security/tomoyo: Remove now unnecessary handling of security_sysctl.
[linux-2.6.git] / security / tomoyo / file.c
1 /*
2  * security/tomoyo/file.c
3  *
4  * Implementation of the Domain-Based Mandatory Access Control.
5  *
6  * Copyright (C) 2005-2009  NTT DATA CORPORATION
7  *
8  * Version: 2.2.0   2009/04/01
9  *
10  */
11
12 #include "common.h"
13 #include "tomoyo.h"
14 #include "realpath.h"
15 #define ACC_MODE(x) ("\000\004\002\006"[(x)&O_ACCMODE])
16
17 /*
18  * tomoyo_globally_readable_file_entry is a structure which is used for holding
19  * "allow_read" entries.
20  * It has following fields.
21  *
22  *  (1) "list" which is linked to tomoyo_globally_readable_list .
23  *  (2) "filename" is a pathname which is allowed to open(O_RDONLY).
24  *  (3) "is_deleted" is a bool which is true if marked as deleted, false
25  *      otherwise.
26  */
27 struct tomoyo_globally_readable_file_entry {
28         struct list_head list;
29         const struct tomoyo_path_info *filename;
30         bool is_deleted;
31 };
32
33 /*
34  * tomoyo_pattern_entry is a structure which is used for holding
35  * "tomoyo_pattern_list" entries.
36  * It has following fields.
37  *
38  *  (1) "list" which is linked to tomoyo_pattern_list .
39  *  (2) "pattern" is a pathname pattern which is used for converting pathnames
40  *      to pathname patterns during learning mode.
41  *  (3) "is_deleted" is a bool which is true if marked as deleted, false
42  *      otherwise.
43  */
44 struct tomoyo_pattern_entry {
45         struct list_head list;
46         const struct tomoyo_path_info *pattern;
47         bool is_deleted;
48 };
49
50 /*
51  * tomoyo_no_rewrite_entry is a structure which is used for holding
52  * "deny_rewrite" entries.
53  * It has following fields.
54  *
55  *  (1) "list" which is linked to tomoyo_no_rewrite_list .
56  *  (2) "pattern" is a pathname which is by default not permitted to modify
57  *      already existing content.
58  *  (3) "is_deleted" is a bool which is true if marked as deleted, false
59  *      otherwise.
60  */
61 struct tomoyo_no_rewrite_entry {
62         struct list_head list;
63         const struct tomoyo_path_info *pattern;
64         bool is_deleted;
65 };
66
67 /* Keyword array for single path operations. */
68 static const char *tomoyo_sp_keyword[TOMOYO_MAX_SINGLE_PATH_OPERATION] = {
69         [TOMOYO_TYPE_READ_WRITE_ACL] = "read/write",
70         [TOMOYO_TYPE_EXECUTE_ACL]    = "execute",
71         [TOMOYO_TYPE_READ_ACL]       = "read",
72         [TOMOYO_TYPE_WRITE_ACL]      = "write",
73         [TOMOYO_TYPE_CREATE_ACL]     = "create",
74         [TOMOYO_TYPE_UNLINK_ACL]     = "unlink",
75         [TOMOYO_TYPE_MKDIR_ACL]      = "mkdir",
76         [TOMOYO_TYPE_RMDIR_ACL]      = "rmdir",
77         [TOMOYO_TYPE_MKFIFO_ACL]     = "mkfifo",
78         [TOMOYO_TYPE_MKSOCK_ACL]     = "mksock",
79         [TOMOYO_TYPE_MKBLOCK_ACL]    = "mkblock",
80         [TOMOYO_TYPE_MKCHAR_ACL]     = "mkchar",
81         [TOMOYO_TYPE_TRUNCATE_ACL]   = "truncate",
82         [TOMOYO_TYPE_SYMLINK_ACL]    = "symlink",
83         [TOMOYO_TYPE_REWRITE_ACL]    = "rewrite",
84 };
85
86 /* Keyword array for double path operations. */
87 static const char *tomoyo_dp_keyword[TOMOYO_MAX_DOUBLE_PATH_OPERATION] = {
88         [TOMOYO_TYPE_LINK_ACL]    = "link",
89         [TOMOYO_TYPE_RENAME_ACL]  = "rename",
90 };
91
92 /**
93  * tomoyo_sp2keyword - Get the name of single path operation.
94  *
95  * @operation: Type of operation.
96  *
97  * Returns the name of single path operation.
98  */
99 const char *tomoyo_sp2keyword(const u8 operation)
100 {
101         return (operation < TOMOYO_MAX_SINGLE_PATH_OPERATION)
102                 ? tomoyo_sp_keyword[operation] : NULL;
103 }
104
105 /**
106  * tomoyo_dp2keyword - Get the name of double path operation.
107  *
108  * @operation: Type of operation.
109  *
110  * Returns the name of double path operation.
111  */
112 const char *tomoyo_dp2keyword(const u8 operation)
113 {
114         return (operation < TOMOYO_MAX_DOUBLE_PATH_OPERATION)
115                 ? tomoyo_dp_keyword[operation] : NULL;
116 }
117
118 /**
119  * tomoyo_strendswith - Check whether the token ends with the given token.
120  *
121  * @name: The token to check.
122  * @tail: The token to find.
123  *
124  * Returns true if @name ends with @tail, false otherwise.
125  */
126 static bool tomoyo_strendswith(const char *name, const char *tail)
127 {
128         int len;
129
130         if (!name || !tail)
131                 return false;
132         len = strlen(name) - strlen(tail);
133         return len >= 0 && !strcmp(name + len, tail);
134 }
135
136 /**
137  * tomoyo_get_path - Get realpath.
138  *
139  * @path: Pointer to "struct path".
140  *
141  * Returns pointer to "struct tomoyo_path_info" on success, NULL otherwise.
142  */
143 static struct tomoyo_path_info *tomoyo_get_path(struct path *path)
144 {
145         int error;
146         struct tomoyo_path_info_with_data *buf = tomoyo_alloc(sizeof(*buf));
147
148         if (!buf)
149                 return NULL;
150         /* Reserve one byte for appending "/". */
151         error = tomoyo_realpath_from_path2(path, buf->body,
152                                            sizeof(buf->body) - 2);
153         if (!error) {
154                 buf->head.name = buf->body;
155                 tomoyo_fill_path_info(&buf->head);
156                 return &buf->head;
157         }
158         tomoyo_free(buf);
159         return NULL;
160 }
161
162 /* Lock for domain->acl_info_list. */
163 DECLARE_RWSEM(tomoyo_domain_acl_info_list_lock);
164
165 static int tomoyo_update_double_path_acl(const u8 type, const char *filename1,
166                                          const char *filename2,
167                                          struct tomoyo_domain_info *
168                                          const domain, const bool is_delete);
169 static int tomoyo_update_single_path_acl(const u8 type, const char *filename,
170                                          struct tomoyo_domain_info *
171                                          const domain, const bool is_delete);
172
173 /*
174  * tomoyo_globally_readable_list is used for holding list of pathnames which
175  * are by default allowed to be open()ed for reading by any process.
