TOMOYO: Add description of lists and structures. (c3fa109a) · Commits · e / devices / android_kernel_xiaomi_markw

security/tomoyo/common.c

+64 −5

Original line number	Diff line number	Diff line
		@@ -28,7 +28,13 @@ static const char *tomoyo_mode_2[4] = {
		"disabled", "enabled", "enabled", "enabled"
		};

		/* Table for profile. */
		/*
		* tomoyo_control_array is a static data which contains
		*
		* (1) functionality name used by /sys/kernel/security/tomoyo/profile .
		* (2) initial values for "struct tomoyo_profile".
		* (3) max values for "struct tomoyo_profile".
		*/
		static struct {
		const char *keyword;
		unsigned int current_value;
		@@ -39,7 +45,13 @@ static struct {
		[TOMOYO_VERBOSE] = { "TOMOYO_VERBOSE", 1, 1 },
		};

		/* Profile table. Memory is allocated as needed. */
		/*
		* tomoyo_profile is a structure which is used for holding the mode of access
		* controls. TOMOYO has 4 modes: disabled, learning, permissive, enforcing.
		* An administrator can define up to 256 profiles.
		* The ->profile of "struct tomoyo_domain_info" is used for remembering
		* the profile's number (0 - 255) assigned to that domain.
		*/
		static struct tomoyo_profile {
		unsigned int value[TOMOYO_MAX_CONTROL_INDEX];
		const struct tomoyo_path_info *comment;
		@@ -1006,7 +1018,19 @@ static int tomoyo_read_profile(struct tomoyo_io_buffer *head)
		return 0;
		}

		/* Structure for policy manager. */
		/*
		* tomoyo_policy_manager_entry is a structure which is used for holding list of
		* domainnames or programs which are permitted to modify configuration via
		* /sys/kernel/security/tomoyo/ interface.
		* It has following fields.
		*
		* (1) "list" which is linked to tomoyo_policy_manager_list .
		* (2) "manager" is a domainname or a program's pathname.
		* (3) "is_domain" is a bool which is true if "manager" is a domainname, false
		* otherwise.
		* (4) "is_deleted" is a bool which is true if marked as deleted, false
		* otherwise.
		*/
		struct tomoyo_policy_manager_entry {
		struct list_head list;
		/* A path to program or a domainname. */
		@@ -1015,7 +1039,36 @@ struct tomoyo_policy_manager_entry {
		bool is_deleted; /* True if this entry is deleted. */
		};

		/* The list for "struct tomoyo_policy_manager_entry". */
		/*
		* tomoyo_policy_manager_list is used for holding list of domainnames or
		* programs which are permitted to modify configuration via
		* /sys/kernel/security/tomoyo/ interface.
		*
		* An entry is added by
		*
		* # echo '<kernel> /sbin/mingetty /bin/login /bin/bash' > \
		* /sys/kernel/security/tomoyo/manager
		* (if you want to specify by a domainname)
		*
		* or
		*
		* # echo '/usr/lib/ccs/editpolicy' > /sys/kernel/security/tomoyo/manager
		* (if you want to specify by a program's location)
		*
		* and is deleted by
		*
		* # echo 'delete <kernel> /sbin/mingetty /bin/login /bin/bash' > \
		* /sys/kernel/security/tomoyo/manager
		*
		* or
		*
		* # echo 'delete /usr/lib/ccs/editpolicy' > \
		* /sys/kernel/security/tomoyo/manager
		*
		* and all entries are retrieved by
		*
		* # cat /sys/kernel/security/tomoyo/manager
		*/
		static LIST_HEAD(tomoyo_policy_manager_list);
		static DECLARE_RWSEM(tomoyo_policy_manager_list_lock);

		@@ -2124,7 +2177,13 @@ static ssize_t tomoyo_write(struct file file, const char __user buf,
		return tomoyo_write_control(file, buf, count);
		}

