Merge branch 'for-4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
[firefly-linux-kernel-4.4.55.git] / security / tomoyo / condition.c
1 /*
2  * security/tomoyo/condition.c
3  *
4  * Copyright (C) 2005-2011  NTT DATA CORPORATION
5  */
6
7 #include "common.h"
8 #include <linux/slab.h>
9
10 /* List of "struct tomoyo_condition". */
11 LIST_HEAD(tomoyo_condition_list);
12
13 /**
14  * tomoyo_argv - Check argv[] in "struct linux_binbrm".
15  *
16  * @index:   Index number of @arg_ptr.
17  * @arg_ptr: Contents of argv[@index].
18  * @argc:    Length of @argv.
19  * @argv:    Pointer to "struct tomoyo_argv".
20  * @checked: Set to true if @argv[@index] was found.
21  *
22  * Returns true on success, false otherwise.
23  */
24 static bool tomoyo_argv(const unsigned int index, const char *arg_ptr,
25                         const int argc, const struct tomoyo_argv *argv,
26                         u8 *checked)
27 {
28         int i;
29         struct tomoyo_path_info arg;
30         arg.name = arg_ptr;
31         for (i = 0; i < argc; argv++, checked++, i++) {
32                 bool result;
33                 if (index != argv->index)
34                         continue;
35                 *checked = 1;
36                 tomoyo_fill_path_info(&arg);
37                 result = tomoyo_path_matches_pattern(&arg, argv->value);
38                 if (argv->is_not)
39                         result = !result;
40                 if (!result)
41                         return false;
42         }
43         return true;
44 }
45
46 /**
47  * tomoyo_envp - Check envp[] in "struct linux_binbrm".
48  *
49  * @env_name:  The name of environment variable.
50  * @env_value: The value of environment variable.
51  * @envc:      Length of @envp.
52  * @envp:      Pointer to "struct tomoyo_envp".
53  * @checked:   Set to true if @envp[@env_name] was found.
54  *
55  * Returns true on success, false otherwise.
56  */
57 static bool tomoyo_envp(const char *env_name, const char *env_value,
58                         const int envc, const struct tomoyo_envp *envp,
59                         u8 *checked)
60 {
61         int i;
62         struct tomoyo_path_info name;
63         struct tomoyo_path_info value;
64         name.name = env_name;
65         tomoyo_fill_path_info(&name);
66         value.name = env_value;
67         tomoyo_fill_path_info(&value);
68         for (i = 0; i < envc; envp++, checked++, i++) {
69                 bool result;
70                 if (!tomoyo_path_matches_pattern(&name, envp->name))
71                         continue;
72                 *checked = 1;
73                 if (envp->value) {
74                         result = tomoyo_path_matches_pattern(&value,
75                                                              envp->value);
76                         if (envp->is_not)
77                                 result = !result;
78                 } else {
79                         result = true;
80                         if (!envp->is_not)
81                                 result = !result;
82                 }
83                 if (!result)
84                         return false;
85         }
86         return true;
87 }
88
89 /**
90  * tomoyo_scan_bprm - Scan "struct linux_binprm".
91  *
92  * @ee:   Pointer to "struct tomoyo_execve".
93  * @argc: Length of @argc.
94  * @argv: Pointer to "struct tomoyo_argv".
95  * @envc: Length of @envp.
96  * @envp: Poiner to "struct tomoyo_envp".
97  *
98  * Returns true on success, false otherwise.
99  */
100 static bool tomoyo_scan_bprm(struct tomoyo_execve *ee,
101                              const u16 argc, const struct tomoyo_argv *argv,
102                              const u16 envc, const struct tomoyo_envp *envp)
103 {
104         struct linux_binprm *bprm = ee->bprm;
105         struct tomoyo_page_dump *dump = &ee->dump;
106         char *arg_ptr = ee->tmp;
107         int arg_len = 0;
108         unsigned long pos = bprm->p;
109         int offset = pos % PAGE_SIZE;
110         int argv_count = bprm->argc;
111         int envp_count = bprm->envc;
112         bool result = true;
113         u8 local_checked[32];
114         u8 *checked;
115         if (argc + envc <= sizeof(local_checked)) {
116                 checked = local_checked;
117                 memset(local_checked, 0, sizeof(local_checked));
118         } else {
119                 checked = kzalloc(argc + envc, GFP_NOFS);
120                 if (!checked)
121                         return false;
122         }
123         while (argv_count || envp_count) {
124                 if (!tomoyo_dump_page(bprm, pos, dump)) {
125                         result = false;
126                         goto out;
127                 }
128                 pos += PAGE_SIZE - offset;
129                 while (offset < PAGE_SIZE) {
130                         /* Read. */
131                         const char *kaddr = dump->data;
132                         const unsigned char c = kaddr[offset++];
133                         if (c && arg_len < TOMOYO_EXEC_TMPSIZE - 10) {
134                                 if (c == '\\') {
135                                         arg_ptr[arg_len++] = '\\';
136                                         arg_ptr[arg_len++] = '\\';
137                                 } else if (c > ' ' && c < 127) {
138                                         arg_ptr[arg_len++] = c;
139                                 } else {
140                                         arg_ptr[arg_len++] = '\\';
141                                         arg_ptr[arg_len++] = (c >> 6) + '0';
142                                         arg_ptr[arg_len++] =
143                                                 ((c >> 3) & 7) + '0';
144                                         arg_ptr[arg_len++] = (c & 7) + '0';
145                                 }
146                         } else {
147                                 arg_ptr[arg_len] = '\0';
148                         }
149                         if (c)
150                                 continue;
151                         /* Check. */
152                         if (argv_count) {
153                                 if (!tomoyo_argv(bprm->argc - argv_count,
154                                                  arg_ptr, argc, argv,
155                                                  checked)) {
156                                         result = false;
157                                         break;
158                                 }
159                                 argv_count--;
160                         } else if (envp_count) {
161                                 char *cp = strchr(arg_ptr, '=');
162                                 if (cp) {
163                                         *cp = '\0';
164                                         if (!tomoyo_envp(arg_ptr, cp + 1,
165                                                          envc, envp,
166                                                          checked + argc)) {
167                                                 result = false;
168                                                 break;
169                                         }
170                                 }
171                                 envp_count--;
172                         } else {
173                                 break;
174                         }
175                         arg_len = 0;
176                 }
177                 offset = 0;
178                 if (!result)
179                         break;
180         }
181 out:
182         if (result) {
183                 int i;
184                 /* Check not-yet-checked entries. */
185                 for (i = 0; i < argc; i++) {
186                         if (checked[i])
187                                 continue;
188                         /*
189                          * Return true only if all unchecked indexes in
190                          * bprm->argv[] are not matched.
