security/tomoyo/condition.c

   1 /*
   2  * security/tomoyo/condition.c
   3  *
   4  * Copyright (C) 2005-2011  NTT DATA CORPORATION
   5  */
   6
   7 #include "common.h"
   8 #include <linux/slab.h>
   9
  10 /* List of "struct tomoyo_condition". */
  11 LIST_HEAD(tomoyo_condition_list);
  12
  13 /**
  14  * tomoyo_argv - Check argv[] in "struct linux_binbrm".
  15  *
  16  * @index:   Index number of @arg_ptr.
  17  * @arg_ptr: Contents of argv[@index].
  18  * @argc:    Length of @argv.
  19  * @argv:    Pointer to "struct tomoyo_argv".
  20  * @checked: Set to true if @argv[@index] was found.
  21  *
  22  * Returns true on success, false otherwise.
  23  */
  24 static bool tomoyo_argv(const unsigned int index, const char *arg_ptr,
  25                         const int argc, const struct tomoyo_argv *argv,
  26                         u8 *checked)
  27 {
  28         int i;
  29         struct tomoyo_path_info arg;
  30         arg.name = arg_ptr;
  31         for (i = 0; i < argc; argv++, checked++, i++) {
  32                 bool result;
  33                 if (index != argv->index)
  34                         continue;
  35                 *checked = 1;
  36                 tomoyo_fill_path_info(&arg);
  37                 result = tomoyo_path_matches_pattern(&arg, argv->value);
  38                 if (argv->is_not)
  39                         result = !result;
  40                 if (!result)
  41                         return false;
  42         }
  43         return true;
  44 }
  45
  46 /**
  47  * tomoyo_envp - Check envp[] in "struct linux_binbrm".
  48  *
  49  * @env_name:  The name of environment variable.
  50  * @env_value: The value of environment variable.
  51  * @envc:      Length of @envp.
  52  * @envp:      Pointer to "struct tomoyo_envp".
  53  * @checked:   Set to true if @envp[@env_name] was found.
  54  *
  55  * Returns true on success, false otherwise.
  56  */
  57 static bool tomoyo_envp(const char *env_name, const char *env_value,
  58                         const int envc, const struct tomoyo_envp *envp,
  59                         u8 *checked)
  60 {
  61         int i;
  62         struct tomoyo_path_info name;
  63         struct tomoyo_path_info value;
  64         name.name = env_name;
  65         tomoyo_fill_path_info(&name);
  66         value.name = env_value;
  67         tomoyo_fill_path_info(&value);
  68         for (i = 0; i < envc; envp++, checked++, i++) {
  69                 bool result;
  70                 if (!tomoyo_path_matches_pattern(&name, envp->name))
  71                         continue;
  72                 *checked = 1;
  73                 if (envp->value) {
  74                         result = tomoyo_path_matches_pattern(&value,
  75                                                              envp->value);
  76                         if (envp->is_not)
  77                                 result = !result;
  78                 } else {
  79                         result = true;
  80                         if (!envp->is_not)
  81                                 result = !result;
  82                 }
  83                 if (!result)
  84                         return false;
  85         }
  86         return true;
  87 }
  88
  89 /**
  90  * tomoyo_scan_bprm - Scan "struct linux_binprm".
  91  *
  92  * @ee:   Pointer to "struct tomoyo_execve".
  93  * @argc: Length of @argc.
  94  * @argv: Pointer to "struct tomoyo_argv".
  95  * @envc: Length of @envp.
  96  * @envp: Poiner to "struct tomoyo_envp".
  97  *
  98  * Returns true on success, false otherwise.
  99  */
 100 static bool tomoyo_scan_bprm(struct tomoyo_execve *ee,
 101                              const u16 argc, const struct tomoyo_argv *argv,
 102                              const u16 envc, const struct tomoyo_envp *envp)
 103 {
 104         struct linux_binprm *bprm = ee->bprm;
 105         struct tomoyo_page_dump *dump = &ee->dump;
 106         char *arg_ptr = ee->tmp;
 107         int arg_len = 0;
 108         unsigned long pos = bprm->p;
 109         int offset = pos % PAGE_SIZE;
 110         int argv_count = bprm->argc;
 111         int envp_count = bprm->envc;
 112         bool result = true;
 113         u8 local_checked[32];
 114         u8 *checked;
 115         if (argc + envc <= sizeof(local_checked)) {
 116                 checked = local_checked;
 117                 memset(local_checked, 0, sizeof(local_checked));
 118         } else {
 119                 checked = kzalloc(argc + envc, GFP_NOFS);
 120                 if (!checked)
 121                         return false;
 122         }
 123         while (argv_count || envp_count) {
 124                 if (!tomoyo_dump_page(bprm, pos, dump)) {
 125                         result = false;
 126                         goto out;
 127                 }
 128                 pos += PAGE_SIZE - offset;
 129                 while (offset < PAGE_SIZE) {
 130                         /* Read. */
 131                         const char *kaddr = dump->data;
 132                         const unsigned char c = kaddr[offset++];
 133                         if (c && arg_len < TOMOYO_EXEC_TMPSIZE - 10) {
 134                                 if (c == '\\') {
 135                                         arg_ptr[arg_len++] = '\\';
 136                                         arg_ptr[arg_len++] = '\\';
 137                                 } else if (c > ' ' && c < 127) {
 138                                         arg_ptr[arg_len++] = c;
 139                                 } else {
 140                                         arg_ptr[arg_len++] = '\\';
 141                                         arg_ptr[arg_len++] = (c >> 6) + '0';
 142                                         arg_ptr[arg_len++] =
 143                                                 ((c >> 3) & 7) + '0';
