Merge branch 'master' into next
[linux-2.6.git] / security / tomoyo / file.c
1 /*
2  * security/tomoyo/file.c
3  *
4  * Implementation of the Domain-Based Mandatory Access Control.
5  *
6  * Copyright (C) 2005-2009  NTT DATA CORPORATION
7  *
8  * Version: 2.2.0   2009/04/01
9  *
10  */
11
12 #include "common.h"
13 #include "tomoyo.h"
14 #include "realpath.h"
15
16 /*
17  * tomoyo_globally_readable_file_entry is a structure which is used for holding
18  * "allow_read" entries.
19  * It has following fields.
20  *
21  *  (1) "list" which is linked to tomoyo_globally_readable_list .
22  *  (2) "filename" is a pathname which is allowed to open(O_RDONLY).
23  *  (3) "is_deleted" is a bool which is true if marked as deleted, false
24  *      otherwise.
25  */
26 struct tomoyo_globally_readable_file_entry {
27         struct list_head list;
28         const struct tomoyo_path_info *filename;
29         bool is_deleted;
30 };
31
32 /*
33  * tomoyo_pattern_entry is a structure which is used for holding
34  * "tomoyo_pattern_list" entries.
35  * It has following fields.
36  *
37  *  (1) "list" which is linked to tomoyo_pattern_list .
38  *  (2) "pattern" is a pathname pattern which is used for converting pathnames
39  *      to pathname patterns during learning mode.
40  *  (3) "is_deleted" is a bool which is true if marked as deleted, false
41  *      otherwise.
42  */
43 struct tomoyo_pattern_entry {
44         struct list_head list;
45         const struct tomoyo_path_info *pattern;
46         bool is_deleted;
47 };
48
49 /*
50  * tomoyo_no_rewrite_entry is a structure which is used for holding
51  * "deny_rewrite" entries.
52  * It has following fields.
53  *
54  *  (1) "list" which is linked to tomoyo_no_rewrite_list .
55  *  (2) "pattern" is a pathname which is by default not permitted to modify
56  *      already existing content.
57  *  (3) "is_deleted" is a bool which is true if marked as deleted, false
58  *      otherwise.
59  */
60 struct tomoyo_no_rewrite_entry {
61         struct list_head list;
62         const struct tomoyo_path_info *pattern;
63         bool is_deleted;
64 };
65
66 /* Keyword array for single path operations. */
67 static const char *tomoyo_sp_keyword[TOMOYO_MAX_SINGLE_PATH_OPERATION] = {
68         [TOMOYO_TYPE_READ_WRITE_ACL] = "read/write",
69         [TOMOYO_TYPE_EXECUTE_ACL]    = "execute",
70         [TOMOYO_TYPE_READ_ACL]       = "read",
71         [TOMOYO_TYPE_WRITE_ACL]      = "write",
72         [TOMOYO_TYPE_CREATE_ACL]     = "create",
73         [TOMOYO_TYPE_UNLINK_ACL]     = "unlink",
74         [TOMOYO_TYPE_MKDIR_ACL]      = "mkdir",
75         [TOMOYO_TYPE_RMDIR_ACL]      = "rmdir",
76         [TOMOYO_TYPE_MKFIFO_ACL]     = "mkfifo",
77         [TOMOYO_TYPE_MKSOCK_ACL]     = "mksock",
78         [TOMOYO_TYPE_MKBLOCK_ACL]    = "mkblock",
79         [TOMOYO_TYPE_MKCHAR_ACL]     = "mkchar",
80         [TOMOYO_TYPE_TRUNCATE_ACL]   = "truncate",
81         [TOMOYO_TYPE_SYMLINK_ACL]    = "symlink",
82         [TOMOYO_TYPE_REWRITE_ACL]    = "rewrite",
83         [TOMOYO_TYPE_IOCTL_ACL]      = "ioctl",
84         [TOMOYO_TYPE_CHMOD_ACL]      = "chmod",
85         [TOMOYO_TYPE_CHOWN_ACL]      = "chown",
86         [TOMOYO_TYPE_CHGRP_ACL]      = "chgrp",
87         [TOMOYO_TYPE_CHROOT_ACL]     = "chroot",
88         [TOMOYO_TYPE_MOUNT_ACL]      = "mount",
89         [TOMOYO_TYPE_UMOUNT_ACL]     = "unmount",
90 };
91
92 /* Keyword array for double path operations. */
93 static const char *tomoyo_dp_keyword[TOMOYO_MAX_DOUBLE_PATH_OPERATION] = {
94         [TOMOYO_TYPE_LINK_ACL]    = "link",
95         [TOMOYO_TYPE_RENAME_ACL]  = "rename",
96         [TOMOYO_TYPE_PIVOT_ROOT_ACL] = "pivot_root",
97 };
98
99 /**
100  * tomoyo_sp2keyword - Get the name of single path operation.
101  *
102  * @operation: Type of operation.
103  *
104  * Returns the name of single path operation.
105  */
106 const char *tomoyo_sp2keyword(const u8 operation)
107 {
108         return (operation < TOMOYO_MAX_SINGLE_PATH_OPERATION)
109                 ? tomoyo_sp_keyword[operation] : NULL;
110 }
111
112 /**
113  * tomoyo_dp2keyword - Get the name of double path operation.
114  *
115  * @operation: Type of operation.
116  *
117  * Returns the name of double path operation.
118  */
119 const char *tomoyo_dp2keyword(const u8 operation)
120 {
121         return (operation < TOMOYO_MAX_DOUBLE_PATH_OPERATION)
122                 ? tomoyo_dp_keyword[operation] : NULL;
123 }
124
125 /**
126  * tomoyo_strendswith - Check whether the token ends with the given token.
127  *
128  * @name: The token to check.
129  * @tail: The token to find.
130  *
131  * Returns true if @name ends with @tail, false otherwise.
132  */
133 static bool tomoyo_strendswith(const char *name, const char *tail)
134 {
135         int len;
136
137         if (!name || !tail)
138                 return false;
139         len = strlen(name) - strlen(tail);
140         return len >= 0 && !strcmp(name + len, tail);
141 }
142
143 /**
144  * tomoyo_get_path - Get realpath.
145  *
146  * @path: Pointer to "struct path".
147  *
148  * Returns pointer to "struct tomoyo_path_info" on success, NULL otherwise.