191                          */
192                         if (argv[i].is_not)
193                                 continue;
194                         result = false;
195                         break;
196                 }
197                 for (i = 0; i < envc; envp++, i++) {
198                         if (checked[argc + i])
199                                 continue;
200                         /*
201                          * Return true only if all unchecked environ variables
202                          * in bprm->envp[] are either undefined or not matched.
203                          */
204                         if ((!envp->value && !envp->is_not) ||
205                             (envp->value && envp->is_not))
206                                 continue;
207                         result = false;
208                         break;
209                 }
210         }
211         if (checked != local_checked)
212                 kfree(checked);
213         return result;
214 }
215
216 /**
217  * tomoyo_scan_exec_realpath - Check "exec.realpath" parameter of "struct tomoyo_condition".
218  *
219  * @file:  Pointer to "struct file".
220  * @ptr:   Pointer to "struct tomoyo_name_union".
221  * @match: True if "exec.realpath=", false if "exec.realpath!=".
222  *
223  * Returns true on success, false otherwise.
224  */
225 static bool tomoyo_scan_exec_realpath(struct file *file,
226                                       const struct tomoyo_name_union *ptr,
227                                       const bool match)
228 {
229         bool result;
230         struct tomoyo_path_info exe;
231         if (!file)
232                 return false;
233         exe.name = tomoyo_realpath_from_path(&file->f_path);
234         if (!exe.name)
235                 return false;
236         tomoyo_fill_path_info(&exe);
237         result = tomoyo_compare_name_union(&exe, ptr);
238         kfree(exe.name);
239         return result == match;
240 }
241
242 /**
243  * tomoyo_get_dqword - tomoyo_get_name() for a quoted string.
244  *
245  * @start: String to save.
246  *
247  * Returns pointer to "struct tomoyo_path_info" on success, NULL otherwise.
248  */
249 static const struct tomoyo_path_info *tomoyo_get_dqword(char *start)
250 {
251         char *cp = start + strlen(start) - 1;
252         if (cp == start || *start++ != '"' || *cp != '"')
253                 return NULL;
254         *cp = '\0';
255         if (*start && !tomoyo_correct_word(start))
256                 return NULL;
257         return tomoyo_get_name(start);
258 }
259
260 /**
261  * tomoyo_parse_name_union_quoted - Parse a quoted word.
262  *
263  * @param: Pointer to "struct tomoyo_acl_param".
264  * @ptr:   Pointer to "struct tomoyo_name_union".
265  *
266  * Returns true on success, false otherwise.
267  */
268 static bool tomoyo_parse_name_union_quoted(struct tomoyo_acl_param *param,
269                                            struct tomoyo_name_union *ptr)
270 {
271         char *filename = param->data;
272         if (*filename == '@')
273                 return tomoyo_parse_name_union(param, ptr);
274         ptr->filename = tomoyo_get_dqword(filename);
275         return ptr->filename != NULL;
276 }
277
278 /**
279  * tomoyo_parse_argv - Parse an argv[] condition part.
280  *
281  * @left:  Lefthand value.
282  * @right: Righthand value.
283  * @argv:  Pointer to "struct tomoyo_argv".
284  *
285  * Returns true on success, false otherwise.
286  */
287 static bool tomoyo_parse_argv(char *left, char *right,
288                               struct tomoyo_argv *argv)
289 {
290         if (tomoyo_parse_ulong(&argv->index, &left) !=
291             TOMOYO_VALUE_TYPE_DECIMAL || *left++ != ']' || *left)
292                 return false;
293         argv->value = tomoyo_get_dqword(right);
294         return argv->value != NULL;
295 }
296
297 /**
298  * tomoyo_parse_envp - Parse an envp[] condition part.
299  *
300  * @left:  Lefthand value.