176  *
177  * An entry is added by
178  *
179  * # echo 'allow_read /lib/libc-2.5.so' > \
180  *                               /sys/kernel/security/tomoyo/exception_policy
181  *
182  * and is deleted by
183  *
184  * # echo 'delete allow_read /lib/libc-2.5.so' > \
185  *                               /sys/kernel/security/tomoyo/exception_policy
186  *
187  * and all entries are retrieved by
188  *
189  * # grep ^allow_read /sys/kernel/security/tomoyo/exception_policy
190  *
191  * In the example above, any process is allowed to
192  * open("/lib/libc-2.5.so", O_RDONLY).
193  * One exception is, if the domain which current process belongs to is marked
194  * as "ignore_global_allow_read", current process can't do so unless explicitly
195  * given "allow_read /lib/libc-2.5.so" to the domain which current process
196  * belongs to.
197  */
198 static LIST_HEAD(tomoyo_globally_readable_list);
199 static DECLARE_RWSEM(tomoyo_globally_readable_list_lock);
200
201 /**
202  * tomoyo_update_globally_readable_entry - Update "struct tomoyo_globally_readable_file_entry" list.
203  *
204  * @filename:  Filename unconditionally permitted to open() for reading.
205  * @is_delete: True if it is a delete request.
206  *
207  * Returns 0 on success, negative value otherwise.
208  */
209 static int tomoyo_update_globally_readable_entry(const char *filename,
210                                                  const bool is_delete)
211 {
212         struct tomoyo_globally_readable_file_entry *new_entry;
213         struct tomoyo_globally_readable_file_entry *ptr;
214         const struct tomoyo_path_info *saved_filename;
215         int error = -ENOMEM;
216
217         if (!tomoyo_is_correct_path(filename, 1, 0, -1, __func__))
218                 return -EINVAL;
219         saved_filename = tomoyo_save_name(filename);
220         if (!saved_filename)
221                 return -ENOMEM;
222         down_write(&tomoyo_globally_readable_list_lock);
223         list_for_each_entry(ptr, &tomoyo_globally_readable_list, list) {
224                 if (ptr->filename != saved_filename)
225                         continue;
226                 ptr->is_deleted = is_delete;
227                 error = 0;
228                 goto out;
229         }
230         if (is_delete) {
231                 error = -ENOENT;
232                 goto out;
233         }
234         new_entry = tomoyo_alloc_element(sizeof(*new_entry));
235         if (!new_entry)
236                 goto out;
237         new_entry->filename = saved_filename;
238         list_add_tail(&new_entry->list, &tomoyo_globally_readable_list);
239         error = 0;
240  out:
241         up_write(&tomoyo_globally_readable_list_lock);
242         return error;
243 }
244
245 /**
246  * tomoyo_is_globally_readable_file - Check if the file is unconditionnaly permitted to be open()ed for reading.
247  *
248  * @filename: The filename to check.
249  *
250  * Returns true if any domain can open @filename for reading, false otherwise.
251  */
252 static bool tomoyo_is_globally_readable_file(const struct tomoyo_path_info *
253                                              filename)
254 {
255         struct tomoyo_globally_readable_file_entry *ptr;
256         bool found = false;
257         down_read(&tomoyo_globally_readable_list_lock);
258         list_for_each_entry(ptr, &tomoyo_globally_readable_list, list) {
259                 if (!ptr->is_deleted &&
260                     tomoyo_path_matches_pattern(filename, ptr->filename)) {
261                         found = true;
262                         break;
263                 }
264         }
265         up_read(&tomoyo_globally_readable_list_lock);
266         return found;
267 }
268
269 /**
270  * tomoyo_write_globally_readable_policy - Write "struct tomoyo_globally_readable_file_entry" list.
271  *
272  * @data:      String to parse.
273  * @is_delete: True if it is a delete request.
274  *
275  * Returns 0 on success, negative value otherwise.
276  */
277 int tomoyo_write_globally_readable_policy(char *data, const bool is_delete)
278 {
279         return tomoyo_update_globally_readable_entry(data, is_delete);
280 }
281
282 /**
283  * tomoyo_read_globally_readable_policy - Read "struct tomoyo_globally_readable_file_entry" list.
284  *
285  * @head: Pointer to "struct tomoyo_io_buffer".
286  *
287  * Returns true on success, false otherwise.
288  */
289 bool tomoyo_read_globally_readable_policy(struct tomoyo_io_buffer *head)
290 {
291         struct list_head *pos;
292         bool done = true;
293
294         down_read(&tomoyo_globally_readable_list_lock);
295         list_for_each_cookie(pos, head->read_var2,
296                              &tomoyo_globally_readable_list) {
297                 struct tomoyo_globally_readable_file_entry *ptr;
298                 ptr = list_entry(pos,
299                                  struct tomoyo_globally_readable_file_entry,
300                                  list);
301                 if (ptr->is_deleted)
302                         continue;
303                 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_ALLOW_READ "%s\n",
304                                         ptr->filename->name);
305                 if (!done)
306                         break;
307         }
308         up_read(&tomoyo_globally_readable_list_lock);
309         return done;
310 }
311
312 /* tomoyo_pattern_list is used for holding list of pathnames which are used for
313  * converting pathnames to pathname patterns during learning mode.
314  *
315  * An entry is added by
316  *
317  * # echo 'file_pattern /proc/\$/mounts' > \
318  *                             /sys/kernel/security/tomoyo/exception_policy
319  *
320  * and is deleted by
321  *
322  * # echo 'delete file_pattern /proc/\$/mounts' > \
323  *                             /sys/kernel/security/tomoyo/exception_policy
324  *
325  * and all entries are retrieved by
326  *
327  * # grep ^file_pattern /sys/kernel/security/tomoyo/exception_policy
328  *
329  * In the example above, if a process which belongs to a domain which is in
330  * learning mode requested open("/proc/1/mounts", O_RDONLY),
331  * "allow_read /proc/\$/mounts" is automatically added to the domain which that
332  * process belongs to.