149  */
150 static struct tomoyo_path_info *tomoyo_get_path(struct path *path)
151 {
152         int error;
153         struct tomoyo_path_info_with_data *buf = tomoyo_alloc(sizeof(*buf));
154
155         if (!buf)
156                 return NULL;
157         /* Reserve one byte for appending "/". */
158         error = tomoyo_realpath_from_path2(path, buf->body,
159                                            sizeof(buf->body) - 2);
160         if (!error) {
161                 buf->head.name = buf->body;
162                 tomoyo_fill_path_info(&buf->head);
163                 return &buf->head;
164         }
165         tomoyo_free(buf);
166         return NULL;
167 }
168
169 static int tomoyo_update_double_path_acl(const u8 type, const char *filename1,
170                                          const char *filename2,
171                                          struct tomoyo_domain_info *
172                                          const domain, const bool is_delete);
173 static int tomoyo_update_single_path_acl(const u8 type, const char *filename,
174                                          struct tomoyo_domain_info *
175                                          const domain, const bool is_delete);
176
177 /*
178  * tomoyo_globally_readable_list is used for holding list of pathnames which
179  * are by default allowed to be open()ed for reading by any process.
180  *
181  * An entry is added by
182  *
183  * # echo 'allow_read /lib/libc-2.5.so' > \
184  *                               /sys/kernel/security/tomoyo/exception_policy
185  *
186  * and is deleted by
187  *
188  * # echo 'delete allow_read /lib/libc-2.5.so' > \
189  *                               /sys/kernel/security/tomoyo/exception_policy
190  *
191  * and all entries are retrieved by
192  *
193  * # grep ^allow_read /sys/kernel/security/tomoyo/exception_policy
194  *
195  * In the example above, any process is allowed to
196  * open("/lib/libc-2.5.so", O_RDONLY).
197  * One exception is, if the domain which current process belongs to is marked
198  * as "ignore_global_allow_read", current process can't do so unless explicitly
199  * given "allow_read /lib/libc-2.5.so" to the domain which current process
200  * belongs to.
201  */
202 static LIST_HEAD(tomoyo_globally_readable_list);
203
204 /**
205  * tomoyo_update_globally_readable_entry - Update "struct tomoyo_globally_readable_file_entry" list.
206  *
207  * @filename:  Filename unconditionally permitted to open() for reading.
208  * @is_delete: True if it is a delete request.
209  *
210  * Returns 0 on success, negative value otherwise.
211  *
212  * Caller holds tomoyo_read_lock().
213  */
214 static int tomoyo_update_globally_readable_entry(const char *filename,
215                                                  const bool is_delete)
216 {
217         struct tomoyo_globally_readable_file_entry *new_entry;
218         struct tomoyo_globally_readable_file_entry *ptr;
219         const struct tomoyo_path_info *saved_filename;
220         int error = -ENOMEM;
221
222         if (!tomoyo_is_correct_path(filename, 1, 0, -1, __func__))
223                 return -EINVAL;
224         saved_filename = tomoyo_save_name(filename);
225         if (!saved_filename)
226                 return -ENOMEM;
227         new_entry = kmalloc(sizeof(*new_entry), GFP_KERNEL);
228         mutex_lock(&tomoyo_policy_lock);
229         list_for_each_entry_rcu(ptr, &tomoyo_globally_readable_list, list) {
230                 if (ptr->filename != saved_filename)
231                         continue;
232                 ptr->is_deleted = is_delete;
233                 error = 0;
234                 goto out;
235         }
236         if (is_delete) {
237                 error = -ENOENT;
238                 goto out;
239         }
240         if (!tomoyo_memory_ok(new_entry))
241                 goto out;
242         new_entry->filename = saved_filename;
243         list_add_tail_rcu(&new_entry->list, &tomoyo_globally_readable_list);
244         new_entry = NULL;
245         error = 0;
246  out:
247         mutex_unlock(&tomoyo_policy_lock);
248         kfree(new_entry);
249         return error;
250 }
251
252 /**
253  * tomoyo_is_globally_readable_file - Check if the file is unconditionnaly permitted to be open()ed for reading.
254  *
255  * @filename: The filename to check.
256  *
257  * Returns true if any domain can open @filename for reading, false otherwise.
258  *
259  * Caller holds tomoyo_read_lock().
260  */
261 static bool tomoyo_is_globally_readable_file(const struct tomoyo_path_info *
262                                              filename)
263 {
264         struct tomoyo_globally_readable_file_entry *ptr;
265         bool found = false;
266
267         list_for_each_entry_rcu(ptr, &tomoyo_globally_readable_list, list) {
268                 if (!ptr->is_deleted &&
269                     tomoyo_path_matches_pattern(filename, ptr->filename)) {
270                         found = true;
271                         break;
272                 }
273         }
274         return found;
275 }
276
277 /**
278  * tomoyo_write_globally_readable_policy - Write "struct tomoyo_globally_readable_file_entry" list.
279  *
280  * @data:      String to parse.
281  * @is_delete: True if it is a delete request.
282  *
283  * Returns 0 on success, negative value otherwise.
284  *
285  * Caller holds tomoyo_read_lock().
286  */
287 int tomoyo_write_globally_readable_policy(char *data, const bool is_delete)
288 {
289         return tomoyo_update_globally_readable_entry(data, is_delete);
290 }
291
292 /**
293  * tomoyo_read_globally_readable_policy - Read "struct tomoyo_globally_readable_file_entry" list.
294  *
295  * @head: Pointer to "struct tomoyo_io_buffer".
296  *
297  * Returns true on success, false otherwise.
298  *
299  * Caller holds tomoyo_read_lock().
300  */
301 bool tomoyo_read_globally_readable_policy(struct tomoyo_io_buffer *head)
302 {
303         struct list_head *pos;
304         bool done = true;
305
306         list_for_each_cookie(pos, head->read_var2,
307                              &tomoyo_globally_readable_list) {
308                 struct tomoyo_globally_readable_file_entry *ptr;
309                 ptr = list_entry(pos,
310                                  struct tomoyo_globally_readable_file_entry,
311                                  list);
312                 if (ptr->is_deleted)
313                         continue;
314                 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_ALLOW_READ "%s\n",
315                                         ptr->filename->name);
316                 if (!done)
317                         break;
318         }
319         return done;
320 }
321
322 /* tomoyo_pattern_list is used for holding list of pathnames which are used for
323  * converting pathnames to pathname patterns during learning mode.
324  *
325  * An entry is added by
326  *
327  * # echo 'file_pattern /proc/\$/mounts' > \
328  *                             /sys/kernel/security/tomoyo/exception_policy
329  *
330  * and is deleted by
331  *
332  * # echo 'delete file_pattern /proc/\$/mounts' > \
333  *                             /sys/kernel/security/tomoyo/exception_policy
334  *
335  * and all entries are retrieved by
336  *
337  * # grep ^file_pattern /sys/kernel/security/tomoyo/exception_policy
338  *
339  * In the example above, if a process which belongs to a domain which is in
340  * learning mode requested open("/proc/1/mounts", O_RDONLY),
341  * "allow_read /proc/\$/mounts" is automatically added to the domain which that
342  * process belongs to.