301  * @right: Righthand value.
302  * @envp:  Pointer to "struct tomoyo_envp".
303  *
304  * Returns true on success, false otherwise.
305  */
306 static bool tomoyo_parse_envp(char *left, char *right,
307                               struct tomoyo_envp *envp)
308 {
309         const struct tomoyo_path_info *name;
310         const struct tomoyo_path_info *value;
311         char *cp = left + strlen(left) - 1;
312         if (*cp-- != ']' || *cp != '"')
313                 goto out;
314         *cp = '\0';
315         if (!tomoyo_correct_word(left))
316                 goto out;
317         name = tomoyo_get_name(left);
318         if (!name)
319                 goto out;
320         if (!strcmp(right, "NULL")) {
321                 value = NULL;
322         } else {
323                 value = tomoyo_get_dqword(right);
324                 if (!value) {
325                         tomoyo_put_name(name);
326                         goto out;
327                 }
328         }
329         envp->name = name;
330         envp->value = value;
331         return true;
332 out:
333         return false;
334 }
335
336 /**
337  * tomoyo_same_condition - Check for duplicated "struct tomoyo_condition" entry.
338  *
339  * @a: Pointer to "struct tomoyo_condition".
340  * @b: Pointer to "struct tomoyo_condition".
341  *
342  * Returns true if @a == @b, false otherwise.
343  */
344 static inline bool tomoyo_same_condition(const struct tomoyo_condition *a,
345                                          const struct tomoyo_condition *b)
346 {
347         return a->size == b->size && a->condc == b->condc &&
348                 a->numbers_count == b->numbers_count &&
349                 a->names_count == b->names_count &&
350                 a->argc == b->argc && a->envc == b->envc &&
351                 a->grant_log == b->grant_log && a->transit == b->transit &&
352                 !memcmp(a + 1, b + 1, a->size - sizeof(*a));
353 }
354
355 /**
356  * tomoyo_condition_type - Get condition type.
357  *
358  * @word: Keyword string.
359  *
360  * Returns one of values in "enum tomoyo_conditions_index" on success,
361  * TOMOYO_MAX_CONDITION_KEYWORD otherwise.
362  */
363 static u8 tomoyo_condition_type(const char *word)
364 {
365         u8 i;
366         for (i = 0; i < TOMOYO_MAX_CONDITION_KEYWORD; i++) {
367                 if (!strcmp(word, tomoyo_condition_keyword[i]))
368                         break;
369         }
370         return i;
371 }
372
373 /* Define this to enable debug mode. */
374 /* #define DEBUG_CONDITION */
375
376 #ifdef DEBUG_CONDITION
377 #define dprintk printk
378 #else
379 #define dprintk(...) do { } while (0)
380 #endif
381
382 /**
383  * tomoyo_commit_condition - Commit "struct tomoyo_condition".
384  *
385  * @entry: Pointer to "struct tomoyo_condition".
386  *
387  * Returns pointer to "struct tomoyo_condition" on success, NULL otherwise.
388  *
389  * This function merges duplicated entries. This function returns NULL if
390  * @entry is not duplicated but memory quota for policy has exceeded.
391  */
392 static struct tomoyo_condition *tomoyo_commit_condition
393 (struct tomoyo_condition *entry)
394 {
395         struct tomoyo_condition *ptr;
396         bool found = false;
397         if (mutex_lock_interruptible(&tomoyo_policy_lock)) {
398                 dprintk(KERN_WARNING "%u: %s failed\n", __LINE__, __func__);
399                 ptr = NULL;
400                 found = true;
401                 goto out;
402         }
403         list_for_each_entry(ptr, &tomoyo_condition_list, head.list) {
404                 if (!tomoyo_same_condition(ptr, entry) ||
405                     atomic_read(&ptr->head.users) == TOMOYO_GC_IN_PROGRESS)
406                         continue;
407                 /* Same entry found. Share this entry. */
408                 atomic_inc(&ptr->head.users);
409                 found = true;
410                 break;
411         }
412         if (!found) {
413                 if (tomoyo_memory_ok(entry)) {
414                         atomic_set(&entry->head.users, 1);
415                         list_add(&entry->head.list, &tomoyo_condition_list);
416                 } else {
417                         found = true;
418                         ptr = NULL;
419                 }
420         }
421         mutex_unlock(&tomoyo_policy_lock);
422 out:
423         if (found) {
424                 tomoyo_del_condition(&entry->head.list);
425                 kfree(entry);
426                 entry = ptr;
427         }
428         return entry;
429 }
430
431 /**
432  * tomoyo_get_transit_preference - Parse domain transition preference for execve().
433  *
434  * @param: Pointer to "struct tomoyo_acl_param".
435  * @e:     Pointer to "struct tomoyo_condition".
436  *
437  * Returns the condition string part.
