TOMOYO: Add socket operation restriction support. (059d84db) · Commits · e / devices / android_kernel_teracube_emerald

security/tomoyo/Kconfig

+2 −0

Original line number	Diff line number	Diff line
		config SECURITY_TOMOYO
		bool "TOMOYO Linux Support"
		depends on SECURITY
		depends on NET
		select SECURITYFS
		select SECURITY_PATH
		select SECURITY_NETWORK
		default n
		help
		This selects TOMOYO Linux, pathname-based access control.

security/tomoyo/Makefile

+1 −1

Original line number	Diff line number	Diff line
		obj-y = audit.o common.o condition.o domain.o environ.o file.o gc.o group.o load_policy.o memory.o mount.o realpath.o securityfs_if.o tomoyo.o util.o
		obj-y = audit.o common.o condition.o domain.o environ.o file.o gc.o group.o load_policy.o memory.o mount.o network.o realpath.o securityfs_if.o tomoyo.o util.o

		$(obj)/policy/profile.conf:
		@mkdir -p $(obj)/policy/

security/tomoyo/common.c

+98 −6

Original line number	Diff line number	Diff line
		@@ -44,10 +44,27 @@ const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX
		[TOMOYO_MAC_FILE_MOUNT] = "mount",
		[TOMOYO_MAC_FILE_UMOUNT] = "unmount",
		[TOMOYO_MAC_FILE_PIVOT_ROOT] = "pivot_root",
		/* CONFIG::network group */
		[TOMOYO_MAC_NETWORK_INET_STREAM_BIND] = "inet_stream_bind",
		[TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN] = "inet_stream_listen",
		[TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT] = "inet_stream_connect",
		[TOMOYO_MAC_NETWORK_INET_DGRAM_BIND] = "inet_dgram_bind",
		[TOMOYO_MAC_NETWORK_INET_DGRAM_SEND] = "inet_dgram_send",
		[TOMOYO_MAC_NETWORK_INET_RAW_BIND] = "inet_raw_bind",
		[TOMOYO_MAC_NETWORK_INET_RAW_SEND] = "inet_raw_send",
		[TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND] = "unix_stream_bind",
		[TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN] = "unix_stream_listen",
		[TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT] = "unix_stream_connect",
		[TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND] = "unix_dgram_bind",
		[TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND] = "unix_dgram_send",
		[TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND] = "unix_seqpacket_bind",
		[TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN] = "unix_seqpacket_listen",
		[TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT] = "unix_seqpacket_connect",
		/* CONFIG::misc group */
		[TOMOYO_MAC_ENVIRON] = "env",
		/* CONFIG group */
		[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_FILE] = "file",
		[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_NETWORK] = "network",
		[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_MISC] = "misc",
		};

		@@ -135,10 +152,19 @@ const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION] = {
		[TOMOYO_TYPE_UMOUNT] = "unmount",
		};

		/* String table for socket's operation. */
		const char * const tomoyo_socket_keyword[TOMOYO_MAX_NETWORK_OPERATION] = {
		[TOMOYO_NETWORK_BIND] = "bind",
		[TOMOYO_NETWORK_LISTEN] = "listen",
		[TOMOYO_NETWORK_CONNECT] = "connect",
		[TOMOYO_NETWORK_SEND] = "send",
		};

		/* String table for categories. */
		static const char * const tomoyo_category_keywords
		[TOMOYO_MAX_MAC_CATEGORY_INDEX] = {
		[TOMOYO_MAC_CATEGORY_FILE] = "file",
		[TOMOYO_MAC_CATEGORY_NETWORK] = "network",
		[TOMOYO_MAC_CATEGORY_MISC] = "misc",
		};