 144                                         arg_ptr[arg_len++] = (c & 7) + '0';
 145                                 }
 146                         } else {
 147                                 arg_ptr[arg_len] = '\0';
 148                         }
 149                         if (c)
 150                                 continue;
 151                         /* Check. */
 152                         if (argv_count) {
 153                                 if (!tomoyo_argv(bprm->argc - argv_count,
 154                                                  arg_ptr, argc, argv,
 155                                                  checked)) {
 156                                         result = false;
 157                                         break;
 158                                 }
 159                                 argv_count--;
 160                         } else if (envp_count) {
 161                                 char *cp = strchr(arg_ptr, '=');
 162                                 if (cp) {
 163                                         *cp = '\0';
 164                                         if (!tomoyo_envp(arg_ptr, cp + 1,
 165                                                          envc, envp,
 166                                                          checked + argc)) {
 167                                                 result = false;
 168                                                 break;
 169                                         }
 170                                 }
 171                                 envp_count--;
 172                         } else {
 173                                 break;
 174                         }
 175                         arg_len = 0;
 176                 }
 177                 offset = 0;
 178                 if (!result)
 179                         break;
 180         }
 181 out:
 182         if (result) {
 183                 int i;
 184                 /* Check not-yet-checked entries. */
 185                 for (i = 0; i < argc; i++) {
 186                         if (checked[i])
 187                                 continue;
 188                         /*
 189                          * Return true only if all unchecked indexes in
 190                          * bprm->argv[] are not matched.
 191                          */
 192                         if (argv[i].is_not)
 193                                 continue;
 194                         result = false;
 195                         break;
 196                 }
 197                 for (i = 0; i < envc; envp++, i++) {
 198                         if (checked[argc + i])
 199                                 continue;
 200                         /*
 201                          * Return true only if all unchecked environ variables
 202                          * in bprm->envp[] are either undefined or not matched.
 203                          */
 204                         if ((!envp->value && !envp->is_not) ||
 205                             (envp->value && envp->is_not))
 206                                 continue;
 207                         result = false;
 208                         break;
 209                 }
 210         }
 211         if (checked != local_checked)
 212                 kfree(checked);
 213         return result;
 214 }
 215
 216 /**
 217  * tomoyo_scan_exec_realpath - Check "exec.realpath" parameter of "struct tomoyo_condition".
 218  *
 219  * @file:  Pointer to "struct file".
 220  * @ptr:   Pointer to "struct tomoyo_name_union".
 221  * @match: True if "exec.realpath=", false if "exec.realpath!=".
 222  *
 223  * Returns true on success, false otherwise.
 224  */
 225 static bool tomoyo_scan_exec_realpath(struct file *file,
 226                                       const struct tomoyo_name_union *ptr,
 227                                       const bool match)
 228 {
 229         bool result;
 230         struct tomoyo_path_info exe;
 231         if (!file)
 232                 return false;
 233         exe.name = tomoyo_realpath_from_path(&file->f_path);
 234         if (!exe.name)
 235                 return false;
 236         tomoyo_fill_path_info(&exe);
 237         result = tomoyo_compare_name_union(&exe, ptr);
 238         kfree(exe.name);
 239         return result == match;
 240 }
 241
 242 /**
 243  * tomoyo_get_dqword - tomoyo_get_name() for a quoted string.
 244  *
 245  * @start: String to save.
 246  *
 247  * Returns pointer to "struct tomoyo_path_info" on success, NULL otherwise.
 248  */
 249 static const struct tomoyo_path_info *tomoyo_get_dqword(char *start)
 250 {
 251         char *cp = start + strlen(start) - 1;
 252         if (cp == start || *start++ != '"' || *cp != '"')
 253                 return NULL;
 254         *cp = '\0';
 255         if (*start && !tomoyo_correct_word(start))
 256                 return NULL;
 257         return tomoyo_get_name(start);
 258 }
 259
 260 /**
 261  * tomoyo_parse_name_union_quoted - Parse a quoted word.
 262  *
 263  * @param: Pointer to "struct tomoyo_acl_param".
 264  * @ptr:   Pointer to "struct tomoyo_name_union".
 265  *
 266  * Returns true on success, false otherwise.
 267  */
 268 static bool tomoyo_parse_name_union_quoted(struct tomoyo_acl_param *param,
 269                                            struct tomoyo_name_union *ptr)
 270 {
 271         char *filename = param->data;
 272         if (*filename == '@')
 273                 return tomoyo_parse_name_union(param, ptr);
 274         ptr->filename = tomoyo_get_dqword(filename);
 275         return ptr->filename != NULL;
 276 }
 277
 278 /**
 279  * tomoyo_parse_argv - Parse an argv[] condition part.
 280  *
 281  * @left:  Lefthand value.
 282  * @right: Righthand value.
 283  * @argv:  Pointer to "struct tomoyo_argv".
 284  *
 285  * Returns true on success, false otherwise.