438  */
439 static char *tomoyo_get_transit_preference(struct tomoyo_acl_param *param,
440                                            struct tomoyo_condition *e)
441 {
442         char * const pos = param->data;
443         bool flag;
444         if (*pos == '<') {
445                 e->transit = tomoyo_get_domainname(param);
446                 goto done;
447         }
448         {
449                 char *cp = strchr(pos, ' ');
450                 if (cp)
451                         *cp = '\0';
452                 flag = tomoyo_correct_path(pos) || !strcmp(pos, "keep") ||
453                         !strcmp(pos, "initialize") || !strcmp(pos, "reset") ||
454                         !strcmp(pos, "child") || !strcmp(pos, "parent");
455                 if (cp)
456                         *cp = ' ';
457         }
458         if (!flag)
459                 return pos;
460         e->transit = tomoyo_get_name(tomoyo_read_token(param));
461 done:
462         if (e->transit)
463                 return param->data;
464         /*
465          * Return a bad read-only condition string that will let
466          * tomoyo_get_condition() return NULL.
467          */
468         return "/";
469 }
470
471 /**
472  * tomoyo_get_condition - Parse condition part.
473  *
474  * @param: Pointer to "struct tomoyo_acl_param".
475  *
476  * Returns pointer to "struct tomoyo_condition" on success, NULL otherwise.
477  */
478 struct tomoyo_condition *tomoyo_get_condition(struct tomoyo_acl_param *param)
479 {
480         struct tomoyo_condition *entry = NULL;
481         struct tomoyo_condition_element *condp = NULL;
482         struct tomoyo_number_union *numbers_p = NULL;
483         struct tomoyo_name_union *names_p = NULL;
484         struct tomoyo_argv *argv = NULL;
485         struct tomoyo_envp *envp = NULL;
486         struct tomoyo_condition e = { };
487         char * const start_of_string =
488                 tomoyo_get_transit_preference(param, &e);
489         char * const end_of_string = start_of_string + strlen(start_of_string);
490         char *pos;
491 rerun:
492         pos = start_of_string;
493         while (1) {
494                 u8 left = -1;
495                 u8 right = -1;
496                 char *left_word = pos;
497                 char *cp;
498                 char *right_word;
499                 bool is_not;
500                 if (!*left_word)
501                         break;
502                 /*
503                  * Since left-hand condition does not allow use of "path_group"
504                  * or "number_group" and environment variable's names do not
505                  * accept '=', it is guaranteed that the original line consists
506                  * of one or more repetition of $left$operator$right blocks
507                  * where "$left is free from '=' and ' '" and "$operator is
508                  * either '=' or '!='" and "$right is free from ' '".
509                  * Therefore, we can reconstruct the original line at the end
510                  * of dry run even if we overwrite $operator with '\0'.
511                  */
512                 cp = strchr(pos, ' ');
513                 if (cp) {
514                         *cp = '\0'; /* Will restore later. */
515                         pos = cp + 1;
516                 } else {
517                         pos = "";
518                 }
519                 right_word = strchr(left_word, '=');
520                 if (!right_word || right_word == left_word)
521                         goto out;
522                 is_not = *(right_word - 1) == '!';
523                 if (is_not)
524                         *(right_word++ - 1) = '\0'; /* Will restore later. */
525                 else if (*(right_word + 1) != '=')
526                         *right_word++ = '\0'; /* Will restore later. */
527                 else
528                         goto out;
529                 dprintk(KERN_WARNING "%u: <%s>%s=<%s>\n", __LINE__, left_word,
530                         is_not ? "!" : "", right_word);
531                 if (!strcmp(left_word, "grant_log")) {
532                         if (entry) {
533                                 if (is_not ||
534                                     entry->grant_log != TOMOYO_GRANTLOG_AUTO)
535                                         goto out;
536                                 else if (!strcmp(right_word, "yes"))
537                                         entry->grant_log = TOMOYO_GRANTLOG_YES;
538                                 else if (!strcmp(right_word, "no"))
539                                         entry->grant_log = TOMOYO_GRANTLOG_NO;
540                                 else
541                                         goto out;
542                         }
543                         continue;
544                 }
545                 if (!strncmp(left_word, "exec.argv[", 10)) {
546                         if (!argv) {
547                                 e.argc++;
548                                 e.condc++;
549                         } else {
550                                 e.argc--;
551                                 e.condc--;
552                                 left = TOMOYO_ARGV_ENTRY;
553                                 argv->is_not = is_not;
554                                 if (!tomoyo_parse_argv(left_word + 10,
555                                                        right_word, argv++))
556                                         goto out;
557                         }
558                         goto store_value;
559                 }
560                 if (!strncmp(left_word, "exec.envp[\"", 11)) {
561                         if (!envp) {
562                                 e.envc++;
563                                 e.condc++;
564                         } else {
565                                 e.envc--;
566                                 e.condc--;
567                                 left = TOMOYO_ENVP_ENTRY;
568                                 envp->is_not = is_not;
569                                 if (!tomoyo_parse_envp(left_word + 11,
570                                                        right_word, envp++))
571                                         goto out;
572                         }
573                         goto store_value;
574                 }
575                 left = tomoyo_condition_type(left_word);
576                 dprintk(KERN_WARNING "%u: <%s> left=%u\n", __LINE__, left_word,
577                         left);
578                 if (left == TOMOYO_MAX_CONDITION_KEYWORD) {
579                         if (!numbers_p) {
580                                 e.numbers_count++;
581                         } else {
582                                 e.numbers_count--;
