Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bd03a3e4 authored by Tetsuo Handa's avatar Tetsuo Handa Committed by James Morris
Browse files

TOMOYO: Add policy namespace support. 



Mauras Olivier reported that it is difficult to use TOMOYO in LXC environments,
for TOMOYO cannot distinguish between environments outside the container and
environments inside the container since LXC environments are created using
pivot_root(). To address this problem, this patch introduces policy namespace.

Each policy namespace has its own set of domain policy, exception policy and
profiles, which are all independent of other namespaces. This independency
allows users to develop policy without worrying interference among namespaces.

Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 32997144

security/tomoyo/audit.c

+5 −3
Original line number Diff line number Diff line
@@ -151,13 +151,15 @@ static unsigned int tomoyo_log_count; 
/**

 * tomoyo_get_audit - Get audit mode.

 *

 * @ns:          Pointer to "struct tomoyo_policy_namespace".

 * @profile:     Profile number.

 * @index:       Index number of functionality.

 * @is_granted:  True if granted log, false otherwise.

 *

 * Returns true if this request should be audited, false otherwise.

 */

static bool tomoyo_get_audit(const u8 profile, const u8 index,

static bool tomoyo_get_audit(const struct tomoyo_policy_namespace *ns,

			     const u8 profile, const u8 index,

			     const bool is_granted)

{

	u8 mode;
@@ -165,7 +167,7 @@ static bool tomoyo_get_audit(const u8 profile, const u8 index, 
	struct tomoyo_profile *p;

	if (!tomoyo_policy_loaded)

		return false;

	p = tomoyo_profile(profile);

	p = tomoyo_profile(ns, profile);

	if (tomoyo_log_count >= p->pref[TOMOYO_PREF_MAX_AUDIT_LOG])

		return false;

	mode = p->config[index];
@@ -194,7 +196,7 @@ void tomoyo_write_log2(struct tomoyo_request_info *r, int len, const char *fmt, 
	char *buf;

	struct tomoyo_log *entry;

	bool quota_exceeded = false;

	if (!tomoyo_get_audit(r->profile, r->type, r->granted))

	if (!tomoyo_get_audit(r->domain->ns, r->profile, r->type, r->granted))

		goto out;

	buf = tomoyo_init_log(r, len, fmt, args);

	if (!buf)

security/tomoyo/common.c

+278 −105

File changed.

Preview size limit exceeded, changes collapsed.

security/tomoyo/common.h

+51 −12

File changed.

Preview size limit exceeded, changes collapsed.

security/tomoyo/domain.c

+260 −100

File changed.

Preview size limit exceeded, changes collapsed.

security/tomoyo/file.c

+1 −1
Original line number Diff line number Diff line
@@ -603,7 +603,7 @@ int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation, 
	int error;



	r->type = tomoyo_p2mac[operation];

	r->mode = tomoyo_get_mode(r->profile, r->type);

	r->mode = tomoyo_get_mode(r->domain->ns, r->profile, r->type);

	if (r->mode == TOMOYO_CONFIG_DISABLED)

		return 0;

	r->param_type = TOMOYO_TYPE_PATH_ACL;