 286  */
 287 static bool tomoyo_parse_argv(char *left, char *right,
 288                               struct tomoyo_argv *argv)
 289 {
 290         if (tomoyo_parse_ulong(&argv->index, &left) !=
 291             TOMOYO_VALUE_TYPE_DECIMAL || *left++ != ']' || *left)
 292                 return false;
 293         argv->value = tomoyo_get_dqword(right);
 294         return argv->value != NULL;
 295 }
 296
 297 /**
 298  * tomoyo_parse_envp - Parse an envp[] condition part.
 299  *
 300  * @left:  Lefthand value.
 301  * @right: Righthand value.
 302  * @envp:  Pointer to "struct tomoyo_envp".
 303  *
 304  * Returns true on success, false otherwise.
 305  */
 306 static bool tomoyo_parse_envp(char *left, char *right,
 307                               struct tomoyo_envp *envp)
 308 {
 309         const struct tomoyo_path_info *name;
 310         const struct tomoyo_path_info *value;
 311         char *cp = left + strlen(left) - 1;
 312         if (*cp-- != ']' || *cp != '"')
 313                 goto out;
 314         *cp = '\0';
 315         if (!tomoyo_correct_word(left))
 316                 goto out;
 317         name = tomoyo_get_name(left);
 318         if (!name)
 319                 goto out;
 320         if (!strcmp(right, "NULL")) {
 321                 value = NULL;
 322         } else {
 323                 value = tomoyo_get_dqword(right);
 324                 if (!value) {
 325                         tomoyo_put_name(name);
 326                         goto out;
 327                 }
 328         }
 329         envp->name = name;
 330         envp->value = value;
 331         return true;
 332 out:
 333         return false;
 334 }
 335
 336 /**
 337  * tomoyo_same_condition - Check for duplicated "struct tomoyo_condition" entry.
 338  *
 339  * @a: Pointer to "struct tomoyo_condition".
 340  * @b: Pointer to "struct tomoyo_condition".
 341  *
 342  * Returns true if @a == @b, false otherwise.
 343  */
 344 static inline bool tomoyo_same_condition(const struct tomoyo_condition *a,
 345                                          const struct tomoyo_condition *b)
 346 {
 347         return a->size == b->size && a->condc == b->condc &&
 348                 a->numbers_count == b->numbers_count &&
 349                 a->names_count == b->names_count &&
 350                 a->argc == b->argc && a->envc == b->envc &&
 351                 a->grant_log == b->grant_log &&
 352                 !memcmp(a + 1, b + 1, a->size - sizeof(*a));
 353 }
 354
 355 /**
 356  * tomoyo_condition_type - Get condition type.
 357  *
 358  * @word: Keyword string.
 359  *
 360  * Returns one of values in "enum tomoyo_conditions_index" on success,
 361  * TOMOYO_MAX_CONDITION_KEYWORD otherwise.
 362  */
 363 static u8 tomoyo_condition_type(const char *word)
 364 {
 365         u8 i;
 366         for (i = 0; i < TOMOYO_MAX_CONDITION_KEYWORD; i++) {
 367                 if (!strcmp(word, tomoyo_condition_keyword[i]))
 368                         break;
 369         }
 370         return i;
 371 }
 372
 373 /* Define this to enable debug mode. */
 374 /* #define DEBUG_CONDITION */
 375
 376 #ifdef DEBUG_CONDITION
 377 #define dprintk printk
 378 #else
 379 #define dprintk(...) do { } while (0)
 380 #endif
 381
 382 /**
 383  * tomoyo_commit_condition - Commit "struct tomoyo_condition".
 384  *
 385  * @entry: Pointer to "struct tomoyo_condition".
 386  *
 387  * Returns pointer to "struct tomoyo_condition" on success, NULL otherwise.
 388  *
 389  * This function merges duplicated entries. This function returns NULL if
 390  * @entry is not duplicated but memory quota for policy has exceeded.
 391  */
 392 static struct tomoyo_condition *tomoyo_commit_condition
 393 (struct tomoyo_condition *entry)
 394 {
 395         struct tomoyo_condition *ptr;
 396         bool found = false;
 397         if (mutex_lock_interruptible(&tomoyo_policy_lock)) {
 398                 dprintk(KERN_WARNING "%u: %s failed\n", __LINE__, __func__);
 399                 ptr = NULL;
 400                 found = true;
 401                 goto out;
 402         }
 403         list_for_each_entry_rcu(ptr, &tomoyo_condition_list, head.list) {
 404                 if (!tomoyo_same_condition(ptr, entry))
 405                         continue;
 406                 /* Same entry found. Share this entry. */
 407                 atomic_inc(&ptr->head.users);
 408                 found = true;
 409                 break;
 410         }
 411         if (!found) {
 412                 if (tomoyo_memory_ok(entry)) {
 413                         atomic_set(&entry->head.users, 1);
 414                         list_add_rcu(&entry->head.list,
 415                                      &tomoyo_condition_list);
 416                 } else {
 417                         found = true;
 418                         ptr = NULL;
 419                 }
 420         }
 421         mutex_unlock(&tomoyo_policy_lock);
 422 out:
 423         if (found) {
 424                 tomoyo_del_condition(&entry->head.list);
 425                 kfree(entry);
 426                 entry = ptr;
 427         }
 428         return entry;
 429 }
 430
 431 /**
 432  * tomoyo_get_condition - Parse condition part.