343  *
344  * It is not a desirable behavior that we have to use /proc/\$/ instead of
345  * /proc/self/ when current process needs to access only current process's
346  * information. As of now, LSM version of TOMOYO is using __d_path() for
347  * calculating pathname. Non LSM version of TOMOYO is using its own function
348  * which pretends as if /proc/self/ is not a symlink; so that we can forbid
349  * current process from accessing other process's information.
350  */
351 static LIST_HEAD(tomoyo_pattern_list);
352
353 /**
354  * tomoyo_update_file_pattern_entry - Update "struct tomoyo_pattern_entry" list.
355  *
356  * @pattern:   Pathname pattern.
357  * @is_delete: True if it is a delete request.
358  *
359  * Returns 0 on success, negative value otherwise.
360  *
361  * Caller holds tomoyo_read_lock().
362  */
363 static int tomoyo_update_file_pattern_entry(const char *pattern,
364                                             const bool is_delete)
365 {
366         struct tomoyo_pattern_entry *new_entry;
367         struct tomoyo_pattern_entry *ptr;
368         const struct tomoyo_path_info *saved_pattern;
369         int error = -ENOMEM;
370
371         if (!tomoyo_is_correct_path(pattern, 0, 1, 0, __func__))
372                 return -EINVAL;
373         saved_pattern = tomoyo_save_name(pattern);
374         if (!saved_pattern)
375                 return -ENOMEM;
376         new_entry = kmalloc(sizeof(*new_entry), GFP_KERNEL);
377         mutex_lock(&tomoyo_policy_lock);
378         list_for_each_entry_rcu(ptr, &tomoyo_pattern_list, list) {
379                 if (saved_pattern != ptr->pattern)
380                         continue;
381                 ptr->is_deleted = is_delete;
382                 error = 0;
383                 goto out;
384         }
385         if (is_delete) {
386                 error = -ENOENT;
387                 goto out;
388         }
389         if (!tomoyo_memory_ok(new_entry))
390                 goto out;
391         new_entry->pattern = saved_pattern;
392         list_add_tail_rcu(&new_entry->list, &tomoyo_pattern_list);
393         new_entry = NULL;
394         error = 0;
395  out:
396         mutex_unlock(&tomoyo_policy_lock);
397         kfree(new_entry);
398         return error;
399 }
400
401 /**
402  * tomoyo_get_file_pattern - Get patterned pathname.
403  *
404  * @filename: The filename to find patterned pathname.
405  *
406  * Returns pointer to pathname pattern if matched, @filename otherwise.
407  *
408  * Caller holds tomoyo_read_lock().
409  */
410 static const struct tomoyo_path_info *
411 tomoyo_get_file_pattern(const struct tomoyo_path_info *filename)
412 {
413         struct tomoyo_pattern_entry *ptr;
414         const struct tomoyo_path_info *pattern = NULL;
415
416         list_for_each_entry_rcu(ptr, &tomoyo_pattern_list, list) {
417                 if (ptr->is_deleted)
418                         continue;
419                 if (!tomoyo_path_matches_pattern(filename, ptr->pattern))
420                         continue;
421                 pattern = ptr->pattern;
422                 if (tomoyo_strendswith(pattern->name, "/\\*")) {
423                         /* Do nothing. Try to find the better match. */
424                 } else {
425                         /* This would be the better match. Use this. */
426                         break;
427                 }
428         }
429         if (pattern)
430                 filename = pattern;
431         return filename;
432 }
433
434 /**
435  * tomoyo_write_pattern_policy - Write "struct tomoyo_pattern_entry" list.
436  *
437  * @data:      String to parse.
438  * @is_delete: True if it is a delete request.
439  *
440  * Returns 0 on success, negative value otherwise.
441  *
442  * Caller holds tomoyo_read_lock().
443  */
444 int tomoyo_write_pattern_policy(char *data, const bool is_delete)
445 {
446         return tomoyo_update_file_pattern_entry(data, is_delete);
447 }
448
449 /**
450  * tomoyo_read_file_pattern - Read "struct tomoyo_pattern_entry" list.
451  *
452  * @head: Pointer to "struct tomoyo_io_buffer".
453  *
454  * Returns true on success, false otherwise.
455  *
456  * Caller holds tomoyo_read_lock().
457  */
458 bool tomoyo_read_file_pattern(struct tomoyo_io_buffer *head)
459 {
460         struct list_head *pos;
461         bool done = true;
462
463         list_for_each_cookie(pos, head->read_var2, &tomoyo_pattern_list) {
464                 struct tomoyo_pattern_entry *ptr;
465                 ptr = list_entry(pos, struct tomoyo_pattern_entry, list);
466                 if (ptr->is_deleted)
467                         continue;
468                 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_FILE_PATTERN
469                                         "%s\n", ptr->pattern->name);
470                 if (!done)
471                         break;
472         }
473         return done;
474 }
475
476 /*
477  * tomoyo_no_rewrite_list is used for holding list of pathnames which are by
478  * default forbidden to modify already written content of a file.
479  *
480  * An entry is added by
481  *
482  * # echo 'deny_rewrite /var/log/messages' > \
483  *                              /sys/kernel/security/tomoyo/exception_policy
484  *
485  * and is deleted by
486  *
487  * # echo 'delete deny_rewrite /var/log/messages' > \
488  *                              /sys/kernel/security/tomoyo/exception_policy
489  *
490  * and all entries are retrieved by
491  *
492  * # grep ^deny_rewrite /sys/kernel/security/tomoyo/exception_policy
493  *
494  * In the example above, if a process requested to rewrite /var/log/messages ,
495  * the process can't rewrite unless the domain which that process belongs to
496  * has "allow_rewrite /var/log/messages" entry.
497  *
498  * It is not a desirable behavior that we have to add "\040(deleted)" suffix
499  * when we want to allow rewriting already unlink()ed file. As of now,
500  * LSM version of TOMOYO is using __d_path() for calculating pathname.
501  * Non LSM version of TOMOYO is using its own function which doesn't append
502  * " (deleted)" suffix if the file is already unlink()ed; so that we don't
503  * need to worry whether the file is already unlink()ed or not.
504  */
505 static LIST_HEAD(tomoyo_no_rewrite_list);
506
507 /**
508  * tomoyo_update_no_rewrite_entry - Update "struct tomoyo_no_rewrite_entry" list.
509  *
510  * @pattern:   Pathname pattern that are not rewritable by default.
511  * @is_delete: True if it is a delete request.
512  *
513  * Returns 0 on success, negative value otherwise.
514  *
515  * Caller holds tomoyo_read_lock().