333  *
334  * It is not a desirable behavior that we have to use /proc/\$/ instead of
335  * /proc/self/ when current process needs to access only current process's
336  * information. As of now, LSM version of TOMOYO is using __d_path() for
337  * calculating pathname. Non LSM version of TOMOYO is using its own function
338  * which pretends as if /proc/self/ is not a symlink; so that we can forbid
339  * current process from accessing other process's information.
340  */
341 static LIST_HEAD(tomoyo_pattern_list);
342 static DECLARE_RWSEM(tomoyo_pattern_list_lock);
343
344 /**
345  * tomoyo_update_file_pattern_entry - Update "struct tomoyo_pattern_entry" list.
346  *
347  * @pattern:   Pathname pattern.
348  * @is_delete: True if it is a delete request.
349  *
350  * Returns 0 on success, negative value otherwise.
351  */
352 static int tomoyo_update_file_pattern_entry(const char *pattern,
353                                             const bool is_delete)
354 {
355         struct tomoyo_pattern_entry *new_entry;
356         struct tomoyo_pattern_entry *ptr;
357         const struct tomoyo_path_info *saved_pattern;
358         int error = -ENOMEM;
359
360         if (!tomoyo_is_correct_path(pattern, 0, 1, 0, __func__))
361                 return -EINVAL;
362         saved_pattern = tomoyo_save_name(pattern);
363         if (!saved_pattern)
364                 return -ENOMEM;
365         down_write(&tomoyo_pattern_list_lock);
366         list_for_each_entry(ptr, &tomoyo_pattern_list, list) {
367                 if (saved_pattern != ptr->pattern)
368                         continue;
369                 ptr->is_deleted = is_delete;
370                 error = 0;
371                 goto out;
372         }
373         if (is_delete) {
374                 error = -ENOENT;
375                 goto out;
376         }
377         new_entry = tomoyo_alloc_element(sizeof(*new_entry));
378         if (!new_entry)
379                 goto out;
380         new_entry->pattern = saved_pattern;
381         list_add_tail(&new_entry->list, &tomoyo_pattern_list);
382         error = 0;
383  out:
384         up_write(&tomoyo_pattern_list_lock);
385         return error;
386 }
387
388 /**
389  * tomoyo_get_file_pattern - Get patterned pathname.
390  *
391  * @filename: The filename to find patterned pathname.
392  *
393  * Returns pointer to pathname pattern if matched, @filename otherwise.
394  */
395 static const struct tomoyo_path_info *
396 tomoyo_get_file_pattern(const struct tomoyo_path_info *filename)
397 {
398         struct tomoyo_pattern_entry *ptr;
399         const struct tomoyo_path_info *pattern = NULL;
400
401         down_read(&tomoyo_pattern_list_lock);
402         list_for_each_entry(ptr, &tomoyo_pattern_list, list) {
403                 if (ptr->is_deleted)
404                         continue;
405                 if (!tomoyo_path_matches_pattern(filename, ptr->pattern))
406                         continue;
407                 pattern = ptr->pattern;
408                 if (tomoyo_strendswith(pattern->name, "/\\*")) {
409                         /* Do nothing. Try to find the better match. */
410                 } else {
411                         /* This would be the better match. Use this. */
412                         break;
413                 }
414         }
415         up_read(&tomoyo_pattern_list_lock);
416         if (pattern)
417                 filename = pattern;
418         return filename;
419 }
420
421 /**
422  * tomoyo_write_pattern_policy - Write "struct tomoyo_pattern_entry" list.
423  *
424  * @data:      String to parse.
425  * @is_delete: True if it is a delete request.
426  *
427  * Returns 0 on success, negative value otherwise.
428  */
429 int tomoyo_write_pattern_policy(char *data, const bool is_delete)
430 {
431         return tomoyo_update_file_pattern_entry(data, is_delete);
432 }
433
434 /**
435  * tomoyo_read_file_pattern - Read "struct tomoyo_pattern_entry" list.
436  *
437  * @head: Pointer to "struct tomoyo_io_buffer".
438  *
439  * Returns true on success, false otherwise.
440  */
441 bool tomoyo_read_file_pattern(struct tomoyo_io_buffer *head)
442 {
443         struct list_head *pos;
444         bool done = true;
445
446         down_read(&tomoyo_pattern_list_lock);
447         list_for_each_cookie(pos, head->read_var2, &tomoyo_pattern_list) {
448                 struct tomoyo_pattern_entry *ptr;
449                 ptr = list_entry(pos, struct tomoyo_pattern_entry, list);
450                 if (ptr->is_deleted)
451                         continue;
452                 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_FILE_PATTERN
453                                         "%s\n", ptr->pattern->name);
454                 if (!done)
455                         break;
456         }
457         up_read(&tomoyo_pattern_list_lock);
458         return done;
459 }
460
461 /*
462  * tomoyo_no_rewrite_list is used for holding list of pathnames which are by
463  * default forbidden to modify already written content of a file.
464  *
465  * An entry is added by
466  *
467  * # echo 'deny_rewrite /var/log/messages' > \
468  *                              /sys/kernel/security/tomoyo/exception_policy
469  *
470  * and is deleted by
471  *
472  * # echo 'delete deny_rewrite /var/log/messages' > \
473  *                              /sys/kernel/security/tomoyo/exception_policy
474  *
475  * and all entries are retrieved by
476  *
477  * # grep ^deny_rewrite /sys/kernel/security/tomoyo/exception_policy
478  *
479  * In the example above, if a process requested to rewrite /var/log/messages ,
480  * the process can't rewrite unless the domain which that process belongs to
481  * has "allow_rewrite /var/log/messages" entry.
482  *
483  * It is not a desirable behavior that we have to add "\040(deleted)" suffix
484  * when we want to allow rewriting already unlink()ed file. As of now,
485  * LSM version of TOMOYO is using __d_path() for calculating pathname.
486  * Non LSM version of TOMOYO is using its own function which doesn't append
487  * " (deleted)" suffix if the file is already unlink()ed; so that we don't
488  * need to worry whether the file is already unlink()ed or not.
489  */
490 static LIST_HEAD(tomoyo_no_rewrite_list);
491 static DECLARE_RWSEM(tomoyo_no_rewrite_list_lock);
492
493 /**
494  * tomoyo_update_no_rewrite_entry - Update "struct tomoyo_no_rewrite_entry" list.
495  *
496  * @pattern:   Pathname pattern that are not rewritable by default.
497  * @is_delete: True if it is a delete request.
498  *
499  * Returns 0 on success, negative value otherwise.