 433  *
 434  * @param: Pointer to "struct tomoyo_acl_param".
 435  *
 436  * Returns pointer to "struct tomoyo_condition" on success, NULL otherwise.
 437  */
 438 struct tomoyo_condition *tomoyo_get_condition(struct tomoyo_acl_param *param)
 439 {
 440         struct tomoyo_condition *entry = NULL;
 441         struct tomoyo_condition_element *condp = NULL;
 442         struct tomoyo_number_union *numbers_p = NULL;
 443         struct tomoyo_name_union *names_p = NULL;
 444         struct tomoyo_argv *argv = NULL;
 445         struct tomoyo_envp *envp = NULL;
 446         struct tomoyo_condition e = { };
 447         char * const start_of_string = param->data;
 448         char * const end_of_string = start_of_string + strlen(start_of_string);
 449         char *pos;
 450 rerun:
 451         pos = start_of_string;
 452         while (1) {
 453                 u8 left = -1;
 454                 u8 right = -1;
 455                 char *left_word = pos;
 456                 char *cp;
 457                 char *right_word;
 458                 bool is_not;
 459                 if (!*left_word)
 460                         break;
 461                 /*
 462                  * Since left-hand condition does not allow use of "path_group"
 463                  * or "number_group" and environment variable's names do not
 464                  * accept '=', it is guaranteed that the original line consists
 465                  * of one or more repetition of $left$operator$right blocks
 466                  * where "$left is free from '=' and ' '" and "$operator is
 467                  * either '=' or '!='" and "$right is free from ' '".
 468                  * Therefore, we can reconstruct the original line at the end
 469                  * of dry run even if we overwrite $operator with '\0'.
 470                  */
 471                 cp = strchr(pos, ' ');
 472                 if (cp) {
 473                         *cp = '\0'; /* Will restore later. */
 474                         pos = cp + 1;
 475                 } else {
 476                         pos = "";
 477                 }
 478                 right_word = strchr(left_word, '=');
 479                 if (!right_word || right_word == left_word)
 480                         goto out;
 481                 is_not = *(right_word - 1) == '!';
 482                 if (is_not)
 483                         *(right_word++ - 1) = '\0'; /* Will restore later. */
 484                 else if (*(right_word + 1) != '=')
 485                         *right_word++ = '\0'; /* Will restore later. */
 486                 else
 487                         goto out;
 488                 dprintk(KERN_WARNING "%u: <%s>%s=<%s>\n", __LINE__, left_word,
 489                         is_not ? "!" : "", right_word);
 490                 if (!strcmp(left_word, "grant_log")) {
 491                         if (entry) {
 492                                 if (is_not ||
 493                                     entry->grant_log != TOMOYO_GRANTLOG_AUTO)
 494                                         goto out;
 495                                 else if (!strcmp(right_word, "yes"))
 496                                         entry->grant_log = TOMOYO_GRANTLOG_YES;
 497                                 else if (!strcmp(right_word, "no"))
 498                                         entry->grant_log = TOMOYO_GRANTLOG_NO;
 499                                 else
 500                                         goto out;
 501                         }
 502                         continue;
 503                 }
 504                 if (!strncmp(left_word, "exec.argv[", 10)) {
 505                         if (!argv) {
 506                                 e.argc++;
 507                                 e.condc++;
 508                         } else {
 509                                 e.argc--;
 510                                 e.condc--;
 511                                 left = TOMOYO_ARGV_ENTRY;
 512                                 argv->is_not = is_not;
 513                                 if (!tomoyo_parse_argv(left_word + 10,
 514                                                        right_word, argv++))
 515                                         goto out;
 516                         }
 517                         goto store_value;
 518                 }
 519                 if (!strncmp(left_word, "exec.envp[\"", 11)) {
 520                         if (!envp) {
 521                                 e.envc++;
 522                                 e.condc++;
 523                         } else {
 524                                 e.envc--;
 525                                 e.condc--;
 526                                 left = TOMOYO_ENVP_ENTRY;
 527                                 envp->is_not = is_not;
 528                                 if (!tomoyo_parse_envp(left_word + 11,
 529                                                        right_word, envp++))
 530                                         goto out;
 531                         }
 532                         goto store_value;
 533                 }
 534                 left = tomoyo_condition_type(left_word);
 535                 dprintk(KERN_WARNING "%u: <%s> left=%u\n", __LINE__, left_word,
 536                         left);
 537                 if (left == TOMOYO_MAX_CONDITION_KEYWORD) {
 538                         if (!numbers_p) {
 539                                 e.numbers_count++;
 540                         } else {
 541                                 e.numbers_count--;
 542                                 left = TOMOYO_NUMBER_UNION;
 543                                 param->data = left_word;
 544                                 if (*left_word == '@' ||
 545                                     !tomoyo_parse_number_union(param,
 546                                                                numbers_p++))
 547                                         goto out;
 548                         }
 549                 }
 550                 if (!condp)
 551                         e.condc++;
 552                 else
 553                         e.condc--;
 554                 if (left == TOMOYO_EXEC_REALPATH ||