583                                 left = TOMOYO_NUMBER_UNION;
584                                 param->data = left_word;
585                                 if (*left_word == '@' ||
586                                     !tomoyo_parse_number_union(param,
587                                                                numbers_p++))
588                                         goto out;
589                         }
590                 }
591                 if (!condp)
592                         e.condc++;
593                 else
594                         e.condc--;
595                 if (left == TOMOYO_EXEC_REALPATH ||
596                     left == TOMOYO_SYMLINK_TARGET) {
597                         if (!names_p) {
598                                 e.names_count++;
599                         } else {
600                                 e.names_count--;
601                                 right = TOMOYO_NAME_UNION;
602                                 param->data = right_word;
603                                 if (!tomoyo_parse_name_union_quoted(param,
604                                                                     names_p++))
605                                         goto out;
606                         }
607                         goto store_value;
608                 }
609                 right = tomoyo_condition_type(right_word);
610                 if (right == TOMOYO_MAX_CONDITION_KEYWORD) {
611                         if (!numbers_p) {
612                                 e.numbers_count++;
613                         } else {
614                                 e.numbers_count--;
615                                 right = TOMOYO_NUMBER_UNION;
616                                 param->data = right_word;
617                                 if (!tomoyo_parse_number_union(param,
618                                                                numbers_p++))
619                                         goto out;
620                         }
621                 }
622 store_value:
623                 if (!condp) {
624                         dprintk(KERN_WARNING "%u: dry_run left=%u right=%u "
625                                 "match=%u\n", __LINE__, left, right, !is_not);
626                         continue;
627                 }
628                 condp->left = left;
629                 condp->right = right;
630                 condp->equals = !is_not;
631                 dprintk(KERN_WARNING "%u: left=%u right=%u match=%u\n",
632                         __LINE__, condp->left, condp->right,
633                         condp->equals);
634                 condp++;
635         }
636         dprintk(KERN_INFO "%u: cond=%u numbers=%u names=%u ac=%u ec=%u\n",
637                 __LINE__, e.condc, e.numbers_count, e.names_count, e.argc,
638                 e.envc);
639         if (entry) {
640                 BUG_ON(e.names_count | e.numbers_count | e.argc | e.envc |
641                        e.condc);
642                 return tomoyo_commit_condition(entry);
643         }
644         e.size = sizeof(*entry)
645                 + e.condc * sizeof(struct tomoyo_condition_element)
646                 + e.numbers_count * sizeof(struct tomoyo_number_union)
647                 + e.names_count * sizeof(struct tomoyo_name_union)
648                 + e.argc * sizeof(struct tomoyo_argv)
649                 + e.envc * sizeof(struct tomoyo_envp);
650         entry = kzalloc(e.size, GFP_NOFS);
651         if (!entry)
652                 goto out2;
653         *entry = e;
654         e.transit = NULL;
655         condp = (struct tomoyo_condition_element *) (entry + 1);
656         numbers_p = (struct tomoyo_number_union *) (condp + e.condc);
657         names_p = (struct tomoyo_name_union *) (numbers_p + e.numbers_count);
658         argv = (struct tomoyo_argv *) (names_p + e.names_count);
659         envp = (struct tomoyo_envp *) (argv + e.argc);
660         {
661                 bool flag = false;
662                 for (pos = start_of_string; pos < end_of_string; pos++) {
663                         if (*pos)
664                                 continue;
665                         if (flag) /* Restore " ". */
666                                 *pos = ' ';
667                         else if (*(pos + 1) == '=') /* Restore "!=". */
668                                 *pos = '!';
669                         else /* Restore "=". */
670                                 *pos = '=';
671                         flag = !flag;
672                 }
673         }
674         goto rerun;
675 out:
676         dprintk(KERN_WARNING "%u: %s failed\n", __LINE__, __func__);
677         if (entry) {
678                 tomoyo_del_condition(&entry->head.list);
679                 kfree(entry);
680         }
681 out2:
682         tomoyo_put_name(e.transit);
683         return NULL;
684 }
685
686 /**
687  * tomoyo_get_attributes - Revalidate "struct inode".
688  *
689  * @obj: Pointer to "struct tomoyo_obj_info".
690  *
691  * Returns nothing.
692  */
693 void tomoyo_get_attributes(struct tomoyo_obj_info *obj)
694 {
695         u8 i;
696         struct dentry *dentry = NULL;
697
698         for (i = 0; i < TOMOYO_MAX_PATH_STAT; i++) {
699                 struct inode *inode;
700                 switch (i) {
701                 case TOMOYO_PATH1:
702                         dentry = obj->path1.dentry;
703                         if (!dentry)
704                                 continue;
705                         break;
706                 case TOMOYO_PATH2:
707                         dentry = obj->path2.dentry;
708                         if (!dentry)
709                                 continue;
710                         break;
711                 default:
712                         if (!dentry)
713                                 continue;
714                         dentry = dget_parent(dentry);
715                         break;
716                 }
717                 inode = d_backing_inode(dentry);
718                 if (inode) {
719                         struct tomoyo_mini_stat *stat = &obj->stat[i];
720                         stat->uid  = inode->i_uid;
721                         stat->gid  = inode->i_gid;
722                         stat->ino  = inode->i_ino;
723                         stat->mode = inode->i_mode;
724                         stat->dev  = inode->i_sb->s_dev;
725                         stat->rdev = inode->i_rdev;
726                         obj->stat_valid[i] = true;
727                 }
728                 if (i & 1) /* i == TOMOYO_PATH1_PARENT ||
729                               i == TOMOYO_PATH2_PARENT */
730                         dput(dentry);
731         }
732 }
733
734 /**
735  * tomoyo_condition - Check condition part.
