linux-toradex.git/security/tomoyo/domain.c, branch v3.0.69

TOMOYO: Use pathname specified by policy rather than execve()

2010-08-02T05:38:38+00:00

Commit c9e69318 "TOMOYO: Allow wildcard for execute permission." changed execute
permission and domainname to accept wildcards. But tomoyo_find_next_domain()
was using pathname passed to execve() rather than pathname specified by the
execute permission. As a result, processes were not able to transit to domains
which contain wildcards in their domainnames.

This patch passes pathname specified by the execute permission back to
tomoyo_find_next_domain() so that processes can transit to domains which
contain wildcards in their domainnames.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Rename symbols.

2010-08-02T05:34:54+00:00

Use shorter name in order to make it easier to fit 80 columns limit.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Use common code for domain transition control.

2010-08-02T05:34:43+00:00

Use common code for "initialize_domain"/"no_initialize_domain"/"keep_domain"/
"no_keep_domain" keywords.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Remove alias keyword.

2010-08-02T05:34:42+00:00

Some programs behave differently depending on argv[0] passed to execve().
TOMOYO has "alias" keyword in order to allow administrators to define different
domains if requested pathname passed to execve() is a symlink. But "alias"
keyword is incomplete because this keyword assumes that requested pathname and
argv[0] are identical. Thus, remove "alias" keyword (by this patch) and add
syntax for checking argv[0] (by future patches).

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Aggregate reader functions.

2010-08-02T05:34:41+00:00

Now lists are accessible via array index. Aggregate reader functions using index.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Use array of "struct list_head".

2010-08-02T05:34:40+00:00

Assign list id and make the lists as array of "struct list_head".

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Rename symbols.

2010-08-02T05:34:33+00:00

Use shorter name in order to make it easier to fix 80 columns limit.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Use callback for permission check.

2010-08-02T05:34:32+00:00

We can use callback function since parameters are passed via
"const struct tomoyo_request_info".

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Use common code for open and mkdir etc.

2010-08-02T05:34:31+00:00

tomoyo_file_perm() and tomoyo_path_permission() are similar.
We can embed tomoyo_file_perm() into tomoyo_path_permission().

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris

TOMOYO: Use callback for updating entries.

2010-08-02T05:34:29+00:00

Use common code for elements using "struct list_head" + "bool" structure.

Signed-off-by: Tetsuo Handa 
Signed-off-by: James Morris