 555                     left == TOMOYO_SYMLINK_TARGET) {
 556                         if (!names_p) {
 557                                 e.names_count++;
 558                         } else {
 559                                 e.names_count--;
 560                                 right = TOMOYO_NAME_UNION;
 561                                 param->data = right_word;
 562                                 if (!tomoyo_parse_name_union_quoted(param,
 563                                                                     names_p++))
 564                                         goto out;
 565                         }
 566                         goto store_value;
 567                 }
 568                 right = tomoyo_condition_type(right_word);
 569                 if (right == TOMOYO_MAX_CONDITION_KEYWORD) {
 570                         if (!numbers_p) {
 571                                 e.numbers_count++;
 572                         } else {
 573                                 e.numbers_count--;
 574                                 right = TOMOYO_NUMBER_UNION;
 575                                 param->data = right_word;
 576                                 if (!tomoyo_parse_number_union(param,
 577                                                                numbers_p++))
 578                                         goto out;
 579                         }
 580                 }
 581 store_value:
 582                 if (!condp) {
 583                         dprintk(KERN_WARNING "%u: dry_run left=%u right=%u "
 584                                 "match=%u\n", __LINE__, left, right, !is_not);
 585                         continue;
 586                 }
 587                 condp->left = left;
 588                 condp->right = right;
 589                 condp->equals = !is_not;
 590                 dprintk(KERN_WARNING "%u: left=%u right=%u match=%u\n",
 591                         __LINE__, condp->left, condp->right,
 592                         condp->equals);
 593                 condp++;
 594         }
 595         dprintk(KERN_INFO "%u: cond=%u numbers=%u names=%u ac=%u ec=%u\n",
 596                 __LINE__, e.condc, e.numbers_count, e.names_count, e.argc,
 597                 e.envc);
 598         if (entry) {
 599                 BUG_ON(e.names_count | e.numbers_count | e.argc | e.envc |
 600                        e.condc);
 601                 return tomoyo_commit_condition(entry);
 602         }
 603         e.size = sizeof(*entry)
 604                 + e.condc * sizeof(struct tomoyo_condition_element)
 605                 + e.numbers_count * sizeof(struct tomoyo_number_union)
 606                 + e.names_count * sizeof(struct tomoyo_name_union)
 607                 + e.argc * sizeof(struct tomoyo_argv)
 608                 + e.envc * sizeof(struct tomoyo_envp);
 609         entry = kzalloc(e.size, GFP_NOFS);
 610         if (!entry)
 611                 return NULL;
 612         *entry = e;
 613         condp = (struct tomoyo_condition_element *) (entry + 1);
 614         numbers_p = (struct tomoyo_number_union *) (condp + e.condc);
 615         names_p = (struct tomoyo_name_union *) (numbers_p + e.numbers_count);
 616         argv = (struct tomoyo_argv *) (names_p + e.names_count);
 617         envp = (struct tomoyo_envp *) (argv + e.argc);
 618         {
 619                 bool flag = false;
 620                 for (pos = start_of_string; pos < end_of_string; pos++) {
 621                         if (*pos)
 622                                 continue;
 623                         if (flag) /* Restore " ". */
 624                                 *pos = ' ';
 625                         else if (*(pos + 1) == '=') /* Restore "!=". */
 626                                 *pos = '!';
 627                         else /* Restore "=". */
 628                                 *pos = '=';
 629                         flag = !flag;
 630                 }
 631         }
 632         goto rerun;
 633 out:
 634         dprintk(KERN_WARNING "%u: %s failed\n", __LINE__, __func__);
 635         if (entry) {
 636                 tomoyo_del_condition(&entry->head.list);
 637                 kfree(entry);
 638         }
 639         return NULL;
 640 }
 641
 642 /**
 643  * tomoyo_get_attributes - Revalidate "struct inode".
 644  *
 645  * @obj: Pointer to "struct tomoyo_obj_info".
 646  *
 647  * Returns nothing.
 648  */
 649 void tomoyo_get_attributes(struct tomoyo_obj_info *obj)
 650 {
 651         u8 i;
 652         struct dentry *dentry = NULL;
 653
 654         for (i = 0; i < TOMOYO_MAX_PATH_STAT; i++) {
 655                 struct inode *inode;
 656                 switch (i) {
 657                 case TOMOYO_PATH1:
 658                         dentry = obj->path1.dentry;
 659                         if (!dentry)
 660                                 continue;
 661                         break;
 662                 case TOMOYO_PATH2:
 663                         dentry = obj->path2.dentry;
 664                         if (!dentry)
 665                                 continue;
 666                         break;
 667                 default:
 668                         if (!dentry)
 669                                 continue;
 670                         dentry = dget_parent(dentry);
 671                         break;
 672                 }
 673                 inode = dentry->d_inode;
 674                 if (inode) {
 675                         struct tomoyo_mini_stat *stat = &obj->stat[i];
 676                         stat->uid  = inode->i_uid;
 677                         stat->gid  = inode->i_gid;
 678                         stat->ino  = inode->i_ino;
 679                         stat->mode = inode->i_mode;
 680                         stat->dev  = inode->i_sb->s_dev;
 681                         stat->rdev = inode->i_rdev;
 682                         obj->stat_valid[i] = true;
 683                 }
 684                 if (i & 1) /* i == TOMOYO_PATH1_PARENT ||
 685                               i == TOMOYO_PATH2_PARENT */
 686                         dput(dentry);
 687         }
 688 }
 689
 690 /**
 691  * tomoyo_condition - Check condition part.