736  *
737  * @r:    Pointer to "struct tomoyo_request_info".
738  * @cond: Pointer to "struct tomoyo_condition". Maybe NULL.
739  *
740  * Returns true on success, false otherwise.
741  *
742  * Caller holds tomoyo_read_lock().
743  */
744 bool tomoyo_condition(struct tomoyo_request_info *r,
745                       const struct tomoyo_condition *cond)
746 {
747         u32 i;
748         unsigned long min_v[2] = { 0, 0 };
749         unsigned long max_v[2] = { 0, 0 };
750         const struct tomoyo_condition_element *condp;
751         const struct tomoyo_number_union *numbers_p;
752         const struct tomoyo_name_union *names_p;
753         const struct tomoyo_argv *argv;
754         const struct tomoyo_envp *envp;
755         struct tomoyo_obj_info *obj;
756         u16 condc;
757         u16 argc;
758         u16 envc;
759         struct linux_binprm *bprm = NULL;
760         if (!cond)
761                 return true;
762         condc = cond->condc;
763         argc = cond->argc;
764         envc = cond->envc;
765         obj = r->obj;
766         if (r->ee)
767                 bprm = r->ee->bprm;
768         if (!bprm && (argc || envc))
769                 return false;
770         condp = (struct tomoyo_condition_element *) (cond + 1);
771         numbers_p = (const struct tomoyo_number_union *) (condp + condc);
772         names_p = (const struct tomoyo_name_union *)
773                 (numbers_p + cond->numbers_count);
774         argv = (const struct tomoyo_argv *) (names_p + cond->names_count);
775         envp = (const struct tomoyo_envp *) (argv + argc);
776         for (i = 0; i < condc; i++) {
777                 const bool match = condp->equals;
778                 const u8 left = condp->left;
779                 const u8 right = condp->right;
780                 bool is_bitop[2] = { false, false };
781                 u8 j;
782                 condp++;
783                 /* Check argv[] and envp[] later. */
784                 if (left == TOMOYO_ARGV_ENTRY || left == TOMOYO_ENVP_ENTRY)
785                         continue;
786                 /* Check string expressions. */
787                 if (right == TOMOYO_NAME_UNION) {
788                         const struct tomoyo_name_union *ptr = names_p++;
789                         switch (left) {
790                                 struct tomoyo_path_info *symlink;
791                                 struct tomoyo_execve *ee;
792                                 struct file *file;
793                         case TOMOYO_SYMLINK_TARGET:
794                                 symlink = obj ? obj->symlink_target : NULL;
795                                 if (!symlink ||
796                                     !tomoyo_compare_name_union(symlink, ptr)
797                                     == match)
798                                         goto out;
799                                 break;
800                         case TOMOYO_EXEC_REALPATH:
801                                 ee = r->ee;
802                                 file = ee ? ee->bprm->file : NULL;
803                                 if (!tomoyo_scan_exec_realpath(file, ptr,
804                                                                match))
805                                         goto out;
806                                 break;
807                         }
808                         continue;
809                 }
810                 /* Check numeric or bit-op expressions. */
811                 for (j = 0; j < 2; j++) {
812                         const u8 index = j ? right : left;
813                         unsigned long value = 0;
814                         switch (index) {
815                         case TOMOYO_TASK_UID:
816                                 value = from_kuid(&init_user_ns, current_uid());
817                                 break;
818                         case TOMOYO_TASK_EUID:
819                                 value = from_kuid(&init_user_ns, current_euid());
820                                 break;
821                         case TOMOYO_TASK_SUID:
822                                 value = from_kuid(&init_user_ns, current_suid());
823                                 break;
824                         case TOMOYO_TASK_FSUID:
825                                 value = from_kuid(&init_user_ns, current_fsuid());
826                                 break;
827                         case TOMOYO_TASK_GID:
828                                 value = from_kgid(&init_user_ns, current_gid());
829                                 break;
830                         case TOMOYO_TASK_EGID:
831                                 value = from_kgid(&init_user_ns, current_egid());
832                                 break;
833                         case TOMOYO_TASK_SGID:
834                                 value = from_kgid(&init_user_ns, current_sgid());
835                                 break;
836                         case TOMOYO_TASK_FSGID:
837                                 value = from_kgid(&init_user_ns, current_fsgid());
838                                 break;
839                         case TOMOYO_TASK_PID:
840                                 value = tomoyo_sys_getpid();
841                                 break;
842                         case TOMOYO_TASK_PPID:
843                                 value = tomoyo_sys_getppid();
844                                 break;
845                         case TOMOYO_TYPE_IS_SOCKET:
846                                 value = S_IFSOCK;
847                                 break;
848                         case TOMOYO_TYPE_IS_SYMLINK:
849                                 value = S_IFLNK;
850                                 break;
851                         case TOMOYO_TYPE_IS_FILE:
852                                 value = S_IFREG;
853                                 break;
854                         case TOMOYO_TYPE_IS_BLOCK_DEV:
855                                 value = S_IFBLK;
856                                 break;
857                         case TOMOYO_TYPE_IS_DIRECTORY:
858                                 value = S_IFDIR;
859                                 break;
860                         case TOMOYO_TYPE_IS_CHAR_DEV:
861                                 value = S_IFCHR;
862                                 break;
863                         case TOMOYO_TYPE_IS_FIFO:
864                                 value = S_IFIFO;
865                                 break;
866                         case TOMOYO_MODE_SETUID:
867                                 value = S_ISUID;