		/* Operations for /sys/kernel/security/tomoyo/ interface. */
		/*
		* tomoyo_operations is a "struct file_operations" which is used for handling
		* /sys/kernel/security/tomoyo/ interface.
		*
		* Some files under /sys/kernel/security/tomoyo/ directory accept open(O_RDWR).
		* See tomoyo_io_buffer for internals.
		*/
		static const struct file_operations tomoyo_operations = {
		.open = tomoyo_open,
		.release = tomoyo_release,

security/tomoyo/common.h

+122 −11

Original line number	Diff line number	Diff line
		@@ -26,12 +26,40 @@
		struct dentry;
		struct vfsmount;

		/* Temporary buffer for holding pathnames. */
		/*
		* tomoyo_page_buffer is a structure which is used for holding a pathname
		* obtained from "struct dentry" and "struct vfsmount" pair.
		* As of now, it is 4096 bytes. If users complain that 4096 bytes is too small
		* (because TOMOYO escapes non ASCII printable characters using \ooo format),
		* we will make the buffer larger.
		*/
		struct tomoyo_page_buffer {
		char buffer[4096];
		};

		/* Structure for holding a token. */
		/*
		* tomoyo_path_info is a structure which is used for holding a string data
		* used by TOMOYO.
		* This structure has several fields for supporting pattern matching.
		*
		* (1) "name" is the '\0' terminated string data.
		* (2) "hash" is full_name_hash(name, strlen(name)).
		* This allows tomoyo_pathcmp() to compare by hash before actually compare
		* using strcmp().
		* (3) "const_len" is the length of the initial segment of "name" which
		* consists entirely of non wildcard characters. In other words, the length
		* which we can compare two strings using strncmp().
		* (4) "is_dir" is a bool which is true if "name" ends with "/",
		* false otherwise.
		* TOMOYO distinguishes directory and non-directory. A directory ends with
		* "/" and non-directory does not end with "/".
		* (5) "is_patterned" is a bool which is true if "name" contains wildcard
		* characters, false otherwise. This allows TOMOYO to use "hash" and
		* strcmp() for string comparison if "is_patterned" is false.
		* (6) "depth" is calculated using the number of "/" characters in "name".
		* This allows TOMOYO to avoid comparing two pathnames which never match
		* (e.g. whether "/var/www/html/index.html" matches "/tmp/sh-thd-\$").
		*/
		struct tomoyo_path_info {
		const char *name;
		u32 hash; /* = full_name_hash(name, strlen(name)) */
		@@ -50,7 +78,20 @@ struct tomoyo_path_info {
		*/
		#define TOMOYO_MAX_PATHNAME_LEN 4000

		/* Structure for holding requested pathname. */
		/*
		* tomoyo_path_info_with_data is a structure which is used for holding a
		* pathname obtained from "struct dentry" and "struct vfsmount" pair.
		*
		* "struct tomoyo_path_info_with_data" consists of "struct tomoyo_path_info"
		* and buffer for the pathname, while "struct tomoyo_page_buffer" consists of
		* buffer for the pathname only.
		*
		* "struct tomoyo_path_info_with_data" is intended to allow TOMOYO to release
		* both "struct tomoyo_path_info" and buffer for the pathname by single kfree()
		* so that we don't need to return two pointers to the caller. If the caller
		* puts "struct tomoyo_path_info" on stack memory, we will be able to remove
		* "struct tomoyo_path_info_with_data".
		*/
		struct tomoyo_path_info_with_data {
		/* Keep "head" first, for this pointer is passed to tomoyo_free(). */
		struct tomoyo_path_info head;
		@@ -60,7 +101,15 @@ struct tomoyo_path_info_with_data {
		};