500  */
501 static int tomoyo_update_no_rewrite_entry(const char *pattern,
502                                           const bool is_delete)
503 {
504         struct tomoyo_no_rewrite_entry *new_entry, *ptr;
505         const struct tomoyo_path_info *saved_pattern;
506         int error = -ENOMEM;
507
508         if (!tomoyo_is_correct_path(pattern, 0, 0, 0, __func__))
509                 return -EINVAL;
510         saved_pattern = tomoyo_save_name(pattern);
511         if (!saved_pattern)
512                 return -ENOMEM;
513         down_write(&tomoyo_no_rewrite_list_lock);
514         list_for_each_entry(ptr, &tomoyo_no_rewrite_list, list) {
515                 if (ptr->pattern != saved_pattern)
516                         continue;
517                 ptr->is_deleted = is_delete;
518                 error = 0;
519                 goto out;
520         }
521         if (is_delete) {
522                 error = -ENOENT;
523                 goto out;
524         }
525         new_entry = tomoyo_alloc_element(sizeof(*new_entry));
526         if (!new_entry)
527                 goto out;
528         new_entry->pattern = saved_pattern;
529         list_add_tail(&new_entry->list, &tomoyo_no_rewrite_list);
530         error = 0;
531  out:
532         up_write(&tomoyo_no_rewrite_list_lock);
533         return error;
534 }
535
536 /**
537  * tomoyo_is_no_rewrite_file - Check if the given pathname is not permitted to be rewrited.
538  *
539  * @filename: Filename to check.
540  *
541  * Returns true if @filename is specified by "deny_rewrite" directive,
542  * false otherwise.
543  */
544 static bool tomoyo_is_no_rewrite_file(const struct tomoyo_path_info *filename)
545 {
546         struct tomoyo_no_rewrite_entry *ptr;
547         bool found = false;
548
549         down_read(&tomoyo_no_rewrite_list_lock);
550         list_for_each_entry(ptr, &tomoyo_no_rewrite_list, list) {
551                 if (ptr->is_deleted)
552                         continue;
553                 if (!tomoyo_path_matches_pattern(filename, ptr->pattern))
554                         continue;
555                 found = true;
556                 break;
557         }
558         up_read(&tomoyo_no_rewrite_list_lock);
559         return found;
560 }
561
562 /**
563  * tomoyo_write_no_rewrite_policy - Write "struct tomoyo_no_rewrite_entry" list.
564  *
565  * @data:      String to parse.
566  * @is_delete: True if it is a delete request.
567  *
568  * Returns 0 on success, negative value otherwise.
569  */
570 int tomoyo_write_no_rewrite_policy(char *data, const bool is_delete)
571 {
572         return tomoyo_update_no_rewrite_entry(data, is_delete);
573 }
574
575 /**
576  * tomoyo_read_no_rewrite_policy - Read "struct tomoyo_no_rewrite_entry" list.
577  *
578  * @head: Pointer to "struct tomoyo_io_buffer".
579  *
580  * Returns true on success, false otherwise.
581  */
582 bool tomoyo_read_no_rewrite_policy(struct tomoyo_io_buffer *head)
583 {
584         struct list_head *pos;
585         bool done = true;
586
587         down_read(&tomoyo_no_rewrite_list_lock);
588         list_for_each_cookie(pos, head->read_var2, &tomoyo_no_rewrite_list) {
589                 struct tomoyo_no_rewrite_entry *ptr;
590                 ptr = list_entry(pos, struct tomoyo_no_rewrite_entry, list);
591                 if (ptr->is_deleted)
592                         continue;
593                 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_DENY_REWRITE
594                                         "%s\n", ptr->pattern->name);
595                 if (!done)
596                         break;
597         }
598         up_read(&tomoyo_no_rewrite_list_lock);
599         return done;
600 }
601
602 /**
603  * tomoyo_update_file_acl - Update file's read/write/execute ACL.
604  *
605  * @filename:  Filename.
606  * @perm:      Permission (between 1 to 7).
607  * @domain:    Pointer to "struct tomoyo_domain_info".
608  * @is_delete: True if it is a delete request.
609  *
610  * Returns 0 on success, negative value otherwise.
611  *
612  * This is legacy support interface for older policy syntax.
613  * Current policy syntax uses "allow_read/write" instead of "6",
614  * "allow_read" instead of "4", "allow_write" instead of "2",
615  * "allow_execute" instead of "1".
616  */
617 static int tomoyo_update_file_acl(const char *filename, u8 perm,
618                                   struct tomoyo_domain_info * const domain,
619                                   const bool is_delete)
620 {
621         if (perm > 7 || !perm) {
622                 printk(KERN_DEBUG "%s: Invalid permission '%d %s'\n",
623                        __func__, perm, filename);
624                 return -EINVAL;
625         }
626         if (filename[0] != '@' && tomoyo_strendswith(filename, "/"))
627                 /*
628                  * Only 'allow_mkdir' and 'allow_rmdir' are valid for
629                  * directory permissions.
630                  */
631                 return 0;
632         if (perm & 4)
633                 tomoyo_update_single_path_acl(TOMOYO_TYPE_READ_ACL, filename,
634                                               domain, is_delete);
635         if (perm & 2)
636                 tomoyo_update_single_path_acl(TOMOYO_TYPE_WRITE_ACL, filename,
637                                               domain, is_delete);
638         if (perm & 1)
639                 tomoyo_update_single_path_acl(TOMOYO_TYPE_EXECUTE_ACL,
640                                               filename, domain, is_delete);
641         return 0;
642 }
643
644 /**
645  * tomoyo_check_single_path_acl2 - Check permission for single path operation.
646  *
647  * @domain:          Pointer to "struct tomoyo_domain_info".
648  * @filename:        Filename to check.
649  * @perm:            Permission.
650  * @may_use_pattern: True if patterned ACL is permitted.
651  *
652  * Returns 0 on success, -EPERM otherwise.
653  */
654 static int tomoyo_check_single_path_acl2(const struct tomoyo_domain_info *
655                                          domain,
656                                          const struct tomoyo_path_info *
657                                          filename,
658                                          const u16 perm,
659                                          const bool may_use_pattern)
660 {
661         struct tomoyo_acl_info *ptr;
662         int error = -EPERM;
663
664         down_read(&tomoyo_domain_acl_info_list_lock);
665         list_for_each_entry(ptr, &domain->acl_info_list, list) {
666                 struct tomoyo_single_path_acl_record *acl;
667                 if (tomoyo_acl_type2(ptr) != TOMOYO_TYPE_SINGLE_PATH_ACL)
668                         continue;
669                 acl = container_of(ptr, struct tomoyo_single_path_acl_record,
670                                    head);
671                 if (!(acl->perm & perm))
672                         continue;
673                 if (may_use_pattern || !acl->filename->is_patterned) {
674                         if (!tomoyo_path_matches_pattern(filename,
675                                                          acl->filename))
676                                 continue;
677                 } else {
678                         continue;
679                 }
680                 error = 0;
681                 break;
682         }
683         up_read(&tomoyo_domain_acl_info_list_lock);
684         return error;
685 }
686
687 /**
688  * tomoyo_check_file_acl - Check permission for opening files.
