];
         */
 };
 
@@ -727,6 +790,8 @@ bool tomoyo_correct_path(const char *filename);
 bool tomoyo_correct_word(const char *string);
 bool tomoyo_domain_def(const unsigned char *buffer);
 bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r);
+bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos,
+                     struct tomoyo_page_dump *dump);
 bool tomoyo_memory_ok(void *ptr);
 bool tomoyo_number_matches_group(const unsigned long min,
                                 const unsigned long max,
@@ -771,7 +836,8 @@ int tomoyo_path2_perm(const u8 operation, struct path *path1,
                      struct path *path2);
 int tomoyo_path_number_perm(const u8 operation, struct path *path,
                            unsigned long number);
-int tomoyo_path_perm(const u8 operation, struct path *path);
+int tomoyo_path_perm(const u8 operation, struct path *path,
+                    const char *target);
 int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation,
                           const struct tomoyo_path_info *filename);
 int tomoyo_poll_control(struct file *file, poll_table *wait);