 692  *
 693  * @r:    Pointer to "struct tomoyo_request_info".
 694  * @cond: Pointer to "struct tomoyo_condition". Maybe NULL.
 695  *
 696  * Returns true on success, false otherwise.
 697  *
 698  * Caller holds tomoyo_read_lock().
 699  */
 700 bool tomoyo_condition(struct tomoyo_request_info *r,
 701                       const struct tomoyo_condition *cond)
 702 {
 703         u32 i;
 704         unsigned long min_v[2] = { 0, 0 };
 705         unsigned long max_v[2] = { 0, 0 };
 706         const struct tomoyo_condition_element *condp;
 707         const struct tomoyo_number_union *numbers_p;
 708         const struct tomoyo_name_union *names_p;
 709         const struct tomoyo_argv *argv;
 710         const struct tomoyo_envp *envp;
 711         struct tomoyo_obj_info *obj;
 712         u16 condc;
 713         u16 argc;
 714         u16 envc;
 715         struct linux_binprm *bprm = NULL;
 716         if (!cond)
 717                 return true;
 718         condc = cond->condc;
 719         argc = cond->argc;
 720         envc = cond->envc;
 721         obj = r->obj;
 722         if (r->ee)
 723                 bprm = r->ee->bprm;
 724         if (!bprm && (argc || envc))
 725                 return false;
 726         condp = (struct tomoyo_condition_element *) (cond + 1);
 727         numbers_p = (const struct tomoyo_number_union *) (condp + condc);
 728         names_p = (const struct tomoyo_name_union *)
 729                 (numbers_p + cond->numbers_count);
 730         argv = (const struct tomoyo_argv *) (names_p + cond->names_count);
 731         envp = (const struct tomoyo_envp *) (argv + argc);
 732         for (i = 0; i < condc; i++) {
 733                 const bool match = condp->equals;
 734                 const u8 left = condp->left;
 735                 const u8 right = condp->right;
 736                 bool is_bitop[2] = { false, false };
 737                 u8 j;
 738                 condp++;
 739                 /* Check argv[] and envp[] later. */
 740                 if (left == TOMOYO_ARGV_ENTRY || left == TOMOYO_ENVP_ENTRY)
 741                         continue;
 742                 /* Check string expressions. */
 743                 if (right == TOMOYO_NAME_UNION) {
 744                         const struct tomoyo_name_union *ptr = names_p++;
 745                         switch (left) {
 746                                 struct tomoyo_path_info *symlink;
 747                                 struct tomoyo_execve *ee;
 748                                 struct file *file;
 749                         case TOMOYO_SYMLINK_TARGET:
 750                                 symlink = obj ? obj->symlink_target : NULL;
 751                                 if (!symlink ||
 752                                     !tomoyo_compare_name_union(symlink, ptr)
 753                                     == match)
 754                                         goto out;
 755                                 break;
 756                         case TOMOYO_EXEC_REALPATH:
 757                                 ee = r->ee;
 758                                 file = ee ? ee->bprm->file : NULL;
 759                                 if (!tomoyo_scan_exec_realpath(file, ptr,
 760                                                                match))
 761                                         goto out;
 762                                 break;
 763                         }
 764                         continue;
 765                 }
 766                 /* Check numeric or bit-op expressions. */
 767                 for (j = 0; j < 2; j++) {
 768                         const u8 index = j ? right : left;
 769                         unsigned long value = 0;
 770                         switch (index) {
 771                         case TOMOYO_TASK_UID:
 772                                 value = current_uid();
 773                                 break;
 774                         case TOMOYO_TASK_EUID:
 775                                 value = current_euid();
 776                                 break;
 777                         case TOMOYO_TASK_SUID:
 778                                 value = current_suid();
 779                                 break;
 780                         case TOMOYO_TASK_FSUID:
 781                                 value = current_fsuid();
 782                                 break;
 783                         case TOMOYO_TASK_GID:
 784                                 value = current_gid();
 785                                 break;
 786                         case TOMOYO_TASK_EGID:
 787                                 value = current_egid();
 788                                 break;
 789                         case TOMOYO_TASK_SGID:
 790                                 value = current_sgid();
 791                                 break;
 792                         case TOMOYO_TASK_FSGID:
 793                                 value = current_fsgid();
 794                                 break;
 795                         case TOMOYO_TASK_PID:
 796                                 value = tomoyo_sys_getpid();
 797                                 break;
 798                         case TOMOYO_TASK_PPID:
 799                                 value = tomoyo_sys_getppid();
 800                                 break;
 801                         case TOMOYO_TYPE_IS_SOCKET:
 802                                 value = S_IFSOCK;
 803                                 break;
 804                         case TOMOYO_TYPE_IS_SYMLINK:
 805                                 value = S_IFLNK;
 806                                 break;
 807                         case TOMOYO_TYPE_IS_FILE:
 808                                 value = S_IFREG;
 809                                 break;
 810                         case TOMOYO_TYPE_IS_BLOCK_DEV:
 811                                 value = S_IFBLK;
 812                                 break;
 813                         case TOMOYO_TYPE_IS_DIRECTORY:
 814                                 value = S_IFDIR;
 815                                 break;
 816                         case TOMOYO_TYPE_IS_CHAR_DEV:
 817                                 value = S_IFCHR;
 818                                 break;
 819                         case TOMOYO_TYPE_IS_FIFO:
 820                                 value = S_IFIFO;
 821                                 break;
 822                         case TOMOYO_MODE_SETUID:
 823                                 value = S_ISUID;
 824                                 break;