868                                 break;
869                         case TOMOYO_MODE_SETGID:
870                                 value = S_ISGID;
871                                 break;
872                         case TOMOYO_MODE_STICKY:
873                                 value = S_ISVTX;
874                                 break;
875                         case TOMOYO_MODE_OWNER_READ:
876                                 value = S_IRUSR;
877                                 break;
878                         case TOMOYO_MODE_OWNER_WRITE:
879                                 value = S_IWUSR;
880                                 break;
881                         case TOMOYO_MODE_OWNER_EXECUTE:
882                                 value = S_IXUSR;
883                                 break;
884                         case TOMOYO_MODE_GROUP_READ:
885                                 value = S_IRGRP;
886                                 break;
887                         case TOMOYO_MODE_GROUP_WRITE:
888                                 value = S_IWGRP;
889                                 break;
890                         case TOMOYO_MODE_GROUP_EXECUTE:
891                                 value = S_IXGRP;
892                                 break;
893                         case TOMOYO_MODE_OTHERS_READ:
894                                 value = S_IROTH;
895                                 break;
896                         case TOMOYO_MODE_OTHERS_WRITE:
897                                 value = S_IWOTH;
898                                 break;
899                         case TOMOYO_MODE_OTHERS_EXECUTE:
900                                 value = S_IXOTH;
901                                 break;
902                         case TOMOYO_EXEC_ARGC:
903                                 if (!bprm)
904                                         goto out;
905                                 value = bprm->argc;
906                                 break;
907                         case TOMOYO_EXEC_ENVC:
908                                 if (!bprm)
909                                         goto out;
910                                 value = bprm->envc;
911                                 break;
912                         case TOMOYO_NUMBER_UNION:
913                                 /* Fetch values later. */
914                                 break;
915                         default:
916                                 if (!obj)
917                                         goto out;
918                                 if (!obj->validate_done) {
919                                         tomoyo_get_attributes(obj);
920                                         obj->validate_done = true;
921                                 }
922                                 {
923                                         u8 stat_index;
924                                         struct tomoyo_mini_stat *stat;
925                                         switch (index) {
926                                         case TOMOYO_PATH1_UID:
927                                         case TOMOYO_PATH1_GID:
928                                         case TOMOYO_PATH1_INO:
929                                         case TOMOYO_PATH1_MAJOR:
930                                         case TOMOYO_PATH1_MINOR:
931                                         case TOMOYO_PATH1_TYPE:
932                                         case TOMOYO_PATH1_DEV_MAJOR:
933                                         case TOMOYO_PATH1_DEV_MINOR:
934                                         case TOMOYO_PATH1_PERM:
935                                                 stat_index = TOMOYO_PATH1;
936                                                 break;
937                                         case TOMOYO_PATH2_UID:
938                                         case TOMOYO_PATH2_GID:
939                                         case TOMOYO_PATH2_INO:
940                                         case TOMOYO_PATH2_MAJOR:
941                                         case TOMOYO_PATH2_MINOR:
942                                         case TOMOYO_PATH2_TYPE:
943                                         case TOMOYO_PATH2_DEV_MAJOR:
944                                         case TOMOYO_PATH2_DEV_MINOR:
945                                         case TOMOYO_PATH2_PERM:
946                                                 stat_index = TOMOYO_PATH2;
947                                                 break;
948                                         case TOMOYO_PATH1_PARENT_UID:
949                                         case TOMOYO_PATH1_PARENT_GID:
950                                         case TOMOYO_PATH1_PARENT_INO:
951                                         case TOMOYO_PATH1_PARENT_PERM:
952                                                 stat_index =
953                                                         TOMOYO_PATH1_PARENT;
954                                                 break;
955                                         case TOMOYO_PATH2_PARENT_UID:
956                                         case TOMOYO_PATH2_PARENT_GID:
957                                         case TOMOYO_PATH2_PARENT_INO:
958                                         case TOMOYO_PATH2_PARENT_PERM:
959                                                 stat_index =
960                                                         TOMOYO_PATH2_PARENT;
961                                                 break;
962                                         default:
963                                                 goto out;
964                                         }
965                                         if (!obj->stat_valid[stat_index])
966                                                 goto out;
967                                         stat = &obj->stat[stat_index];
968                                         switch (index) {
969                                         case TOMOYO_PATH1_UID:
970                                         case TOMOYO_PATH2_UID:
971                                         case TOMOYO_PATH1_PARENT_UID:
972                                         case TOMOYO_PATH2_PARENT_UID:
973                                                 value = from_kuid(&init_user_ns, stat->uid);
974                                                 break;
975                                         case TOMOYO_PATH1_GID:
976                                         case TOMOYO_PATH2_GID:
977                                         case TOMOYO_PATH1_PARENT_GID:
978                                         case TOMOYO_PATH2_PARENT_GID:
979                                                 value = from_kgid(&init_user_ns, stat->gid);
980                                                 break;
981                                         case TOMOYO_PATH1_INO:
982                                         case TOMOYO_PATH2_INO:
983                                         case TOMOYO_PATH1_PARENT_INO:
984                                         case TOMOYO_PATH2_PARENT_INO:
985                                                 value = stat->ino;
986                                                 break;
987                                         case TOMOYO_PATH1_MAJOR:
988                                         case TOMOYO_PATH2_MAJOR:
989                                                 value = MAJOR(stat->dev);
990                                                 break;
991                                         case TOMOYO_PATH1_MINOR:
992                                         case TOMOYO_PATH2_MINOR:
993                                                 value = MINOR(stat->dev);
994                                                 break;
995                                         case TOMOYO_PATH1_TYPE:
996                                         case TOMOYO_PATH2_TYPE:
997                                                 value = stat->mode & S_IFMT;
998                                                 break;
999                                         case TOMOYO_PATH1_DEV_MAJOR:
1000                                         case TOMOYO_PATH2_DEV_MAJOR:
1001                                                 value = MAJOR(stat->rdev);
1002                                                 break;
1003                                         case TOMOYO_PATH1_DEV_MINOR:
1004                                         case TOMOYO_PATH2_DEV_MINOR:
1005                                                 value = MINOR(stat->rdev);
1006                                                 break;
1007                                         case TOMOYO_PATH1_PERM:
1008                                         case TOMOYO_PATH2_PERM:
1009                                         case TOMOYO_PATH1_PARENT_PERM:
1010                                         case TOMOYO_PATH2_PARENT_PERM:
1011                                                 value = stat->mode & S_IALLUGO;
1012                                                 break;
1013                                         }
1014                                 }
1015                                 break;
1016                         }
1017                         max_v[j] = value;
1018                         min_v[j] = value;
1019                         switch (index) {
1020                         case TOMOYO_MODE_SETUID:
1021                         case TOMOYO_MODE_SETGID:
1022                         case TOMOYO_MODE_STICKY:
1023                         case TOMOYO_MODE_OWNER_READ:
1024                         case TOMOYO_MODE_OWNER_WRITE:
1025                         case TOMOYO_MODE_OWNER_EXECUTE:
1026                         case TOMOYO_MODE_GROUP_READ:
1027                         case TOMOYO_MODE_GROUP_WRITE:
1028                         case TOMOYO_MODE_GROUP_EXECUTE:
1029                         case TOMOYO_MODE_OTHERS_READ:
1030                         case TOMOYO_MODE_OTHERS_WRITE:
1031                         case TOMOYO_MODE_OTHERS_EXECUTE:
1032                                 is_bitop[j] = true;
1033                         }
1034                 }
1035                 if (left == TOMOYO_NUMBER_UNION) {
1036                         /* Fetch values now. */
1037                         const struct tomoyo_number_union *ptr = numbers_p++;
1038                         min_v[0] = ptr->values[0];
1039                         max_v[0] = ptr->values[1];
1040                 }
1041                 if (right == TOMOYO_NUMBER_UNION) {
1042                         /* Fetch values now. */
1043                         const struct tomoyo_number_union *ptr = numbers_p++;
1044                         if (ptr->group) {
1045                                 if (tomoyo_number_matches_group(min_v[0],
1046                                                                 max_v[0],
1047                                                                 ptr->group)
1048                                     == match)
1049                                         continue;
1050                         } else {
1051                                 if ((min_v[0] <= ptr->values[1] &&
1052                                      max_v[0] >= ptr->values[0]) == match)
1053                                         continue;
1054                         }
1055                         goto out;
1056                 }
1057                 /*
1058                  * Bit operation is valid only when counterpart value
1059                  * represents permission.
1060                  */
1061                 if (is_bitop[0] && is_bitop[1]) {
1062                         goto out;
1063                 } else if (is_bitop[0]) {
1064                         switch (right) {
1065                         case TOMOYO_PATH1_PERM:
1066                         case TOMOYO_PATH1_PARENT_PERM:
1067                         case TOMOYO_PATH2_PERM:
1068                         case TOMOYO_PATH2_PARENT_PERM:
1069                                 if (!(max_v[0] & max_v[1]) == !match)
1070                                         continue;
1071                         }
1072                         goto out;
1073                 } else if (is_bitop[1]) {
1074                         switch (left) {
1075                         case TOMOYO_PATH1_PERM:
1076                         case TOMOYO_PATH1_PARENT_PERM:
1077                         case TOMOYO_PATH2_PERM:
1078                         case TOMOYO_PATH2_PARENT_PERM:
1079                                 if (!(max_v[0] & max_v[1]) == !match)
1080                                         continue;
1081                         }
1082                         goto out;
1083                 }
1084                 /* Normal value range comparison. */
1085                 if ((min_v[0] <= max_v[1] && max_v[0] >= min_v[1]) == match)
1086                         continue;
1087 out:
1088                 return false;
1089         }
1090         /* Check argv[] and envp[] now. */
1091         if (r->ee && (argc || envc))
1092                 return tomoyo_scan_bprm(r->ee, argc, argv, envc, envp);
1093         return true;
1094 }