516  */
517 static int tomoyo_update_no_rewrite_entry(const char *pattern,
518                                           const bool is_delete)
519 {
520         struct tomoyo_no_rewrite_entry *new_entry, *ptr;
521         const struct tomoyo_path_info *saved_pattern;
522         int error = -ENOMEM;
523
524         if (!tomoyo_is_correct_path(pattern, 0, 0, 0, __func__))
525                 return -EINVAL;
526         saved_pattern = tomoyo_save_name(pattern);
527         if (!saved_pattern)
528                 return -ENOMEM;
529         new_entry = kmalloc(sizeof(*new_entry), GFP_KERNEL);
530         mutex_lock(&tomoyo_policy_lock);
531         list_for_each_entry_rcu(ptr, &tomoyo_no_rewrite_list, list) {
532                 if (ptr->pattern != saved_pattern)
533                         continue;
534                 ptr->is_deleted = is_delete;
535                 error = 0;
536                 goto out;
537         }
538         if (is_delete) {
539                 error = -ENOENT;
540                 goto out;
541         }
542         if (!tomoyo_memory_ok(new_entry))
543                 goto out;
544         new_entry->pattern = saved_pattern;
545         list_add_tail_rcu(&new_entry->list, &tomoyo_no_rewrite_list);
546         new_entry = NULL;
547         error = 0;
548  out:
549         mutex_unlock(&tomoyo_policy_lock);
550         kfree(new_entry);
551         return error;
552 }
553
554 /**
555  * tomoyo_is_no_rewrite_file - Check if the given pathname is not permitted to be rewrited.
556  *
557  * @filename: Filename to check.
558  *
559  * Returns true if @filename is specified by "deny_rewrite" directive,
560  * false otherwise.
561  *
562  * Caller holds tomoyo_read_lock().
563  */
564 static bool tomoyo_is_no_rewrite_file(const struct tomoyo_path_info *filename)
565 {
566         struct tomoyo_no_rewrite_entry *ptr;
567         bool found = false;
568
569         list_for_each_entry_rcu(ptr, &tomoyo_no_rewrite_list, list) {
570                 if (ptr->is_deleted)
571                         continue;
572                 if (!tomoyo_path_matches_pattern(filename, ptr->pattern))
573                         continue;
574                 found = true;
575                 break;
576         }
577         return found;
578 }
579
580 /**
581  * tomoyo_write_no_rewrite_policy - Write "struct tomoyo_no_rewrite_entry" list.
582  *
583  * @data:      String to parse.
584  * @is_delete: True if it is a delete request.
585  *
586  * Returns 0 on success, negative value otherwise.
587  *
588  * Caller holds tomoyo_read_lock().
589  */
590 int tomoyo_write_no_rewrite_policy(char *data, const bool is_delete)
591 {
592         return tomoyo_update_no_rewrite_entry(data, is_delete);
593 }
594
595 /**
596  * tomoyo_read_no_rewrite_policy - Read "struct tomoyo_no_rewrite_entry" list.
597  *
598  * @head: Pointer to "struct tomoyo_io_buffer".
599  *
600  * Returns true on success, false otherwise.
601  *
602  * Caller holds tomoyo_read_lock().
603  */
604 bool tomoyo_read_no_rewrite_policy(struct tomoyo_io_buffer *head)
605 {
606         struct list_head *pos;
607         bool done = true;
608
609         list_for_each_cookie(pos, head->read_var2, &tomoyo_no_rewrite_list) {
610                 struct tomoyo_no_rewrite_entry *ptr;
611                 ptr = list_entry(pos, struct tomoyo_no_rewrite_entry, list);
612                 if (ptr->is_deleted)
613                         continue;
614                 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_DENY_REWRITE
615                                         "%s\n", ptr->pattern->name);
616                 if (!done)
617                         break;
618         }
619         return done;
620 }
621
622 /**
623  * tomoyo_update_file_acl - Update file's read/write/execute ACL.
624  *
625  * @filename:  Filename.
626  * @perm:      Permission (between 1 to 7).
627  * @domain:    Pointer to "struct tomoyo_domain_info".
628  * @is_delete: True if it is a delete request.
629  *
630  * Returns 0 on success, negative value otherwise.
631  *
632  * This is legacy support interface for older policy syntax.
633  * Current policy syntax uses "allow_read/write" instead of "6",
634  * "allow_read" instead of "4", "allow_write" instead of "2",
635  * "allow_execute" instead of "1".
636  *
637  * Caller holds tomoyo_read_lock().
638  */
639 static int tomoyo_update_file_acl(const char *filename, u8 perm,
640                                   struct tomoyo_domain_info * const domain,
641                                   const bool is_delete)
642 {
643         if (perm > 7 || !perm) {
644                 printk(KERN_DEBUG "%s: Invalid permission '%d %s'\n",
645                        __func__, perm, filename);
646                 return -EINVAL;
647         }
648         if (filename[0] != '@' && tomoyo_strendswith(filename, "/"))
649                 /*
650                  * Only 'allow_mkdir' and 'allow_rmdir' are valid for
651                  * directory permissions.
652                  */
653                 return 0;
654         if (perm & 4)
655                 tomoyo_update_single_path_acl(TOMOYO_TYPE_READ_ACL, filename,
656                                               domain, is_delete);
657         if (perm & 2)
658                 tomoyo_update_single_path_acl(TOMOYO_TYPE_WRITE_ACL, filename,
659                                               domain, is_delete);
660         if (perm & 1)
661                 tomoyo_update_single_path_acl(TOMOYO_TYPE_EXECUTE_ACL,
662                                               filename, domain, is_delete);
663         return 0;
664 }
665
666 /**
667  * tomoyo_check_single_path_acl2 - Check permission for single path operation.
668  *
669  * @domain:          Pointer to "struct tomoyo_domain_info".
670  * @filename:        Filename to check.
671  * @perm:            Permission.
672  * @may_use_pattern: True if patterned ACL is permitted.
673  *
674  * Returns 0 on success, -EPERM otherwise.
675  *
676  * Caller holds tomoyo_read_lock().
677  */
678 static int tomoyo_check_single_path_acl2(const struct tomoyo_domain_info *
679                                          domain,
680                                          const struct tomoyo_path_info *
681                                          filename,
682                                          const u32 perm,
683                                          const bool may_use_pattern)
684 {
685         struct tomoyo_acl_info *ptr;
686         int error = -EPERM;
687
688         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
689                 struct tomoyo_single_path_acl_record *acl;
690                 if (tomoyo_acl_type2(ptr) != TOMOYO_TYPE_SINGLE_PATH_ACL)
691                         continue;
692                 acl = container_of(ptr, struct tomoyo_single_path_acl_record,
693                                    head);
694                 if (perm <= 0xFFFF) {
695                         if (!(acl->perm & perm))
696                                 continue;
697                 } else {
698                         if (!(acl->perm_high & (perm >> 16)))
699                                 continue;
700                 }
701                 if (may_use_pattern || !acl->filename->is_patterned) {
702                         if (!tomoyo_path_matches_pattern(filename,
703                                                          acl->filename))
704                                 continue;
705                 } else {
706                         continue;
707                 }
708                 error = 0;
709                 break;
710         }
711         return error;
712 }
713
714 /**
715  * tomoyo_check_file_acl - Check permission for opening files.