		@@ -1042,8 +1068,10 @@ static int tomoyo_write_domain2(struct tomoyo_policy_namespace *ns,
		static const struct {
		const char *keyword;
		int (write) (struct tomoyo_acl_param );
		} tomoyo_callback[2] = {
		} tomoyo_callback[4] = {
		{ "file ", tomoyo_write_file },
		{ "network inet ", tomoyo_write_inet_network },
		{ "network unix ", tomoyo_write_unix_network },
		{ "misc ", tomoyo_write_misc },
		};
		u8 i;
		@@ -1375,6 +1403,60 @@ static bool tomoyo_print_entry(struct tomoyo_io_buffer *head,
		tomoyo_print_number_union(head, &ptr->mode);
		tomoyo_print_number_union(head, &ptr->major);
		tomoyo_print_number_union(head, &ptr->minor);
		} else if (acl_type == TOMOYO_TYPE_INET_ACL) {
		struct tomoyo_inet_acl *ptr =
		container_of(acl, typeof(*ptr), head);
		const u8 perm = ptr->perm;

		for (bit = 0; bit < TOMOYO_MAX_NETWORK_OPERATION; bit++) {
		if (!(perm & (1 << bit)))
		continue;
		if (first) {
		tomoyo_set_group(head, "network inet ");
		tomoyo_set_string(head, tomoyo_proto_keyword
		[ptr->protocol]);
		tomoyo_set_space(head);
		first = false;
		} else {
		tomoyo_set_slash(head);
		}
		tomoyo_set_string(head, tomoyo_socket_keyword[bit]);
		}
		if (first)
		return true;
		tomoyo_set_space(head);
		if (ptr->address.group) {
		tomoyo_set_string(head, "@");
		tomoyo_set_string(head, ptr->address.group->group_name
		->name);
		} else {
		char buf[128];
		tomoyo_print_ip(buf, sizeof(buf), &ptr->address);
		tomoyo_io_printf(head, "%s", buf);
		}
		tomoyo_print_number_union(head, &ptr->port);
		} else if (acl_type == TOMOYO_TYPE_UNIX_ACL) {
		struct tomoyo_unix_acl *ptr =
		container_of(acl, typeof(*ptr), head);
		const u8 perm = ptr->perm;

		for (bit = 0; bit < TOMOYO_MAX_NETWORK_OPERATION; bit++) {
		if (!(perm & (1 << bit)))
		continue;
		if (first) {
		tomoyo_set_group(head, "network unix ");
		tomoyo_set_string(head, tomoyo_proto_keyword
		[ptr->protocol]);
		tomoyo_set_space(head);
		first = false;
		} else {
		tomoyo_set_slash(head);
		}
		tomoyo_set_string(head, tomoyo_socket_keyword[bit]);
		}
		if (first)
		return true;
		tomoyo_print_name_union(head, &ptr->name);
		} else if (acl_type == TOMOYO_TYPE_MOUNT_ACL) {
		struct tomoyo_mount_acl *ptr =
		container_of(acl, typeof(*ptr), head);
		@@ -1550,6 +1632,7 @@ static const char *tomoyo_transition_type[TOMOYO_MAX_TRANSITION_TYPE] = {
		static const char *tomoyo_group_name[TOMOYO_MAX_GROUP] = {
		[TOMOYO_PATH_GROUP] = "path_group ",
		[TOMOYO_NUMBER_GROUP] = "number_group ",
		[TOMOYO_ADDRESS_GROUP] = "address_group ",
		};

		/**
		@@ -1591,7 +1674,7 @@ static int tomoyo_write_exception(struct tomoyo_io_buffer *head)
		}

		/**
		* tomoyo_read_group - Read "struct tomoyo_path_group"/"struct tomoyo_number_group" list.
		* tomoyo_read_group - Read "struct tomoyo_path_group"/"struct tomoyo_number_group"/"struct tomoyo_address_group" list.
		*
		* @head: Pointer to "struct tomoyo_io_buffer".
		* @idx: Index number.
		@@ -1628,6 +1711,15 @@ static bool tomoyo_read_group(struct tomoyo_io_buffer *head, const int idx)
		(ptr,
		struct tomoyo_number_group,
		head)->number);
		} else if (idx == TOMOYO_ADDRESS_GROUP) {
		char buffer[128];