		/*
		* Common header for holding ACL entries.
		* tomoyo_acl_info is a structure which is used for holding
		*
		* (1) "list" which is linked to the ->acl_info_list of
		* "struct tomoyo_domain_info"
		* (2) "type" which tells
		* (a) type & 0x7F : type of the entry (either
		* "struct tomoyo_single_path_acl_record" or
		* "struct tomoyo_double_path_acl_record")
		* (b) type & 0x80 : whether the entry is marked as "deleted".
		*
		* Packing "struct tomoyo_acl_info" allows
		* "struct tomoyo_single_path_acl_record" to embed "u16" and
		@@ -80,7 +129,28 @@ struct tomoyo_acl_info {
		/* This ACL entry is deleted. */
		#define TOMOYO_ACL_DELETED 0x80

		/* Structure for domain information. */
		/*
		* tomoyo_domain_info is a structure which is used for holding permissions
		* (e.g. "allow_read /lib/libc-2.5.so") given to each domain.
		* It has following fields.
		*
		* (1) "list" which is linked to tomoyo_domain_list .
		* (2) "acl_info_list" which is linked to "struct tomoyo_acl_info".
		* (3) "domainname" which holds the name of the domain.
		* (4) "profile" which remembers profile number assigned to this domain.
		* (5) "is_deleted" is a bool which is true if this domain is marked as
		* "deleted", false otherwise.
		* (6) "quota_warned" is a bool which is used for suppressing warning message
		* when learning mode learned too much entries.
		* (7) "flags" which remembers this domain's attributes.
		*
		* A domain's lifecycle is an analogy of files on / directory.
		* Multiple domains with the same domainname cannot be created (as with
		* creating files with the same filename fails with -EEXIST).
		* If a process reached a domain, that process can reside in that domain after
		* that domain is marked as "deleted" (as with a process can access an already
		* open()ed file after that file was unlink()ed).
		*/
		struct tomoyo_domain_info {
		struct list_head list;
		struct list_head acl_info_list;
		@@ -107,10 +177,18 @@ struct tomoyo_domain_info {
		#define TOMOYO_DOMAIN_FLAGS_TRANSITION_FAILED 2

		/*
		* Structure for "allow_read/write", "allow_execute", "allow_read",
		* "allow_write", "allow_create", "allow_unlink", "allow_mkdir", "allow_rmdir",
		* "allow_mkfifo", "allow_mksock", "allow_mkblock", "allow_mkchar",
		* "allow_truncate", "allow_symlink" and "allow_rewrite" directive.
		* tomoyo_single_path_acl_record is a structure which is used for holding an
		* entry with one pathname operation (e.g. open(), mkdir()).
		* It has following fields.
		*
		* (1) "head" which is a "struct tomoyo_acl_info".
		* (2) "perm" which is a bitmask of permitted operations.
		* (3) "filename" is the pathname.
		*
		* Directives held by this structure are "allow_read/write", "allow_execute",
		* "allow_read", "allow_write", "allow_create", "allow_unlink", "allow_mkdir",
		* "allow_rmdir", "allow_mkfifo", "allow_mksock", "allow_mkblock",
		* "allow_mkchar", "allow_truncate", "allow_symlink" and "allow_rewrite".
		*/
		struct tomoyo_single_path_acl_record {
		struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_SINGLE_PATH_ACL */
		@@ -119,7 +197,18 @@ struct tomoyo_single_path_acl_record {
		const struct tomoyo_path_info *filename;
		};

		/* Structure for "allow_rename" and "allow_link" directive. */
		/*
		* tomoyo_double_path_acl_record is a structure which is used for holding an
		* entry with two pathnames operation (i.e. link() and rename()).
		* It has following fields.
		*
		* (1) "head" which is a "struct tomoyo_acl_info".
		* (2) "perm" which is a bitmask of permitted operations.
		* (3) "filename1" is the source/old pathname.
		* (4) "filename2" is the destination/new pathname.
		*
		* Directives held by this structure are "allow_rename" and "allow_link".
		*/
		struct tomoyo_double_path_acl_record {
		struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_DOUBLE_PATH_ACL */
		u8 perm;
		@@ -152,7 +241,29 @@ struct tomoyo_double_path_acl_record {
		#define TOMOYO_VERBOSE 2
		#define TOMOYO_MAX_CONTROL_INDEX 3