689  *
690  * @domain:    Pointer to "struct tomoyo_domain_info".
691  * @filename:  Filename to check.
692  * @operation: Mode ("read" or "write" or "read/write" or "execute").
693  *
694  * Returns 0 on success, -EPERM otherwise.
695  */
696 static int tomoyo_check_file_acl(const struct tomoyo_domain_info *domain,
697                                  const struct tomoyo_path_info *filename,
698                                  const u8 operation)
699 {
700         u16 perm = 0;
701
702         if (!tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE))
703                 return 0;
704         if (operation == 6)
705                 perm = 1 << TOMOYO_TYPE_READ_WRITE_ACL;
706         else if (operation == 4)
707                 perm = 1 << TOMOYO_TYPE_READ_ACL;
708         else if (operation == 2)
709                 perm = 1 << TOMOYO_TYPE_WRITE_ACL;
710         else if (operation == 1)
711                 perm = 1 << TOMOYO_TYPE_EXECUTE_ACL;
712         else
713                 BUG();
714         return tomoyo_check_single_path_acl2(domain, filename, perm,
715                                              operation != 1);
716 }
717
718 /**
719  * tomoyo_check_file_perm2 - Check permission for opening files.
720  *
721  * @domain:    Pointer to "struct tomoyo_domain_info".
722  * @filename:  Filename to check.
723  * @perm:      Mode ("read" or "write" or "read/write" or "execute").
724  * @operation: Operation name passed used for verbose mode.
725  * @mode:      Access control mode.
726  *
727  * Returns 0 on success, negative value otherwise.
728  */
729 static int tomoyo_check_file_perm2(struct tomoyo_domain_info * const domain,
730                                    const struct tomoyo_path_info *filename,
731                                    const u8 perm, const char *operation,
732                                    const u8 mode)
733 {
734         const bool is_enforce = (mode == 3);
735         const char *msg = "<unknown>";
736         int error = 0;
737
738         if (!filename)
739                 return 0;
740         error = tomoyo_check_file_acl(domain, filename, perm);
741         if (error && perm == 4 &&
742             (domain->flags & TOMOYO_DOMAIN_FLAGS_IGNORE_GLOBAL_ALLOW_READ) == 0
743             && tomoyo_is_globally_readable_file(filename))
744                 error = 0;
745         if (perm == 6)
746                 msg = tomoyo_sp2keyword(TOMOYO_TYPE_READ_WRITE_ACL);
747         else if (perm == 4)
748                 msg = tomoyo_sp2keyword(TOMOYO_TYPE_READ_ACL);
749         else if (perm == 2)
750                 msg = tomoyo_sp2keyword(TOMOYO_TYPE_WRITE_ACL);
751         else if (perm == 1)
752                 msg = tomoyo_sp2keyword(TOMOYO_TYPE_EXECUTE_ACL);
753         else
754                 BUG();
755         if (!error)
756                 return 0;
757         if (tomoyo_verbose_mode(domain))
758                 printk(KERN_WARNING "TOMOYO-%s: Access '%s(%s) %s' denied "
759                        "for %s\n", tomoyo_get_msg(is_enforce), msg, operation,
760                        filename->name, tomoyo_get_last_name(domain));
761         if (is_enforce)
762                 return error;
763         if (mode == 1 && tomoyo_domain_quota_is_ok(domain)) {
764                 /* Don't use patterns for execute permission. */
765                 const struct tomoyo_path_info *patterned_file = (perm != 1) ?
766                         tomoyo_get_file_pattern(filename) : filename;
767                 tomoyo_update_file_acl(patterned_file->name, perm,
768                                        domain, false);
769         }
770         return 0;
771 }
772
773 /**
774  * tomoyo_write_file_policy - Update file related list.
775  *
776  * @data:      String to parse.
777  * @domain:    Pointer to "struct tomoyo_domain_info".
778  * @is_delete: True if it is a delete request.
779  *
780  * Returns 0 on success, negative value otherwise.
781  */
782 int tomoyo_write_file_policy(char *data, struct tomoyo_domain_info *domain,
783                              const bool is_delete)
784 {
785         char *filename = strchr(data, ' ');
786         char *filename2;
787         unsigned int perm;
788         u8 type;
789
790         if (!filename)
791                 return -EINVAL;
792         *filename++ = '\0';
793         if (sscanf(data, "%u", &perm) == 1)
794                 return tomoyo_update_file_acl(filename, (u8) perm, domain,
795                                               is_delete);
796         if (strncmp(data, "allow_", 6))
797                 goto out;
798         data += 6;
799         for (type = 0; type < TOMOYO_MAX_SINGLE_PATH_OPERATION; type++) {
800                 if (strcmp(data, tomoyo_sp_keyword[type]))
801                         continue;
802                 return tomoyo_update_single_path_acl(type, filename,
803                                                      domain, is_delete);
804         }
805         filename2 = strchr(filename, ' ');
806         if (!filename2)
807                 goto out;
808         *filename2++ = '\0';
809         for (type = 0; type < TOMOYO_MAX_DOUBLE_PATH_OPERATION; type++) {
810                 if (strcmp(data, tomoyo_dp_keyword[type]))
811                         continue;
812                 return tomoyo_update_double_path_acl(type, filename, filename2,
813                                                      domain, is_delete);
814         }
815  out:
816         return -EINVAL;
817 }
818
819 /**
820  * tomoyo_update_single_path_acl - Update "struct tomoyo_single_path_acl_record" list.
821  *
822  * @type:      Type of operation.
823  * @filename:  Filename.
824  * @domain:    Pointer to "struct tomoyo_domain_info".
825  * @is_delete: True if it is a delete request.
826  *
827  * Returns 0 on success, negative value otherwise.