		struct tomoyo_address_group *member =
		container_of(ptr, typeof(*member),
		head);
		tomoyo_print_ip(buffer, sizeof(buffer),
		&member->address);
		tomoyo_io_printf(head, " %s", buffer);
		}
		tomoyo_set_lf(head);
		}

security/tomoyo/common.h

+126 −1

Original line number	Diff line number	Diff line
		@@ -23,6 +23,16 @@
		#include <linux/poll.h>
		#include <linux/binfmts.h>
		#include <linux/highmem.h>
		#include <linux/net.h>
		#include <linux/inet.h>
		#include <linux/in.h>
		#include <linux/in6.h>
		#include <linux/un.h>
		#include <net/sock.h>
		#include <net/af_unix.h>
		#include <net/ip.h>
		#include <net/ipv6.h>
		#include <net/udp.h>

		/******** Constants definitions. ********/

		@@ -34,6 +44,12 @@
		#define TOMOYO_HASH_BITS 8
		#define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS)

		/*
		* TOMOYO checks only SOCK_STREAM, SOCK_DGRAM, SOCK_RAW, SOCK_SEQPACKET.
		* Therefore, we don't need SOCK_MAX.
		*/
		#define TOMOYO_SOCK_MAX 6

		#define TOMOYO_EXEC_TMPSIZE 4096

		/* Profile number is an integer between 0 and 255. */
		@@ -136,6 +152,7 @@ enum tomoyo_mode_index {
		/* Index numbers for entry type. */
		enum tomoyo_policy_id {
		TOMOYO_ID_GROUP,
		TOMOYO_ID_ADDRESS_GROUP,
		TOMOYO_ID_PATH_GROUP,
		TOMOYO_ID_NUMBER_GROUP,
		TOMOYO_ID_TRANSITION_CONTROL,
		@@ -166,6 +183,7 @@ enum tomoyo_domain_info_flags_index {
		enum tomoyo_group_id {
		TOMOYO_PATH_GROUP,
		TOMOYO_NUMBER_GROUP,
		TOMOYO_ADDRESS_GROUP,
		TOMOYO_MAX_GROUP
		};

		@@ -196,6 +214,8 @@ enum tomoyo_acl_entry_type_index {
		TOMOYO_TYPE_PATH_NUMBER_ACL,
		TOMOYO_TYPE_MKDEV_ACL,
		TOMOYO_TYPE_MOUNT_ACL,
		TOMOYO_TYPE_INET_ACL,
		TOMOYO_TYPE_UNIX_ACL,
		TOMOYO_TYPE_ENV_ACL,
		};

		@@ -229,6 +249,15 @@ enum tomoyo_mkdev_acl_index {
		TOMOYO_MAX_MKDEV_OPERATION
		};

		/* Index numbers for socket operations. */
		enum tomoyo_network_acl_index {
		TOMOYO_NETWORK_BIND, /* bind() operation. */
		TOMOYO_NETWORK_LISTEN, /* listen() operation. */
		TOMOYO_NETWORK_CONNECT, /* connect() operation. */
		TOMOYO_NETWORK_SEND, /* send() operation. */
		TOMOYO_MAX_NETWORK_OPERATION
		};