		/* Structure for reading/writing policy via securityfs interfaces. */
		/*
		* tomoyo_io_buffer is a structure which is used for reading and modifying
		* configuration via /sys/kernel/security/tomoyo/ interface.
		* It has many fields. ->read_var1 , ->read_var2 , ->write_var1 are used as
		* cursors.
		*
		* Since the content of /sys/kernel/security/tomoyo/domain_policy is a list of
		* "struct tomoyo_domain_info" entries and each "struct tomoyo_domain_info"
		* entry has a list of "struct tomoyo_acl_info", we need two cursors when
		* reading (one is for traversing tomoyo_domain_list and the other is for
		* traversing "struct tomoyo_acl_info"->acl_info_list ).
		*
		* If a line written to /sys/kernel/security/tomoyo/domain_policy starts with
		* "select ", TOMOYO seeks the cursor ->read_var1 and ->write_var1 to the
		* domain with the domainname specified by the rest of that line (NULL is set
		* if seek failed).
		* If a line written to /sys/kernel/security/tomoyo/domain_policy starts with
		* "delete ", TOMOYO deletes an entry or a domain specified by the rest of that
		* line (->write_var1 is set to NULL if a domain was deleted).
		* If a line written to /sys/kernel/security/tomoyo/domain_policy starts with
		* neither "select " nor "delete ", an entry or a domain specified by that line
		* is appended.
		*/
		struct tomoyo_io_buffer {
		int (read) (struct tomoyo_io_buffer );
		int (write) (struct tomoyo_io_buffer );

security/tomoyo/domain.c

+185 −7

Original line number	Diff line number	Diff line
		@@ -19,11 +19,63 @@
		/* The initial domain. */
		struct tomoyo_domain_info tomoyo_kernel_domain;

		/* The list for "struct tomoyo_domain_info". */
		/*
		* tomoyo_domain_list is used for holding list of domains.
		* The ->acl_info_list of "struct tomoyo_domain_info" is used for holding
		* permissions (e.g. "allow_read /lib/libc-2.5.so") given to each domain.
		*
		* An entry is added by
		*
		* # ( echo "<kernel>"; echo "allow_execute /sbin/init" ) > \
		* /sys/kernel/security/tomoyo/domain_policy
		*
		* and is deleted by
		*
		* # ( echo "<kernel>"; echo "delete allow_execute /sbin/init" ) > \
		* /sys/kernel/security/tomoyo/domain_policy
		*
		* and all entries are retrieved by
		*
		* # cat /sys/kernel/security/tomoyo/domain_policy
		*
		* A domain is added by
		*
		* # echo "<kernel>" > /sys/kernel/security/tomoyo/domain_policy
		*
		* and is deleted by
		*
		* # echo "delete <kernel>" > /sys/kernel/security/tomoyo/domain_policy
		*
		* and all domains are retrieved by
		*
		* # grep '^<kernel>' /sys/kernel/security/tomoyo/domain_policy
		*
		* Normally, a domainname is monotonically getting longer because a domainname
		* which the process will belong to if an execve() operation succeeds is
		* defined as a concatenation of "current domainname" + "pathname passed to
		* execve()".
		* See tomoyo_domain_initializer_list and tomoyo_domain_keeper_list for
		* exceptions.
		*/
		LIST_HEAD(tomoyo_domain_list);
		DECLARE_RWSEM(tomoyo_domain_list_lock);

		/* Structure for "initialize_domain" and "no_initialize_domain" keyword. */
		/*
		* tomoyo_domain_initializer_entry is a structure which is used for holding
		* "initialize_domain" and "no_initialize_domain" entries.
		* It has following fields.
		*
		* (1) "list" which is linked to tomoyo_domain_initializer_list .
		* (2) "domainname" which is "a domainname" or "the last component of a
		* domainname". This field is NULL if "from" clause is not specified.
		* (3) "program" which is a program's pathname.
		* (4) "is_deleted" is a bool which is true if marked as deleted, false
		* otherwise.
		* (5) "is_not" is a bool which is true if "no_initialize_domain", false
		* otherwise.
		* (6) "is_last_name" is a bool which is true if "domainname" is "the last
		* component of a domainname", false otherwise.
		*/
		struct tomoyo_domain_initializer_entry {
		struct list_head list;
		const struct tomoyo_path_info domainname; / This may be NULL */
		@@ -34,7 +86,23 @@ struct tomoyo_domain_initializer_entry {
		bool is_last_name;
		};