828  */
829 static int tomoyo_update_single_path_acl(const u8 type, const char *filename,
830                                          struct tomoyo_domain_info *
831                                          const domain, const bool is_delete)
832 {
833         static const u16 rw_mask =
834                 (1 << TOMOYO_TYPE_READ_ACL) | (1 << TOMOYO_TYPE_WRITE_ACL);
835         const struct tomoyo_path_info *saved_filename;
836         struct tomoyo_acl_info *ptr;
837         struct tomoyo_single_path_acl_record *acl;
838         int error = -ENOMEM;
839         const u16 perm = 1 << type;
840
841         if (!domain)
842                 return -EINVAL;
843         if (!tomoyo_is_correct_path(filename, 0, 0, 0, __func__))
844                 return -EINVAL;
845         saved_filename = tomoyo_save_name(filename);
846         if (!saved_filename)
847                 return -ENOMEM;
848         down_write(&tomoyo_domain_acl_info_list_lock);
849         if (is_delete)
850                 goto delete;
851         list_for_each_entry(ptr, &domain->acl_info_list, list) {
852                 if (tomoyo_acl_type1(ptr) != TOMOYO_TYPE_SINGLE_PATH_ACL)
853                         continue;
854                 acl = container_of(ptr, struct tomoyo_single_path_acl_record,
855                                    head);
856                 if (acl->filename != saved_filename)
857                         continue;
858                 /* Special case. Clear all bits if marked as deleted. */
859                 if (ptr->type & TOMOYO_ACL_DELETED)
860                         acl->perm = 0;
861                 acl->perm |= perm;
862                 if ((acl->perm & rw_mask) == rw_mask)
863                         acl->perm |= 1 << TOMOYO_TYPE_READ_WRITE_ACL;
864                 else if (acl->perm & (1 << TOMOYO_TYPE_READ_WRITE_ACL))
865                         acl->perm |= rw_mask;
866                 ptr->type &= ~TOMOYO_ACL_DELETED;
867                 error = 0;
868                 goto out;
869         }
870         /* Not found. Append it to the tail. */
871         acl = tomoyo_alloc_acl_element(TOMOYO_TYPE_SINGLE_PATH_ACL);
872         if (!acl)
873                 goto out;
874         acl->perm = perm;
875         if (perm == (1 << TOMOYO_TYPE_READ_WRITE_ACL))
876                 acl->perm |= rw_mask;
877         acl->filename = saved_filename;
878         list_add_tail(&acl->head.list, &domain->acl_info_list);
879         error = 0;
880         goto out;
881  delete:
882         error = -ENOENT;
883         list_for_each_entry(ptr, &domain->acl_info_list, list) {
884                 if (tomoyo_acl_type2(ptr) != TOMOYO_TYPE_SINGLE_PATH_ACL)
885                         continue;
886                 acl = container_of(ptr, struct tomoyo_single_path_acl_record,
887                                    head);
888                 if (acl->filename != saved_filename)
889                         continue;
890                 acl->perm &= ~perm;
891                 if ((acl->perm & rw_mask) != rw_mask)
892                         acl->perm &= ~(1 << TOMOYO_TYPE_READ_WRITE_ACL);
893                 else if (!(acl->perm & (1 << TOMOYO_TYPE_READ_WRITE_ACL)))
894                         acl->perm &= ~rw_mask;
895                 if (!acl->perm)
896                         ptr->type |= TOMOYO_ACL_DELETED;
897                 error = 0;
898                 break;
899         }
900  out:
901         up_write(&tomoyo_domain_acl_info_list_lock);
902         return error;
903 }
904
905 /**
906  * tomoyo_update_double_path_acl - Update "struct tomoyo_double_path_acl_record" list.
907  *
908  * @type:      Type of operation.
909  * @filename1: First filename.
910  * @filename2: Second filename.
911  * @domain:    Pointer to "struct tomoyo_domain_info".
912  * @is_delete: True if it is a delete request.
913  *
914  * Returns 0 on success, negative value otherwise.
915  */
916 static int tomoyo_update_double_path_acl(const u8 type, const char *filename1,
917                                          const char *filename2,
918                                          struct tomoyo_domain_info *
919                                          const domain, const bool is_delete)
920 {
921         const struct tomoyo_path_info *saved_filename1;
922         const struct tomoyo_path_info *saved_filename2;
923         struct tomoyo_acl_info *ptr;
924         struct tomoyo_double_path_acl_record *acl;
925         int error = -ENOMEM;
926         const u8 perm = 1 << type;
927
928         if (!domain)
929                 return -EINVAL;
930         if (!tomoyo_is_correct_path(filename1, 0, 0, 0, __func__) ||
931             !tomoyo_is_correct_path(filename2, 0, 0, 0, __func__))
932                 return -EINVAL;
933         saved_filename1 = tomoyo_save_name(filename1);
934         saved_filename2 = tomoyo_save_name(filename2);
935         if (!saved_filename1 || !saved_filename2)
936                 return -ENOMEM;
937         down_write(&tomoyo_domain_acl_info_list_lock);
938         if (is_delete)
939                 goto delete;
940         list_for_each_entry(ptr, &domain->acl_info_list, list) {
941                 if (tomoyo_acl_type1(ptr) != TOMOYO_TYPE_DOUBLE_PATH_ACL)
942                         continue;
943                 acl = container_of(ptr, struct tomoyo_double_path_acl_record,
944                                    head);
945                 if (acl->filename1 != saved_filename1 ||
946                     acl->filename2 != saved_filename2)
947                         continue;
948                 /* Special case. Clear all bits if marked as deleted. */
949                 if (ptr->type & TOMOYO_ACL_DELETED)
950                         acl->perm = 0;
951                 acl->perm |= perm;
952                 ptr->type &= ~TOMOYO_ACL_DELETED;
953                 error = 0;
954                 goto out;
955         }
956         /* Not found. Append it to the tail. */
957         acl = tomoyo_alloc_acl_element(TOMOYO_TYPE_DOUBLE_PATH_ACL);
958         if (!acl)
959                 goto out;
960         acl->perm = perm;
961         acl->filename1 = saved_filename1;
962         acl->filename2 = saved_filename2;
963         list_add_tail(&acl->head.list, &domain->acl_info_list);
964         error = 0;
965         goto out;
966  delete:
967         error = -ENOENT;
968         list_for_each_entry(ptr, &domain->acl_info_list, list) {
969                 if (tomoyo_acl_type2(ptr) != TOMOYO_TYPE_DOUBLE_PATH_ACL)
970                         continue;
971                 acl = container_of(ptr, struct tomoyo_double_path_acl_record,
972                                    head);
973                 if (acl->filename1 != saved_filename1 ||
974                     acl->filename2 != saved_filename2)
975                         continue;
976                 acl->perm &= ~perm;
977                 if (!acl->perm)
978                         ptr->type |= TOMOYO_ACL_DELETED;
979                 error = 0;
980                 break;
981         }
982  out:
983         up_write(&tomoyo_domain_acl_info_list_lock);
984         return error;
985 }
986
987 /**
988  * tomoyo_check_single_path_acl - Check permission for single path operation.