		/* Index numbers for access controls with two pathnames. */
		enum tomoyo_path2_acl_index {
		TOMOYO_TYPE_LINK,
		@@ -301,6 +330,21 @@ enum tomoyo_mac_index {
		TOMOYO_MAC_FILE_MOUNT,
		TOMOYO_MAC_FILE_UMOUNT,
		TOMOYO_MAC_FILE_PIVOT_ROOT,
		TOMOYO_MAC_NETWORK_INET_STREAM_BIND,
		TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN,
		TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT,
		TOMOYO_MAC_NETWORK_INET_DGRAM_BIND,
		TOMOYO_MAC_NETWORK_INET_DGRAM_SEND,
		TOMOYO_MAC_NETWORK_INET_RAW_BIND,
		TOMOYO_MAC_NETWORK_INET_RAW_SEND,
		TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND,
		TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN,
		TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT,
		TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND,
		TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND,
		TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND,
		TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN,
		TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT,
		TOMOYO_MAC_ENVIRON,
		TOMOYO_MAX_MAC_INDEX
		};
		@@ -308,6 +352,7 @@ enum tomoyo_mac_index {
		/* Index numbers for category of functionality. */
		enum tomoyo_mac_category_index {
		TOMOYO_MAC_CATEGORY_FILE,
		TOMOYO_MAC_CATEGORY_NETWORK,
		TOMOYO_MAC_CATEGORY_MISC,
		TOMOYO_MAX_MAC_CATEGORY_INDEX
		};
		@@ -402,6 +447,22 @@ struct tomoyo_request_info {
		struct {
		const struct tomoyo_path_info *name;
		} environ;
		struct {
		const __be32 *address;
		u16 port;
		/* One of values smaller than TOMOYO_SOCK_MAX. */
		u8 protocol;
		/* One of values in "enum tomoyo_network_acl_index". */
		u8 operation;
		bool is_ipv6;
		} inet_network;
		struct {
		const struct tomoyo_path_info *address;
		/* One of values smaller than TOMOYO_SOCK_MAX. */
		u8 protocol;
		/* One of values in "enum tomoyo_network_acl_index". */
		u8 operation;
		} unix_network;
		struct {
		const struct tomoyo_path_info *type;
		const struct tomoyo_path_info *dir;
		@@ -448,7 +509,14 @@ struct tomoyo_number_union {
		u8 value_type[2];
		};

		/* Structure for "path_group"/"number_group" directive. */
		/* Structure for holding an IP address. */
		struct tomoyo_ipaddr_union {
		struct in6_addr ip[2]; /* Big endian. */
		struct tomoyo_group group; / Pointer to address group. */
		bool is_ipv6; /* Valid only if @group == NULL. */
		};

		/* Structure for "path_group"/"number_group"/"address_group" directive. */
		struct tomoyo_group {
		struct tomoyo_shared_acl_head head;
		const struct tomoyo_path_info *group_name;
		@@ -467,6 +535,13 @@ struct tomoyo_number_group {
		struct tomoyo_number_union number;
		};

		/* Structure for "address_group" directive. */
		struct tomoyo_address_group {
		struct tomoyo_acl_head head;
		/* Structure for holding an IP address. */
		struct tomoyo_ipaddr_union address;
		};

		/* Subset of "struct stat". Used by conditional ACL and audit logs. */
		struct tomoyo_mini_stat {
		uid_t uid;
		@@ -650,6 +725,23 @@ struct tomoyo_env_acl {
		const struct tomoyo_path_info env; / environment variable */
		};

		/* Structure for "network inet" directive. */
		struct tomoyo_inet_acl {
		struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_INET_ACL */
		u8 protocol;
		u8 perm; /* Bitmask of values in "enum tomoyo_network_acl_index" */
		struct tomoyo_ipaddr_union address;
		struct tomoyo_number_union port;
		};

		/* Structure for "network unix" directive. */
		struct tomoyo_unix_acl {
		struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_UNIX_ACL */
		u8 protocol;
		u8 perm; /* Bitmask of values in "enum tomoyo_network_acl_index" */
		struct tomoyo_name_union name;
		};

		/* Structure for holding a line from /sys/kernel/security/tomoyo/ interface. */
		struct tomoyo_acl_param {
		char *data;
		@@ -793,6 +885,8 @@ struct tomoyo_policy_namespace {