		/* Structure for "keep_domain" and "no_keep_domain" keyword. */
		/*
		* tomoyo_domain_keeper_entry is a structure which is used for holding
		* "keep_domain" and "no_keep_domain" entries.
		* It has following fields.
		*
		* (1) "list" which is linked to tomoyo_domain_keeper_list .
		* (2) "domainname" which is "a domainname" or "the last component of a
		* domainname".
		* (3) "program" which is a program's pathname.
		* This field is NULL if "from" clause is not specified.
		* (4) "is_deleted" is a bool which is true if marked as deleted, false
		* otherwise.
		* (5) "is_not" is a bool which is true if "no_initialize_domain", false
		* otherwise.
		* (6) "is_last_name" is a bool which is true if "domainname" is "the last
		* component of a domainname", false otherwise.
		*/
		struct tomoyo_domain_keeper_entry {
		struct list_head list;
		const struct tomoyo_path_info *domainname;
		@@ -45,7 +113,16 @@ struct tomoyo_domain_keeper_entry {
		bool is_last_name;
		};

		/* Structure for "alias" keyword. */
		/*
		* tomoyo_alias_entry is a structure which is used for holding "alias" entries.
		* It has following fields.
		*
		* (1) "list" which is linked to tomoyo_alias_list .
		* (2) "original_name" which is a dereferenced pathname.
		* (3) "aliased_name" which is a symlink's pathname.
		* (4) "is_deleted" is a bool which is true if marked as deleted, false
		* otherwise.
		*/
		struct tomoyo_alias_entry {
		struct list_head list;
		const struct tomoyo_path_info *original_name;
		@@ -92,7 +169,42 @@ const char tomoyo_get_last_name(const struct tomoyo_domain_info domain)
		return cp0;
		}

		/* The list for "struct tomoyo_domain_initializer_entry". */
		/*
		* tomoyo_domain_initializer_list is used for holding list of programs which
		* triggers reinitialization of domainname. Normally, a domainname is
		* monotonically getting longer. But sometimes, we restart daemon programs.
		* It would be convenient for us that "a daemon started upon system boot" and
		* "the daemon restarted from console" belong to the same domain. Thus, TOMOYO
		* provides a way to shorten domainnames.
		*
		* An entry is added by
		*
		* # echo 'initialize_domain /usr/sbin/httpd' > \
		* /sys/kernel/security/tomoyo/exception_policy
		*
		* and is deleted by
		*
		* # echo 'delete initialize_domain /usr/sbin/httpd' > \
		* /sys/kernel/security/tomoyo/exception_policy
		*
		* and all entries are retrieved by
		*
		* # grep ^initialize_domain /sys/kernel/security/tomoyo/exception_policy
		*
		* In the example above, /usr/sbin/httpd will belong to
		* "<kernel> /usr/sbin/httpd" domain.
		*
		* You may specify a domainname using "from" keyword.
		* "initialize_domain /usr/sbin/httpd from <kernel> /etc/rc.d/init.d/httpd"
		* will cause "/usr/sbin/httpd" executed from "<kernel> /etc/rc.d/init.d/httpd"
		* domain to belong to "<kernel> /usr/sbin/httpd" domain.
		*
		* You may add "no_" prefix to "initialize_domain".
		* "initialize_domain /usr/sbin/httpd" and
		* "no_initialize_domain /usr/sbin/httpd from <kernel> /etc/rc.d/init.d/httpd"
		* will cause "/usr/sbin/httpd" to belong to "<kernel> /usr/sbin/httpd" domain
		* unless executed from "<kernel> /etc/rc.d/init.d/httpd" domain.
		*/
		static LIST_HEAD(tomoyo_domain_initializer_list);
		static DECLARE_RWSEM(tomoyo_domain_initializer_list_lock);