989  *
990  * @domain:   Pointer to "struct tomoyo_domain_info".
991  * @type:     Type of operation.
992  * @filename: Filename to check.
993  *
994  * Returns 0 on success, negative value otherwise.
995  */
996 static int tomoyo_check_single_path_acl(struct tomoyo_domain_info *domain,
997                                         const u8 type,
998                                         const struct tomoyo_path_info *filename)
999 {
1000         if (!tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE))
1001                 return 0;
1002         return tomoyo_check_single_path_acl2(domain, filename, 1 << type, 1);
1003 }
1004
1005 /**
1006  * tomoyo_check_double_path_acl - Check permission for double path operation.
1007  *
1008  * @domain:    Pointer to "struct tomoyo_domain_info".
1009  * @type:      Type of operation.
1010  * @filename1: First filename to check.
1011  * @filename2: Second filename to check.
1012  *
1013  * Returns 0 on success, -EPERM otherwise.
1014  */
1015 static int tomoyo_check_double_path_acl(const struct tomoyo_domain_info *domain,
1016                                         const u8 type,
1017                                         const struct tomoyo_path_info *
1018                                         filename1,
1019                                         const struct tomoyo_path_info *
1020                                         filename2)
1021 {
1022         struct tomoyo_acl_info *ptr;
1023         const u8 perm = 1 << type;
1024         int error = -EPERM;
1025
1026         if (!tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE))
1027                 return 0;
1028         down_read(&tomoyo_domain_acl_info_list_lock);
1029         list_for_each_entry(ptr, &domain->acl_info_list, list) {
1030                 struct tomoyo_double_path_acl_record *acl;
1031                 if (tomoyo_acl_type2(ptr) != TOMOYO_TYPE_DOUBLE_PATH_ACL)
1032                         continue;
1033                 acl = container_of(ptr, struct tomoyo_double_path_acl_record,
1034                                    head);
1035                 if (!(acl->perm & perm))
1036                         continue;
1037                 if (!tomoyo_path_matches_pattern(filename1, acl->filename1))
1038                         continue;
1039                 if (!tomoyo_path_matches_pattern(filename2, acl->filename2))
1040                         continue;
1041                 error = 0;
1042                 break;
1043         }
1044         up_read(&tomoyo_domain_acl_info_list_lock);
1045         return error;
1046 }
1047
1048 /**
1049  * tomoyo_check_single_path_permission2 - Check permission for single path operation.
1050  *
1051  * @domain:    Pointer to "struct tomoyo_domain_info".
1052  * @operation: Type of operation.
1053  * @filename:  Filename to check.
1054  * @mode:      Access control mode.
1055  *
1056  * Returns 0 on success, negative value otherwise.
1057  */
1058 static int tomoyo_check_single_path_permission2(struct tomoyo_domain_info *
1059                                                 const domain, u8 operation,
1060                                                 const struct tomoyo_path_info *
1061                                                 filename, const u8 mode)
1062 {
1063         const char *msg;
1064         int error;
1065         const bool is_enforce = (mode == 3);
1066
1067         if (!mode)
1068                 return 0;
1069  next:
1070         error = tomoyo_check_single_path_acl(domain, operation, filename);
1071         msg = tomoyo_sp2keyword(operation);
1072         if (!error)
1073                 goto ok;
1074         if (tomoyo_verbose_mode(domain))
1075                 printk(KERN_WARNING "TOMOYO-%s: Access '%s %s' denied for %s\n",
1076                        tomoyo_get_msg(is_enforce), msg, filename->name,
1077                        tomoyo_get_last_name(domain));
1078         if (mode == 1 && tomoyo_domain_quota_is_ok(domain)) {
1079                 const char *name = tomoyo_get_file_pattern(filename)->name;
1080                 tomoyo_update_single_path_acl(operation, name, domain, false);
1081         }
1082         if (!is_enforce)
1083                 error = 0;
1084  ok:
1085         /*
1086          * Since "allow_truncate" doesn't imply "allow_rewrite" permission,
1087          * we need to check "allow_rewrite" permission if the filename is
1088          * specified by "deny_rewrite" keyword.
1089          */
1090         if (!error && operation == TOMOYO_TYPE_TRUNCATE_ACL &&
1091             tomoyo_is_no_rewrite_file(filename)) {
1092                 operation = TOMOYO_TYPE_REWRITE_ACL;
1093                 goto next;
1094         }
1095         return error;
1096 }
1097
1098 /**
1099  * tomoyo_check_exec_perm - Check permission for "execute".
1100  *
1101  * @domain:   Pointer to "struct tomoyo_domain_info".
1102  * @filename: Check permission for "execute".
1103  *
1104  * Returns 0 on success, negativevalue otherwise.
1105  */
1106 int tomoyo_check_exec_perm(struct tomoyo_domain_info *domain,
1107                            const struct tomoyo_path_info *filename)
1108 {
1109         const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1110
1111         if (!mode)
1112                 return 0;
1113         return tomoyo_check_file_perm2(domain, filename, 1, "do_execve", mode);
1114 }
1115
1116 /**
1117  * tomoyo_check_open_permission - Check permission for "read" and "write".
1118  *
1119  * @domain: Pointer to "struct tomoyo_domain_info".
1120  * @path:   Pointer to "struct path".
1121  * @flag:   Flags for open().
1122  *
1123  * Returns 0 on success, negative value otherwise.
1124  */
1125 int tomoyo_check_open_permission(struct tomoyo_domain_info *domain,
1126                                  struct path *path, const int flag)
1127 {
1128         const u8 acc_mode = ACC_MODE(flag);
1129         int error = -ENOMEM;
1130         struct tomoyo_path_info *buf;
1131         const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1132         const bool is_enforce = (mode == 3);
1133
1134         if (!mode || !path->mnt)
1135                 return 0;
1136         if (acc_mode == 0)
1137                 return 0;
1138         if (path->dentry->d_inode && S_ISDIR(path->dentry->d_inode->i_mode))
1139                 /*
1140                  * I don't check directories here because mkdir() and rmdir()
1141                  * don't call me.
1142                  */
1143                 return 0;
1144         buf = tomoyo_get_path(path);
1145         if (!buf)
1146                 goto out;
1147         error = 0;
1148         /*
1149          * If the filename is specified by "deny_rewrite" keyword,
1150          * we need to check "allow_rewrite" permission when the filename is not
1151          * opened for append mode or the filename is truncated at open time.