		/******** Function prototypes. ********/

		bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address,
		const struct tomoyo_group *group);
		bool tomoyo_compare_number_union(const unsigned long value,
		const struct tomoyo_number_union *ptr);
		bool tomoyo_condition(struct tomoyo_request_info *r,
		@@ -808,6 +902,8 @@ bool tomoyo_memory_ok(void *ptr);
		bool tomoyo_number_matches_group(const unsigned long min,
		const unsigned long max,
		const struct tomoyo_group *group);
		bool tomoyo_parse_ipaddr_union(struct tomoyo_acl_param *param,
		struct tomoyo_ipaddr_union *ptr);
		bool tomoyo_parse_name_union(struct tomoyo_acl_param *param,
		struct tomoyo_name_union *ptr);
		bool tomoyo_parse_number_union(struct tomoyo_acl_param *param,
		@@ -817,6 +913,7 @@ bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename,
		bool tomoyo_permstr(const char string, const char keyword);
		bool tomoyo_str_starts(char *src, const char find);
		char tomoyo_encode(const char str);
		char tomoyo_encode2(const char str, int str_len);
		char tomoyo_init_log(struct tomoyo_request_info r, int len, const char *fmt,
		va_list args);
		char tomoyo_read_token(struct tomoyo_acl_param param);
		@@ -855,6 +952,13 @@ int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation,
		const struct tomoyo_path_info *filename);
		int tomoyo_poll_control(struct file file, poll_table wait);
		int tomoyo_poll_log(struct file file, poll_table wait);
		int tomoyo_socket_bind_permission(struct socket sock, struct sockaddr addr,
		int addr_len);
		int tomoyo_socket_connect_permission(struct socket *sock,
		struct sockaddr *addr, int addr_len);
		int tomoyo_socket_listen_permission(struct socket *sock);
		int tomoyo_socket_sendmsg_permission(struct socket sock, struct msghdr msg,
		int size);
		int tomoyo_supervisor(struct tomoyo_request_info r, const char fmt, ...)
		__printf(2, 3);
		int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size,
		@@ -874,8 +978,10 @@ int tomoyo_write_aggregator(struct tomoyo_acl_param *param);
		int tomoyo_write_file(struct tomoyo_acl_param *param);
		int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type);
		int tomoyo_write_misc(struct tomoyo_acl_param *param);
		int tomoyo_write_inet_network(struct tomoyo_acl_param *param);
		int tomoyo_write_transition_control(struct tomoyo_acl_param *param,
		const u8 type);
		int tomoyo_write_unix_network(struct tomoyo_acl_param *param);
		ssize_t tomoyo_read_control(struct tomoyo_io_buffer head, char __user buffer,
		const int buffer_len);
		ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head,
		@@ -911,6 +1017,8 @@ void tomoyo_load_policy(const char *filename);
		void tomoyo_memory_free(void *ptr);
		void tomoyo_normalize_line(unsigned char *buffer);
		void tomoyo_notify_gc(struct tomoyo_io_buffer *head, const bool is_register);
		void tomoyo_print_ip(char *buf, const unsigned int size,
		const struct tomoyo_ipaddr_union *ptr);
		void tomoyo_print_ulong(char *buffer, const int buffer_len,
		const unsigned long value, const u8 type);
		void tomoyo_put_name_union(struct tomoyo_name_union *ptr);
		@@ -933,6 +1041,8 @@ extern const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX
		+ TOMOYO_MAX_MAC_CATEGORY_INDEX];
		extern const char * const tomoyo_mode[TOMOYO_CONFIG_MAX_MODE];
		extern const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION];
		extern const char * const tomoyo_proto_keyword[TOMOYO_SOCK_MAX];
		extern const char * const tomoyo_socket_keyword[TOMOYO_MAX_NETWORK_OPERATION];
		extern const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX];
		extern const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION];
		extern const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION];
		@@ -1111,6 +1221,21 @@ static inline bool tomoyo_same_number_union
		a->value_type[1] == b->value_type[1];
		}

		/**
		* tomoyo_same_ipaddr_union - Check for duplicated "struct tomoyo_ipaddr_union" entry.
		*
		* @a: Pointer to "struct tomoyo_ipaddr_union".
		* @b: Pointer to "struct tomoyo_ipaddr_union".
		*
		* Returns true if @a == @b, false otherwise.
		*/
		static inline bool tomoyo_same_ipaddr_union
		(const struct tomoyo_ipaddr_union a, const struct tomoyo_ipaddr_union b)
		{
		return !memcmp(a->ip, b->ip, sizeof(a->ip)) && a->group == b->group &&
		a->is_ipv6 == b->is_ipv6;
		}