716  *
717  * @domain:    Pointer to "struct tomoyo_domain_info".
718  * @filename:  Filename to check.
719  * @operation: Mode ("read" or "write" or "read/write" or "execute").
720  *
721  * Returns 0 on success, -EPERM otherwise.
722  *
723  * Caller holds tomoyo_read_lock().
724  */
725 static int tomoyo_check_file_acl(const struct tomoyo_domain_info *domain,
726                                  const struct tomoyo_path_info *filename,
727                                  const u8 operation)
728 {
729         u32 perm = 0;
730
731         if (!tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE))
732                 return 0;
733         if (operation == 6)
734                 perm = 1 << TOMOYO_TYPE_READ_WRITE_ACL;
735         else if (operation == 4)
736                 perm = 1 << TOMOYO_TYPE_READ_ACL;
737         else if (operation == 2)
738                 perm = 1 << TOMOYO_TYPE_WRITE_ACL;
739         else if (operation == 1)
740                 perm = 1 << TOMOYO_TYPE_EXECUTE_ACL;
741         else
742                 BUG();
743         return tomoyo_check_single_path_acl2(domain, filename, perm,
744                                              operation != 1);
745 }
746
747 /**
748  * tomoyo_check_file_perm2 - Check permission for opening files.
749  *
750  * @domain:    Pointer to "struct tomoyo_domain_info".
751  * @filename:  Filename to check.
752  * @perm:      Mode ("read" or "write" or "read/write" or "execute").
753  * @operation: Operation name passed used for verbose mode.
754  * @mode:      Access control mode.
755  *
756  * Returns 0 on success, negative value otherwise.
757  *
758  * Caller holds tomoyo_read_lock().
759  */
760 static int tomoyo_check_file_perm2(struct tomoyo_domain_info * const domain,
761                                    const struct tomoyo_path_info *filename,
762                                    const u8 perm, const char *operation,
763                                    const u8 mode)
764 {
765         const bool is_enforce = (mode == 3);
766         const char *msg = "<unknown>";
767         int error = 0;
768
769         if (!filename)
770                 return 0;
771         error = tomoyo_check_file_acl(domain, filename, perm);
772         if (error && perm == 4 &&
773             (domain->flags & TOMOYO_DOMAIN_FLAGS_IGNORE_GLOBAL_ALLOW_READ) == 0
774             && tomoyo_is_globally_readable_file(filename))
775                 error = 0;
776         if (perm == 6)
777                 msg = tomoyo_sp2keyword(TOMOYO_TYPE_READ_WRITE_ACL);
778         else if (perm == 4)
779                 msg = tomoyo_sp2keyword(TOMOYO_TYPE_READ_ACL);
780         else if (perm == 2)
781                 msg = tomoyo_sp2keyword(TOMOYO_TYPE_WRITE_ACL);
782         else if (perm == 1)
783                 msg = tomoyo_sp2keyword(TOMOYO_TYPE_EXECUTE_ACL);
784         else
785                 BUG();
786         if (!error)
787                 return 0;
788         if (tomoyo_verbose_mode(domain))
789                 printk(KERN_WARNING "TOMOYO-%s: Access '%s(%s) %s' denied "
790                        "for %s\n", tomoyo_get_msg(is_enforce), msg, operation,
791                        filename->name, tomoyo_get_last_name(domain));
792         if (is_enforce)
793                 return error;
794         if (mode == 1 && tomoyo_domain_quota_is_ok(domain)) {
795                 /* Don't use patterns for execute permission. */
796                 const struct tomoyo_path_info *patterned_file = (perm != 1) ?
797                         tomoyo_get_file_pattern(filename) : filename;
798                 tomoyo_update_file_acl(patterned_file->name, perm,
799                                        domain, false);
800         }
801         return 0;
802 }
803
804 /**
805  * tomoyo_write_file_policy - Update file related list.
806  *
807  * @data:      String to parse.
808  * @domain:    Pointer to "struct tomoyo_domain_info".
809  * @is_delete: True if it is a delete request.
810  *
811  * Returns 0 on success, negative value otherwise.
812  *
813  * Caller holds tomoyo_read_lock().
814  */
815 int tomoyo_write_file_policy(char *data, struct tomoyo_domain_info *domain,
816                              const bool is_delete)
817 {
818         char *filename = strchr(data, ' ');
819         char *filename2;
820         unsigned int perm;
821         u8 type;
822
823         if (!filename)
824                 return -EINVAL;
825         *filename++ = '\0';
826         if (sscanf(data, "%u", &perm) == 1)
827                 return tomoyo_update_file_acl(filename, (u8) perm, domain,
828                                               is_delete);
829         if (strncmp(data, "allow_", 6))
830                 goto out;
831         data += 6;
832         for (type = 0; type < TOMOYO_MAX_SINGLE_PATH_OPERATION; type++) {
833                 if (strcmp(data, tomoyo_sp_keyword[type]))
834                         continue;
835                 return tomoyo_update_single_path_acl(type, filename,
836                                                      domain, is_delete);
837         }
838         filename2 = strchr(filename, ' ');
839         if (!filename2)
840                 goto out;
841         *filename2++ = '\0';
842         for (type = 0; type < TOMOYO_MAX_DOUBLE_PATH_OPERATION; type++) {
843                 if (strcmp(data, tomoyo_dp_keyword[type]))
844                         continue;
845                 return tomoyo_update_double_path_acl(type, filename, filename2,
846                                                      domain, is_delete);
847         }
848  out:
849         return -EINVAL;
850 }
851
852 /**
853  * tomoyo_update_single_path_acl - Update "struct tomoyo_single_path_acl_record" list.
854  *
855  * @type:      Type of operation.
856  * @filename:  Filename.
857  * @domain:    Pointer to "struct tomoyo_domain_info".
858  * @is_delete: True if it is a delete request.
859  *
860  * Returns 0 on success, negative value otherwise.
861  *
862  * Caller holds tomoyo_read_lock().