1152          */
1153         if ((acc_mode & MAY_WRITE) &&
1154             ((flag & O_TRUNC) || !(flag & O_APPEND)) &&
1155             (tomoyo_is_no_rewrite_file(buf))) {
1156                 error = tomoyo_check_single_path_permission2(domain,
1157                                                      TOMOYO_TYPE_REWRITE_ACL,
1158                                                              buf, mode);
1159         }
1160         if (!error)
1161                 error = tomoyo_check_file_perm2(domain, buf, acc_mode, "open",
1162                                                 mode);
1163         if (!error && (flag & O_TRUNC))
1164                 error = tomoyo_check_single_path_permission2(domain,
1165                                                      TOMOYO_TYPE_TRUNCATE_ACL,
1166                                                              buf, mode);
1167  out:
1168         tomoyo_free(buf);
1169         if (!is_enforce)
1170                 error = 0;
1171         return error;
1172 }
1173
1174 /**
1175  * tomoyo_check_1path_perm - Check permission for "create", "unlink", "mkdir", "rmdir", "mkfifo", "mksock", "mkblock", "mkchar", "truncate" and "symlink".
1176  *
1177  * @domain:    Pointer to "struct tomoyo_domain_info".
1178  * @operation: Type of operation.
1179  * @path:      Pointer to "struct path".
1180  *
1181  * Returns 0 on success, negative value otherwise.
1182  */
1183 int tomoyo_check_1path_perm(struct tomoyo_domain_info *domain,
1184                             const u8 operation, struct path *path)
1185 {
1186         int error = -ENOMEM;
1187         struct tomoyo_path_info *buf;
1188         const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1189         const bool is_enforce = (mode == 3);
1190
1191         if (!mode || !path->mnt)
1192                 return 0;
1193         buf = tomoyo_get_path(path);
1194         if (!buf)
1195                 goto out;
1196         switch (operation) {
1197         case TOMOYO_TYPE_MKDIR_ACL:
1198         case TOMOYO_TYPE_RMDIR_ACL:
1199                 if (!buf->is_dir) {
1200                         /*
1201                          * tomoyo_get_path() reserves space for appending "/."
1202                          */
1203                         strcat((char *) buf->name, "/");
1204                         tomoyo_fill_path_info(buf);
1205                 }
1206         }
1207         error = tomoyo_check_single_path_permission2(domain, operation, buf,
1208                                                      mode);
1209  out:
1210         tomoyo_free(buf);
1211         if (!is_enforce)
1212                 error = 0;
1213         return error;
1214 }
1215
1216 /**
1217  * tomoyo_check_rewrite_permission - Check permission for "rewrite".
1218  *
1219  * @domain: Pointer to "struct tomoyo_domain_info".
1220  * @filp: Pointer to "struct file".
1221  *
1222  * Returns 0 on success, negative value otherwise.
1223  */
1224 int tomoyo_check_rewrite_permission(struct tomoyo_domain_info *domain,
1225                                     struct file *filp)
1226 {
1227         int error = -ENOMEM;
1228         const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1229         const bool is_enforce = (mode == 3);
1230         struct tomoyo_path_info *buf;
1231
1232         if (!mode || !filp->f_path.mnt)
1233                 return 0;
1234         buf = tomoyo_get_path(&filp->f_path);
1235         if (!buf)
1236                 goto out;
1237         if (!tomoyo_is_no_rewrite_file(buf)) {
1238                 error = 0;
1239                 goto out;
1240         }
1241         error = tomoyo_check_single_path_permission2(domain,
1242                                                      TOMOYO_TYPE_REWRITE_ACL,
1243                                                      buf, mode);
1244  out:
1245         tomoyo_free(buf);
1246         if (!is_enforce)
1247                 error = 0;
1248         return error;
1249 }
1250
1251 /**
1252  * tomoyo_check_2path_perm - Check permission for "rename" and "link".
1253  *
1254  * @domain:    Pointer to "struct tomoyo_domain_info".
1255  * @operation: Type of operation.
1256  * @path1:      Pointer to "struct path".
1257  * @path2:      Pointer to "struct path".
1258  *
1259  * Returns 0 on success, negative value otherwise.
1260  */
1261 int tomoyo_check_2path_perm(struct tomoyo_domain_info * const domain,
1262                             const u8 operation, struct path *path1,
1263                             struct path *path2)
1264 {
1265         int error = -ENOMEM;
1266         struct tomoyo_path_info *buf1, *buf2;
1267         const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1268         const bool is_enforce = (mode == 3);
1269         const char *msg;
1270
1271         if (!mode || !path1->mnt || !path2->mnt)
1272                 return 0;
1273         buf1 = tomoyo_get_path(path1);
1274         buf2 = tomoyo_get_path(path2);
1275         if (!buf1 || !buf2)
1276                 goto out;
1277         {
1278                 struct dentry *dentry = path1->dentry;
1279                 if (dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode)) {
1280                         /*
1281                          * tomoyo_get_path() reserves space for appending "/."
1282                          */
1283                         if (!buf1->is_dir) {
1284                                 strcat((char *) buf1->name, "/");
1285                                 tomoyo_fill_path_info(buf1);
1286                         }
1287                         if (!buf2->is_dir) {
1288                                 strcat((char *) buf2->name, "/");
1289                                 tomoyo_fill_path_info(buf2);
1290                         }
1291                 }
1292         }
1293         error = tomoyo_check_double_path_acl(domain, operation, buf1, buf2);
1294         msg = tomoyo_dp2keyword(operation);
1295         if (!error)
1296                 goto out;
1297         if (tomoyo_verbose_mode(domain))
1298                 printk(KERN_WARNING "TOMOYO-%s: Access '%s %s %s' "
1299                        "denied for %s\n", tomoyo_get_msg(is_enforce),
1300                        msg, buf1->name, buf2->name,
1301                        tomoyo_get_last_name(domain));
1302         if (mode == 1 && tomoyo_domain_quota_is_ok(domain)) {
1303                 const char *name1 = tomoyo_get_file_pattern(buf1)->name;
1304                 const char *name2 = tomoyo_get_file_pattern(buf2)->name;
1305                 tomoyo_update_double_path_acl(operation, name1, name2, domain,
1306                                               false);
1307         }
1308  out:
1309         tomoyo_free(buf1);
1310         tomoyo_free(buf2);
1311         if (!is_enforce)
1312                 error = 0;
1313         return error;
1314 }