31 Mar, 2011
1 commit
-
Fixes generated by 'codespell' and manually reviewed.
Signed-off-by: Lucas De Marchi
03 Mar, 2011
1 commit
-
In tomoyo_check_open_permission() since 2.6.36, TOMOYO was by error
recalculating already calculated pathname when checking allow_rewrite
permission. As a result, memory will leak whenever a file is opened for writing
without O_APPEND flag. Also, performance will degrade because TOMOYO is
calculating pathname regardless of profile configuration.
This patch fixes the leak and performance degrade.Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris
07 Jan, 2011
1 commit
-
Protect d_unhashed(dentry) condition with d_lock. This means keeping
DCACHE_UNHASHED bit in synch with hash manipulations.Signed-off-by: Nick Piggin
26 Oct, 2010
1 commit
-
All callers take dcache_lock just around the call to __d_path, so
take the lock into it in preparation of getting rid of dcache_lock.Signed-off-by: Christoph Hellwig
Signed-off-by: Al Viro
21 Oct, 2010
2 commits
-
Configuration files for TOMOYO 2.3 are not compatible with TOMOYO 2.2.
But current panic() message is too unfriendly and is confusing users.Signed-off-by: Tetsuo Handa
Reviewed-by: KOSAKI Motohiro
Signed-off-by: James Morris -
If domain is NULL then &domain->list is a bogus address. Let's leave
head->r.domain NULL instead of saving an unusable pointer.This is just a cleanup. The current code always checks head->r.eof
before dereferencing head->r.domain.Signed-off-by: Dan Carpenter
Acked-by: Tetsuo Handa
27 Sep, 2010
1 commit
-
System call entry functions sys_*() are never to be called from
general kernel code. The fact that they aren't declared in header
files should have been a clue. These functions also don't exist on
Alpha since it has sys_getxpid() instead.Signed-off-by: Ben Hutchings
Acked-by: Tetsuo Handa
Signed-off-by: James Morris
02 Aug, 2010
33 commits
-
Commit c9e69318 "TOMOYO: Allow wildcard for execute permission." changed execute
permission and domainname to accept wildcards. But tomoyo_find_next_domain()
was using pathname passed to execve() rather than pathname specified by the
execute permission. As a result, processes were not able to transit to domains
which contain wildcards in their domainnames.This patch passes pathname specified by the execute permission back to
tomoyo_find_next_domain() so that processes can transit to domains which
contain wildcards in their domainnames.Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Commit d74725b9 "TOMOYO: Use callback for updating entries." broke
tomoyo_domain_quota_is_ok() by counting deleted entries. It needs to
count non-deleted entries.Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
TOMOYO does not deal offset pointer. Thus seek operation makes
no sense. Changing default seek operation from default_llseek()
to no_llseek() might break some applications. Thus, explicitly
set noop_llseek().Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Commit 1dae08c "TOMOYO: Add interactive enforcing mode." forgot to register
poll() hook. As a result, /usr/sbin/tomoyo-queryd was doing busy loop.Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Use shorter name in order to make it easier to fit 80 columns limit.
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Split tomoyo_write_profile() into several functions.
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
When userspace program reads policy from /sys/kernel/security/tomoyo/
interface, TOMOYO uses line buffered mode. A line has at least one word.Commit 006dacc "TOMOYO: Support longer pathname." changed a word's max length
from 4000 bytes to max kmalloc()able bytes. By that commit, a line's max length
changed from 8192 bytes to more than max kmalloc()able bytes.Max number of words in a line remains finite. This patch changes the way of
buffering so that all words in a line are firstly directly copied to userspace
buffer as much as possible and are secondly queued for next read request.
Words queued are guaranteed to be valid until /sys/kernel/security/tomoyo/
interface is close()d.Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
tomoyo_print_..._acl() are similar. Merge them.
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Policy editor needs to know allow_execute entries in order to build domain
transition tree. Reading all entries is slow. Thus, allow reading only
allow_execute entries.Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Change list_for_each_cookie to
(1) start from current position rather than next position
(2) remove temporary cursor
(3) check that srcu_read_lock() is heldSigned-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Use common code for "initialize_domain"/"no_initialize_domain"/"keep_domain"/
"no_keep_domain" keywords.Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Some programs behave differently depending on argv[0] passed to execve().
TOMOYO has "alias" keyword in order to allow administrators to define different
domains if requested pathname passed to execve() is a symlink. But "alias"
keyword is incomplete because this keyword assumes that requested pathname and
argv[0] are identical. Thus, remove "alias" keyword (by this patch) and add
syntax for checking argv[0] (by future patches).Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Use common code for "path_group" and "number_group".
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Now lists are accessible via array index. Aggregate reader functions using index.
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Assign list id and make the lists as array of "struct list_head".
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
"struct tomoyo_path_group" and "struct tomoyo_number_group" are identical.
Rename tomoyo_path_group/tomoyo_number_group to tomoyo_group and
tomoyo_path_group_member to tomoyo_path_group and
tomoyo_number_group_member to tomoyo_unmber_group.Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Pass "struct list_head" to tomoyo_add_to_gc() and bring
list_del_rcu() to tomoyo_add_to_gc().Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Read functions do not fail. Make them from int to void.
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Embed tomoyo_path_number_perm2() into tomoyo_path_number_perm().
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Keyword strings are read-only. We can directly access them to reduce code size.
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
If invalid combination of mount flags are given, it will be rejected later.
Thus, no need for TOMOYO to reject invalid combination of mount flags.Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Use shorter name in order to make it easier to fix 80 columns limit.
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
We can use callback function since parameters are passed via
"const struct tomoyo_request_info".Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
To make it possible to use callback function, pass parameters via
"struct tomoyo_request_info".Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
tomoyo_file_perm() and tomoyo_path_permission() are similar.
We can embed tomoyo_file_perm() into tomoyo_path_permission().Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Use common code for elements using "struct list_head" + "bool" structure.
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Use common code for elements using "struct list_head" + "bool" structure.
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Use common "struct list_head" + "bool" structure.
Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Use common "struct list_head" + "bool" + "u8" structure and
use common code for elements using that structure.Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
This patch allows users to change access control mode for per-operation basis.
This feature comes from non LSM version of TOMOYO which is designed for
permitting users to use SELinux and TOMOYO at the same time.SELinux does not care filename in a directory whereas TOMOYO does. Change of
filename can change how the file is used. For example, renaming index.txt to
.htaccess will change how the file is used. Thus, letting SELinux to enforce
read()/write()/mmap() etc. restriction and letting TOMOYO to enforce rename()
restriction is an example usage of this feature.What is unfortunate for me is that currently LSM does not allow users to use
SELinux and LSM version of TOMOYO at the same time...Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
This patch allows users to aggregate programs which provide similar
functionality (e.g. /usr/bin/vi and /usr/bin/emacs ).Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris -
Some applications create and execute programs dynamically. We need to accept
wildcard for execute permission because such programs contain random suffix
in their filenames. This patch loosens up regulation of string parameters.Signed-off-by: Tetsuo Handa
Signed-off-by: James Morris