863  */
864 static int tomoyo_update_single_path_acl(const u8 type, const char *filename,
865                                          struct tomoyo_domain_info *
866                                          const domain, const bool is_delete)
867 {
868         static const u32 rw_mask =
869                 (1 << TOMOYO_TYPE_READ_ACL) | (1 << TOMOYO_TYPE_WRITE_ACL);
870         const struct tomoyo_path_info *saved_filename;
871         struct tomoyo_acl_info *ptr;
872         struct tomoyo_single_path_acl_record *acl;
873         int error = -ENOMEM;
874         const u32 perm = 1 << type;
875
876         if (!domain)
877                 return -EINVAL;
878         if (!tomoyo_is_correct_path(filename, 0, 0, 0, __func__))
879                 return -EINVAL;
880         saved_filename = tomoyo_save_name(filename);
881         if (!saved_filename)
882                 return -ENOMEM;
883         mutex_lock(&tomoyo_policy_lock);
884         if (is_delete)
885                 goto delete;
886         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
887                 if (tomoyo_acl_type1(ptr) != TOMOYO_TYPE_SINGLE_PATH_ACL)
888                         continue;
889                 acl = container_of(ptr, struct tomoyo_single_path_acl_record,
890                                    head);
891                 if (acl->filename != saved_filename)
892                         continue;
893                 /* Special case. Clear all bits if marked as deleted. */
894                 if (ptr->type & TOMOYO_ACL_DELETED)
895                         acl->perm = 0;
896                 if (perm <= 0xFFFF)
897                         acl->perm |= perm;
898                 else
899                         acl->perm_high |= (perm >> 16);
900                 if ((acl->perm & rw_mask) == rw_mask)
901                         acl->perm |= 1 << TOMOYO_TYPE_READ_WRITE_ACL;
902                 else if (acl->perm & (1 << TOMOYO_TYPE_READ_WRITE_ACL))
903                         acl->perm |= rw_mask;
904                 ptr->type &= ~TOMOYO_ACL_DELETED;
905                 error = 0;
906                 goto out;
907         }
908         /* Not found. Append it to the tail. */
909         acl = kmalloc(sizeof(*acl), GFP_KERNEL);
910         if (!tomoyo_memory_ok(acl)) {
911                 kfree(acl);
912                 acl = NULL;
913                 goto out;
914         }
915         acl->head.type = TOMOYO_TYPE_SINGLE_PATH_ACL;
916         if (perm <= 0xFFFF)
917                 acl->perm = perm;
918         else
919                 acl->perm_high = (perm >> 16);
920         if (perm == (1 << TOMOYO_TYPE_READ_WRITE_ACL))
921                 acl->perm |= rw_mask;
922         acl->filename = saved_filename;
923         list_add_tail_rcu(&acl->head.list, &domain->acl_info_list);
924         error = 0;
925         goto out;
926  delete:
927         error = -ENOENT;
928         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
929                 if (tomoyo_acl_type2(ptr) != TOMOYO_TYPE_SINGLE_PATH_ACL)
930                         continue;
931                 acl = container_of(ptr, struct tomoyo_single_path_acl_record,
932                                    head);
933                 if (acl->filename != saved_filename)
934                         continue;
935                 if (perm <= 0xFFFF)
936                         acl->perm &= ~perm;
937                 else
938                         acl->perm_high &= ~(perm >> 16);
939                 if ((acl->perm & rw_mask) != rw_mask)
940                         acl->perm &= ~(1 << TOMOYO_TYPE_READ_WRITE_ACL);
941                 else if (!(acl->perm & (1 << TOMOYO_TYPE_READ_WRITE_ACL)))
942                         acl->perm &= ~rw_mask;
943                 if (!acl->perm && !acl->perm_high)
944                         ptr->type |= TOMOYO_ACL_DELETED;
945                 error = 0;
946                 break;
947         }
948  out:
949         mutex_unlock(&tomoyo_policy_lock);
950         return error;
951 }
952
953 /**
954  * tomoyo_update_double_path_acl - Update "struct tomoyo_double_path_acl_record" list.
955  *
956  * @type:      Type of operation.
957  * @filename1: First filename.
958  * @filename2: Second filename.
959  * @domain:    Pointer to "struct tomoyo_domain_info".
960  * @is_delete: True if it is a delete request.
961  *
962  * Returns 0 on success, negative value otherwise.
963  *
964  * Caller holds tomoyo_read_lock().
965  */
966 static int tomoyo_update_double_path_acl(const u8 type, const char *filename1,
967                                          const char *filename2,
968                                          struct tomoyo_domain_info *
969                                          const domain, const bool is_delete)
970 {
971         const struct tomoyo_path_info *saved_filename1;
972         const struct tomoyo_path_info *saved_filename2;
973         struct tomoyo_acl_info *ptr;
974         struct tomoyo_double_path_acl_record *acl;
975         int error = -ENOMEM;
976         const u8 perm = 1 << type;
977
978         if (!domain)
979                 return -EINVAL;
980         if (!tomoyo_is_correct_path(filename1, 0, 0, 0, __func__) ||
981             !tomoyo_is_correct_path(filename2, 0, 0, 0, __func__))
982                 return -EINVAL;
983         saved_filename1 = tomoyo_save_name(filename1);
984         saved_filename2 = tomoyo_save_name(filename2);
985         if (!saved_filename1 || !saved_filename2)
986                 return -ENOMEM;
987         mutex_lock(&tomoyo_policy_lock);
988         if (is_delete)
989                 goto delete;
990         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
991                 if (tomoyo_acl_type1(ptr) != TOMOYO_TYPE_DOUBLE_PATH_ACL)
992                         continue;
993                 acl = container_of(ptr, struct tomoyo_double_path_acl_record,
994                                    head);
995                 if (acl->filename1 != saved_filename1 ||
996                     acl->filename2 != saved_filename2)
997                         continue;
998                 /* Special case. Clear all bits if marked as deleted. */
999                 if (ptr->type & TOMOYO_ACL_DELETED)
1000                         acl->perm = 0;
1001                 acl->perm |= perm;
1002                 ptr->type &= ~TOMOYO_ACL_DELETED;
1003                 error = 0;
1004                 goto out;
1005         }
1006         /* Not found. Append it to the tail. */
1007         acl = kmalloc(sizeof(*acl), GFP_KERNEL);
1008         if (!tomoyo_memory_ok(acl)) {
1009                 kfree(acl);
1010                 acl = NULL;
1011                 goto out;
1012         }
1013         acl->head.type = TOMOYO_TYPE_DOUBLE_PATH_ACL;
1014         acl->perm = perm;
1015         acl->filename1 = saved_filename1;
1016         acl->filename2 = saved_filename2;
1017         list_add_tail_rcu(&acl->head.list, &domain->acl_info_list);
1018         error = 0;
1019         goto out;
1020  delete:
1021         error = -ENOENT;
1022         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
1023                 if (tomoyo_acl_type2(ptr) != TOMOYO_TYPE_DOUBLE_PATH_ACL)
1024                         continue;
1025                 acl = container_of(ptr, struct tomoyo_double_path_acl_record,
1026                                    head);
1027                 if (acl->filename1 != saved_filename1 ||
1028                     acl->filename2 != saved_filename2)
1029                         continue;
1030                 acl->perm &= ~perm;
1031                 if (!acl->perm)
1032                         ptr->type |= TOMOYO_ACL_DELETED;
1033                 error = 0;
1034                 break;
1035         }
1036  out:
1037         mutex_unlock(&tomoyo_policy_lock);
1038         return error;
1039 }
1040
1041 /**
1042  * tomoyo_check_single_path_acl - Check permission for single path operation.