		/**
		* tomoyo_current_namespace - Get "struct tomoyo_policy_namespace" for current thread.
		*

security/tomoyo/gc.c

+39 −1

Original line number	Diff line number	Diff line
		@@ -16,6 +16,7 @@ static DEFINE_SPINLOCK(tomoyo_io_buffer_list_lock);
		/* Size of an element. */
		static const u8 tomoyo_element_size[TOMOYO_MAX_POLICY] = {
		[TOMOYO_ID_GROUP] = sizeof(struct tomoyo_group),
		[TOMOYO_ID_ADDRESS_GROUP] = sizeof(struct tomoyo_address_group),
		[TOMOYO_ID_PATH_GROUP] = sizeof(struct tomoyo_path_group),
		[TOMOYO_ID_NUMBER_GROUP] = sizeof(struct tomoyo_number_group),
		[TOMOYO_ID_AGGREGATOR] = sizeof(struct tomoyo_aggregator),
		@@ -36,6 +37,8 @@ static const u8 tomoyo_acl_size[] = {
		[TOMOYO_TYPE_PATH_NUMBER_ACL] = sizeof(struct tomoyo_path_number_acl),
		[TOMOYO_TYPE_MKDEV_ACL] = sizeof(struct tomoyo_mkdev_acl),
		[TOMOYO_TYPE_MOUNT_ACL] = sizeof(struct tomoyo_mount_acl),
		[TOMOYO_TYPE_INET_ACL] = sizeof(struct tomoyo_inet_acl),
		[TOMOYO_TYPE_UNIX_ACL] = sizeof(struct tomoyo_unix_acl),
		[TOMOYO_TYPE_ENV_ACL] = sizeof(struct tomoyo_env_acl),
		};

		@@ -302,6 +305,23 @@ static void tomoyo_del_acl(struct list_head *element)
		tomoyo_put_name(entry->env);
		}
		break;
		case TOMOYO_TYPE_INET_ACL:
		{
		struct tomoyo_inet_acl *entry =
		container_of(acl, typeof(*entry), head);

		tomoyo_put_group(entry->address.group);
		tomoyo_put_number_union(&entry->port);
		}
		break;
		case TOMOYO_TYPE_UNIX_ACL:
		{
		struct tomoyo_unix_acl *entry =
		container_of(acl, typeof(*entry), head);

		tomoyo_put_name_union(&entry->name);
		}
		break;
		}
		}

		@@ -430,6 +450,18 @@ static void tomoyo_del_group(struct list_head *element)
		tomoyo_put_name(group->group_name);
		}

		/**
		* tomoyo_del_address_group - Delete members in "struct tomoyo_address_group".
		*
		* @element: Pointer to "struct list_head".
		*
		* Returns nothing.
		*/
		static inline void tomoyo_del_address_group(struct list_head *element)
		{
		/* Nothing to do. */
		}

		/**
		* tomoyo_del_number_group - Delete members in "struct tomoyo_number_group".
		*
		@@ -527,9 +559,12 @@ static void tomoyo_collect_entry(void)
		case 0:
		id = TOMOYO_ID_PATH_GROUP;
		break;
		default:
		case 1:
		id = TOMOYO_ID_NUMBER_GROUP;
		break;
		default:
		id = TOMOYO_ID_ADDRESS_GROUP;
		break;
		}
		list_for_each_entry(group, list, head.list) {
		if (!tomoyo_collect_member
		@@ -634,6 +669,9 @@ static bool tomoyo_kfree_entry(void)
		case TOMOYO_ID_PATH_GROUP:
		tomoyo_del_path_group(element);
		break;
		case TOMOYO_ID_ADDRESS_GROUP:
		tomoyo_del_address_group(element);
		break;
		case TOMOYO_ID_GROUP:
		tomoyo_del_group(element);
		break;