 825                         case TOMOYO_MODE_SETGID:
 826                                 value = S_ISGID;
 827                                 break;
 828                         case TOMOYO_MODE_STICKY:
 829                                 value = S_ISVTX;
 830                                 break;
 831                         case TOMOYO_MODE_OWNER_READ:
 832                                 value = S_IRUSR;
 833                                 break;
 834                         case TOMOYO_MODE_OWNER_WRITE:
 835                                 value = S_IWUSR;
 836                                 break;
 837                         case TOMOYO_MODE_OWNER_EXECUTE:
 838                                 value = S_IXUSR;
 839                                 break;
 840                         case TOMOYO_MODE_GROUP_READ:
 841                                 value = S_IRGRP;
 842                                 break;
 843                         case TOMOYO_MODE_GROUP_WRITE:
 844                                 value = S_IWGRP;
 845                                 break;
 846                         case TOMOYO_MODE_GROUP_EXECUTE:
 847                                 value = S_IXGRP;
 848                                 break;
 849                         case TOMOYO_MODE_OTHERS_READ:
 850                                 value = S_IROTH;
 851                                 break;
 852                         case TOMOYO_MODE_OTHERS_WRITE:
 853                                 value = S_IWOTH;
 854                                 break;
 855                         case TOMOYO_MODE_OTHERS_EXECUTE:
 856                                 value = S_IXOTH;
 857                                 break;
 858                         case TOMOYO_EXEC_ARGC:
 859                                 if (!bprm)
 860                                         goto out;
 861                                 value = bprm->argc;
 862                                 break;
 863                         case TOMOYO_EXEC_ENVC:
 864                                 if (!bprm)
 865                                         goto out;
 866                                 value = bprm->envc;
 867                                 break;
 868                         case TOMOYO_NUMBER_UNION:
 869                                 /* Fetch values later. */
 870                                 break;
 871                         default:
 872                                 if (!obj)
 873                                         goto out;
 874                                 if (!obj->validate_done) {
 875                                         tomoyo_get_attributes(obj);
 876                                         obj->validate_done = true;
 877                                 }
 878                                 {
 879                                         u8 stat_index;
 880                                         struct tomoyo_mini_stat *stat;
 881                                         switch (index) {
 882                                         case TOMOYO_PATH1_UID:
 883                                         case TOMOYO_PATH1_GID:
 884                                         case TOMOYO_PATH1_INO:
 885                                         case TOMOYO_PATH1_MAJOR:
 886                                         case TOMOYO_PATH1_MINOR:
 887                                         case TOMOYO_PATH1_TYPE:
 888                                         case TOMOYO_PATH1_DEV_MAJOR:
 889                                         case TOMOYO_PATH1_DEV_MINOR:
 890                                         case TOMOYO_PATH1_PERM:
 891                                                 stat_index = TOMOYO_PATH1;
 892                                                 break;
 893                                         case TOMOYO_PATH2_UID:
 894                                         case TOMOYO_PATH2_GID:
 895                                         case TOMOYO_PATH2_INO:
 896                                         case TOMOYO_PATH2_MAJOR:
 897                                         case TOMOYO_PATH2_MINOR:
 898                                         case TOMOYO_PATH2_TYPE:
 899                                         case TOMOYO_PATH2_DEV_MAJOR:
 900                                         case TOMOYO_PATH2_DEV_MINOR:
 901                                         case TOMOYO_PATH2_PERM:
 902                                                 stat_index = TOMOYO_PATH2;
 903                                                 break;
 904                                         case TOMOYO_PATH1_PARENT_UID:
 905                                         case TOMOYO_PATH1_PARENT_GID:
 906                                         case TOMOYO_PATH1_PARENT_INO:
 907                                         case TOMOYO_PATH1_PARENT_PERM:
 908                                                 stat_index =
 909                                                         TOMOYO_PATH1_PARENT;
 910                                                 break;
 911                                         case TOMOYO_PATH2_PARENT_UID:
 912                                         case TOMOYO_PATH2_PARENT_GID:
 913                                         case TOMOYO_PATH2_PARENT_INO:
 914                                         case TOMOYO_PATH2_PARENT_PERM:
 915                                                 stat_index =
 916                                                         TOMOYO_PATH2_PARENT;
 917                                                 break;
 918                                         default:
 919                                                 goto out;
 920                                         }
 921                                         if (!obj->stat_valid[stat_index])
 922                                                 goto out;
 923                                         stat = &obj->stat[stat_index];
 924                                         switch (index) {
 925                                         case TOMOYO_PATH1_UID:
 926                                         case TOMOYO_PATH2_UID:
 927                                         case TOMOYO_PATH1_PARENT_UID:
 928                                         case TOMOYO_PATH2_PARENT_UID:
 929                                                 value = stat->uid;
 930                                                 break;
 931                                         case TOMOYO_PATH1_GID:
 932                                         case TOMOYO_PATH2_GID:
 933                                         case TOMOYO_PATH1_PARENT_GID:
 934                                         case TOMOYO_PATH2_PARENT_GID:
 935                                                 value = stat->gid;
 936                                                 break;
 937                                         case TOMOYO_PATH1_INO:
 938                                         case TOMOYO_PATH2_INO:
 939                                         case TOMOYO_PATH1_PARENT_INO:
 940                                         case TOMOYO_PATH2_PARENT_INO:
 941                                                 value = stat->ino;
 942                                                 break;
 943                                         case TOMOYO_PATH1_MAJOR:
 944                                         case TOMOYO_PATH2_MAJOR:
 945                                                 value = MAJOR(stat->dev);
 946                                                 break;
 947                                         case TOMOYO_PATH1_MINOR:
 948                                         case TOMOYO_PATH2_MINOR:
 949                                                 value = MINOR(stat->dev);
 950                                                 break;
 951                                         case TOMOYO_PATH1_TYPE:
 952                                         case TOMOYO_PATH2_TYPE:
 953                                                 value = stat->mode & S_IFMT;
 954                                                 break;
 955                                         case TOMOYO_PATH1_DEV_MAJOR:
 956                                         case TOMOYO_PATH2_DEV_MAJOR:
 957                                                 value = MAJOR(stat->rdev);
 958                                                 break;
 959                                         case TOMOYO_PATH1_DEV_MINOR:
 960                                         case TOMOYO_PATH2_DEV_MINOR:
 961                                                 value = MINOR(stat->rdev);
 962                                                 break;
 963                                         case TOMOYO_PATH1_PERM:
 964                                         case TOMOYO_PATH2_PERM:
 965                                         case TOMOYO_PATH1_PARENT_PERM:
 966                                         case TOMOYO_PATH2_PARENT_PERM:
 967                                                 value = stat->mode & S_IALLUGO;
 968                                                 break;
 969                                         }
 970                                 }
 971                                 break;
 972                         }
 973                         max_v[j] = value;
 974                         min_v[j] = value;
 975                         switch (index) {
 976                         case TOMOYO_MODE_SETUID:
 977                         case TOMOYO_MODE_SETGID:
 978                         case TOMOYO_MODE_STICKY:
 979                         case TOMOYO_MODE_OWNER_READ:
 980                         case TOMOYO_MODE_OWNER_WRITE:
 981                         case TOMOYO_MODE_OWNER_EXECUTE:
 982                         case TOMOYO_MODE_GROUP_READ:
 983                         case TOMOYO_MODE_GROUP_WRITE:
 984                         case TOMOYO_MODE_GROUP_EXECUTE:
 985                         case TOMOYO_MODE_OTHERS_READ:
 986                         case TOMOYO_MODE_OTHERS_WRITE:
 987                         case TOMOYO_MODE_OTHERS_EXECUTE:
 988                                 is_bitop[j] = true;
 989                         }
 990                 }
 991                 if (left == TOMOYO_NUMBER_UNION) {
 992                         /* Fetch values now. */
 993                         const struct tomoyo_number_union *ptr = numbers_p++;
 994                         min_v[0] = ptr->values[0];
 995                         max_v[0] = ptr->values[1];
 996                 }
 997                 if (right == TOMOYO_NUMBER_UNION) {
 998                         /* Fetch values now. */
 999                         const struct tomoyo_number_union *ptr = numbers_p++;
1000                         if (ptr->group) {
1001                                 if (tomoyo_number_matches_group(min_v[0],
1002                                                                 max_v[0],
1003                                                                 ptr->group)
1004                                     == match)
1005                                         continue;
1006                         } else {
1007                                 if ((min_v[0] <= ptr->values[1] &&
1008                                      max_v[0] >= ptr->values[0]) == match)
1009                                         continue;
1010                         }
1011                         goto out;
1012                 }
1013                 /*
1014                  * Bit operation is valid only when counterpart value
1015                  * represents permission.
1016                  */
1017                 if (is_bitop[0] && is_bitop[1]) {
1018                         goto out;
1019                 } else if (is_bitop[0]) {
1020                         switch (right) {
1021                         case TOMOYO_PATH1_PERM:
1022                         case TOMOYO_PATH1_PARENT_PERM:
1023                         case TOMOYO_PATH2_PERM:
1024                         case TOMOYO_PATH2_PARENT_PERM:
1025                                 if (!(max_v[0] & max_v[1]) == !match)
1026                                         continue;
1027                         }
1028                         goto out;
1029                 } else if (is_bitop[1]) {
1030                         switch (left) {
1031                         case TOMOYO_PATH1_PERM:
1032                         case TOMOYO_PATH1_PARENT_PERM:
1033                         case TOMOYO_PATH2_PERM:
1034                         case TOMOYO_PATH2_PARENT_PERM:
1035                                 if (!(max_v[0] & max_v[1]) == !match)
1036                                         continue;
1037                         }
1038                         goto out;
1039                 }
1040                 /* Normal value range comparison. */
1041                 if ((min_v[0] <= max_v[1] && max_v[0] >= min_v[1]) == match)
1042                         continue;
1043 out:
1044                 return false;
1045         }
1046         /* Check argv[] and envp[] now. */
1047         if (r->ee && (argc || envc))
1048                 return tomoyo_scan_bprm(r->ee, argc, argv, envc, envp);
1049         return true;
1050 }