1043  *
1044  * @domain:   Pointer to "struct tomoyo_domain_info".
1045  * @type:     Type of operation.
1046  * @filename: Filename to check.
1047  *
1048  * Returns 0 on success, negative value otherwise.
1049  *
1050  * Caller holds tomoyo_read_lock().
1051  */
1052 static int tomoyo_check_single_path_acl(struct tomoyo_domain_info *domain,
1053                                         const u8 type,
1054                                         const struct tomoyo_path_info *filename)
1055 {
1056         if (!tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE))
1057                 return 0;
1058         return tomoyo_check_single_path_acl2(domain, filename, 1 << type, 1);
1059 }
1060
1061 /**
1062  * tomoyo_check_double_path_acl - Check permission for double path operation.
1063  *
1064  * @domain:    Pointer to "struct tomoyo_domain_info".
1065  * @type:      Type of operation.
1066  * @filename1: First filename to check.
1067  * @filename2: Second filename to check.
1068  *
1069  * Returns 0 on success, -EPERM otherwise.
1070  *
1071  * Caller holds tomoyo_read_lock().
1072  */
1073 static int tomoyo_check_double_path_acl(const struct tomoyo_domain_info *domain,
1074                                         const u8 type,
1075                                         const struct tomoyo_path_info *
1076                                         filename1,
1077                                         const struct tomoyo_path_info *
1078                                         filename2)
1079 {
1080         struct tomoyo_acl_info *ptr;
1081         const u8 perm = 1 << type;
1082         int error = -EPERM;
1083
1084         if (!tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE))
1085                 return 0;
1086         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
1087                 struct tomoyo_double_path_acl_record *acl;
1088                 if (tomoyo_acl_type2(ptr) != TOMOYO_TYPE_DOUBLE_PATH_ACL)
1089                         continue;
1090                 acl = container_of(ptr, struct tomoyo_double_path_acl_record,
1091                                    head);
1092                 if (!(acl->perm & perm))
1093                         continue;
1094                 if (!tomoyo_path_matches_pattern(filename1, acl->filename1))
1095                         continue;
1096                 if (!tomoyo_path_matches_pattern(filename2, acl->filename2))
1097                         continue;
1098                 error = 0;
1099                 break;
1100         }
1101         return error;
1102 }
1103
1104 /**
1105  * tomoyo_check_single_path_permission2 - Check permission for single path operation.
1106  *
1107  * @domain:    Pointer to "struct tomoyo_domain_info".
1108  * @operation: Type of operation.
1109  * @filename:  Filename to check.
1110  * @mode:      Access control mode.
1111  *
1112  * Returns 0 on success, negative value otherwise.
1113  *
1114  * Caller holds tomoyo_read_lock().
1115  */
1116 static int tomoyo_check_single_path_permission2(struct tomoyo_domain_info *
1117                                                 const domain, u8 operation,
1118                                                 const struct tomoyo_path_info *
1119                                                 filename, const u8 mode)
1120 {
1121         const char *msg;
1122         int error;
1123         const bool is_enforce = (mode == 3);
1124
1125         if (!mode)
1126                 return 0;
1127  next:
1128         error = tomoyo_check_single_path_acl(domain, operation, filename);
1129         msg = tomoyo_sp2keyword(operation);
1130         if (!error)
1131                 goto ok;
1132         if (tomoyo_verbose_mode(domain))
1133                 printk(KERN_WARNING "TOMOYO-%s: Access '%s %s' denied for %s\n",
1134                        tomoyo_get_msg(is_enforce), msg, filename->name,
1135                        tomoyo_get_last_name(domain));
1136         if (mode == 1 && tomoyo_domain_quota_is_ok(domain)) {
1137                 const char *name = tomoyo_get_file_pattern(filename)->name;
1138                 tomoyo_update_single_path_acl(operation, name, domain, false);
1139         }
1140         if (!is_enforce)
1141                 error = 0;
1142  ok:
1143         /*
1144          * Since "allow_truncate" doesn't imply "allow_rewrite" permission,
1145          * we need to check "allow_rewrite" permission if the filename is
1146          * specified by "deny_rewrite" keyword.
1147          */
1148         if (!error && operation == TOMOYO_TYPE_TRUNCATE_ACL &&
1149             tomoyo_is_no_rewrite_file(filename)) {
1150                 operation = TOMOYO_TYPE_REWRITE_ACL;
1151                 goto next;
1152         }
1153         return error;
1154 }
1155
1156 /**
1157  * tomoyo_check_exec_perm - Check permission for "execute".
1158  *
1159  * @domain:   Pointer to "struct tomoyo_domain_info".
1160  * @filename: Check permission for "execute".
1161  *
1162  * Returns 0 on success, negativevalue otherwise.
1163  *
1164  * Caller holds tomoyo_read_lock().
1165  */
1166 int tomoyo_check_exec_perm(struct tomoyo_domain_info *domain,
1167                            const struct tomoyo_path_info *filename)
1168 {
1169         const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1170
1171         if (!mode)
1172                 return 0;
1173         return tomoyo_check_file_perm2(domain, filename, 1, "do_execve", mode);
1174 }
1175
1176 /**
1177  * tomoyo_check_open_permission - Check permission for "read" and "write".
1178  *
1179  * @domain: Pointer to "struct tomoyo_domain_info".
1180  * @path:   Pointer to "struct path".
1181  * @flag:   Flags for open().
1182  *
1183  * Returns 0 on success, negative value otherwise.
1184  */
1185 int tomoyo_check_open_permission(struct tomoyo_domain_info *domain,
1186                                  struct path *path, const int flag)
1187 {
1188         const u8 acc_mode = ACC_MODE(flag);
1189         int error = -ENOMEM;
1190         struct tomoyo_path_info *buf;
1191         const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1192         const bool is_enforce = (mode == 3);
1193         int idx;
1194
1195         if (!mode || !path->mnt)
1196                 return 0;
1197         if (acc_mode == 0)
1198                 return 0;
1199         if (path->dentry->d_inode && S_ISDIR(path->dentry->d_inode->i_mode))
1200                 /*
1201                  * I don't check directories here because mkdir() and rmdir()
1202                  * don't call me.
1203                  */
1204                 return 0;
1205         idx = tomoyo_read_lock();
1206         buf = tomoyo_get_path(path);
1207         if (!buf)
1208                 goto out;
1209         error = 0;
1210         /*
1211          * If the filename is specified by "deny_rewrite" keyword,
1212          * we need to check "allow_rewrite" permission when the filename is not
1213          * opened for append mode or the filename is truncated at open time.
1214          */
1215         if ((acc_mode & MAY_WRITE) &&
1216             ((flag & O_TRUNC) || !(flag & O_APPEND)) &&
1217             (tomoyo_is_no_rewrite_file(buf))) {
1218                 error = tomoyo_check_single_path_permission2(domain,
1219                                                      TOMOYO_TYPE_REWRITE_ACL,
1220                                                              buf, mode);
1221         }
1222         if (!error)
1223                 error = tomoyo_check_file_perm2(domain, buf, acc_mode, "open",
1224                                                 mode);
1225         if (!error && (flag & O_TRUNC))
1226                 error = tomoyo_check_single_path_permission2(domain,
1227                                                      TOMOYO_TYPE_TRUNCATE_ACL,
1228                                                              buf, mode);
1229  out:
1230         tomoyo_free(buf);
1231         tomoyo_read_unlock(idx);
1232         if (!is_enforce)
1233                 error = 0;
1234         return error;
1235 }
1236
1237 /**
1238  * tomoyo_check_1path_perm - Check permission for "create", "unlink", "mkdir", "rmdir", "mkfifo", "mksock", "mkblock", "mkchar", "truncate", "symlink", "ioctl", "chmod", "chown", "chgrp", "chroot", "mount" and "unmount".
1239  *
1240  * @domain:    Pointer to "struct tomoyo_domain_info".
1241  * @operation: Type of operation.
1242  * @path:      Pointer to "struct path".
1243  *
1244  * Returns 0 on success, negative value otherwise.
1245  */
1246 int tomoyo_check_1path_perm(struct tomoyo_domain_info *domain,
1247                             const u8 operation, struct path *path)
1248 {
1249         int error = -ENOMEM;
1250         struct tomoyo_path_info *buf;
1251         const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1252         const bool is_enforce = (mode == 3);
1253         int idx;
1254
1255         if (!mode || !path->mnt)
1256                 return 0;
1257         idx = tomoyo_read_lock();
1258         buf = tomoyo_get_path(path);
1259         if (!buf)
1260                 goto out;
1261         switch (operation) {
1262         case TOMOYO_TYPE_MKDIR_ACL:
1263         case TOMOYO_TYPE_RMDIR_ACL:
1264         case TOMOYO_TYPE_CHROOT_ACL:
1265                 if (!buf->is_dir) {
1266                         /*
1267                          * tomoyo_get_path() reserves space for appending "/."
1268                          */
1269                         strcat((char *) buf->name, "/");
1270                         tomoyo_fill_path_info(buf);
1271                 }
1272         }
1273         error = tomoyo_check_single_path_permission2(domain, operation, buf,
1274                                                      mode);
1275  out:
1276         tomoyo_free(buf);
1277         tomoyo_read_unlock(idx);
1278         if (!is_enforce)
1279                 error = 0;
1280         return error;
1281 }
1282
1283 /**
1284  * tomoyo_check_rewrite_permission - Check permission for "rewrite".
1285  *
1286  * @domain: Pointer to "struct tomoyo_domain_info".
1287  * @filp: Pointer to "struct file".
1288  *
1289  * Returns 0 on success, negative value otherwise.
1290  */
1291 int tomoyo_check_rewrite_permission(struct tomoyo_domain_info *domain,
1292                                     struct file *filp)
1293 {
1294         int error = -ENOMEM;
1295         const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1296         const bool is_enforce = (mode == 3);
1297         struct tomoyo_path_info *buf;
1298         int idx;
1299
1300         if (!mode || !filp->f_path.mnt)
1301                 return 0;
1302
1303         idx = tomoyo_read_lock();
1304         buf = tomoyo_get_path(&filp->f_path);
1305         if (!buf)
1306                 goto out;
1307         if (!tomoyo_is_no_rewrite_file(buf)) {
1308                 error = 0;
1309                 goto out;
1310         }
1311         error = tomoyo_check_single_path_permission2(domain,
1312                                                      TOMOYO_TYPE_REWRITE_ACL,
1313                                                      buf, mode);
1314  out:
1315         tomoyo_free(buf);
1316         tomoyo_read_unlock(idx);
1317         if (!is_enforce)
1318                 error = 0;
1319         return error;
1320 }
1321
1322 /**
1323  * tomoyo_check_2path_perm - Check permission for "rename", "link" and "pivot_root".
1324  *
1325  * @domain:    Pointer to "struct tomoyo_domain_info".
1326  * @operation: Type of operation.
1327  * @path1:      Pointer to "struct path".
1328  * @path2:      Pointer to "struct path".
1329  *
1330  * Returns 0 on success, negative value otherwise.
1331  */
1332 int tomoyo_check_2path_perm(struct tomoyo_domain_info * const domain,
1333                             const u8 operation, struct path *path1,
1334                             struct path *path2)
1335 {
1336         int error = -ENOMEM;
1337         struct tomoyo_path_info *buf1, *buf2;
1338         const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1339         const bool is_enforce = (mode == 3);
1340         const char *msg;
1341         int idx;
1342
1343         if (!mode || !path1->mnt || !path2->mnt)
1344                 return 0;
1345         idx = tomoyo_read_lock();
1346         buf1 = tomoyo_get_path(path1);
1347         buf2 = tomoyo_get_path(path2);
1348         if (!buf1 || !buf2)
1349                 goto out;
1350         {
1351                 struct dentry *dentry = path1->dentry;
1352                 if (dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode)) {
1353                         /*
1354                          * tomoyo_get_path() reserves space for appending "/."
1355                          */
1356                         if (!buf1->is_dir) {
1357                                 strcat((char *) buf1->name, "/");
1358                                 tomoyo_fill_path_info(buf1);
1359                         }
1360                         if (!buf2->is_dir) {
1361                                 strcat((char *) buf2->name, "/");
1362                                 tomoyo_fill_path_info(buf2);
1363                         }
1364                 }
1365         }
1366         error = tomoyo_check_double_path_acl(domain, operation, buf1, buf2);
1367         msg = tomoyo_dp2keyword(operation);
1368         if (!error)
1369                 goto out;
1370         if (tomoyo_verbose_mode(domain))
1371                 printk(KERN_WARNING "TOMOYO-%s: Access '%s %s %s' "
1372                        "denied for %s\n", tomoyo_get_msg(is_enforce),
1373                        msg, buf1->name, buf2->name,
1374                        tomoyo_get_last_name(domain));
1375         if (mode == 1 && tomoyo_domain_quota_is_ok(domain)) {
1376                 const char *name1 = tomoyo_get_file_pattern(buf1)->name;
1377                 const char *name2 = tomoyo_get_file_pattern(buf2)->name;
1378                 tomoyo_update_double_path_acl(operation, name1, name2, domain,
1379                                               false);
1380         }
1381  out:
1382         tomoyo_free(buf1);
1383         tomoyo_free(buf2);
1384         tomoyo_read_unlock(idx);
1385         if (!is_enforce)
1386                 error = 0;
1387         return error;
1388 }