		@@ -268,7 +380,44 @@ static bool tomoyo_is_domain_initializer(const struct tomoyo_path_info *
		return flag;
		}

		/* The list for "struct tomoyo_domain_keeper_entry". */
		/*
		* tomoyo_domain_keeper_list is used for holding list of domainnames which
		* suppresses domain transition. Normally, a domainname is monotonically
		* getting longer. But sometimes, we want to suppress domain transition.
		* It would be convenient for us that programs executed from a login session
		* belong to the same domain. Thus, TOMOYO provides a way to suppress domain
		* transition.
		*
		* An entry is added by
		*
		* # echo 'keep_domain <kernel> /usr/sbin/sshd /bin/bash' > \
		* /sys/kernel/security/tomoyo/exception_policy
		*
		* and is deleted by
		*
		* # echo 'delete keep_domain <kernel> /usr/sbin/sshd /bin/bash' > \
		* /sys/kernel/security/tomoyo/exception_policy
		*
		* and all entries are retrieved by
		*
		* # grep ^keep_domain /sys/kernel/security/tomoyo/exception_policy
		*
		* In the example above, any process which belongs to
		* "<kernel> /usr/sbin/sshd /bin/bash" domain will remain in that domain,
		* unless explicitly specified by "initialize_domain" or "no_keep_domain".
		*
		* You may specify a program using "from" keyword.
		* "keep_domain /bin/pwd from <kernel> /usr/sbin/sshd /bin/bash"
		* will cause "/bin/pwd" executed from "<kernel> /usr/sbin/sshd /bin/bash"
		* domain to remain in "<kernel> /usr/sbin/sshd /bin/bash" domain.
		*
		* You may add "no_" prefix to "keep_domain".
		* "keep_domain <kernel> /usr/sbin/sshd /bin/bash" and
		* "no_keep_domain /usr/bin/passwd from <kernel> /usr/sbin/sshd /bin/bash" will
		* cause "/usr/bin/passwd" to belong to
		* "<kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd" domain, unless
		* explicitly specified by "initialize_domain".
		*/
		static LIST_HEAD(tomoyo_domain_keeper_list);
		static DECLARE_RWSEM(tomoyo_domain_keeper_list_lock);

		@@ -437,7 +586,36 @@ static bool tomoyo_is_domain_keeper(const struct tomoyo_path_info *domainname,
		return flag;
		}

		/* The list for "struct tomoyo_alias_entry". */
		/*
		* tomoyo_alias_list is used for holding list of symlink's pathnames which are
		* allowed to be passed to an execve() request. Normally, the domainname which
		* the current process will belong to after execve() succeeds is calculated
		* using dereferenced pathnames. But some programs behave differently depending
		* on the name passed to argv[0]. For busybox, calculating domainname using
		* dereferenced pathnames will cause all programs in the busybox to belong to
		* the same domain. Thus, TOMOYO provides a way to allow use of symlink's
		* pathname for checking execve()'s permission and calculating domainname which
		* the current process will belong to after execve() succeeds.
		*
		* An entry is added by
		*
		* # echo 'alias /bin/busybox /bin/cat' > \
		* /sys/kernel/security/tomoyo/exception_policy
		*
		* and is deleted by
		*
		* # echo 'delete alias /bin/busybox /bin/cat' > \
		* /sys/kernel/security/tomoyo/exception_policy
		*
		* and all entries are retrieved by
		*
		* # grep ^alias /sys/kernel/security/tomoyo/exception_policy
		*
		* In the example above, if /bin/cat is a symlink to /bin/busybox and execution
		* of /bin/cat is requested, permission is checked for /bin/cat rather than
		* /bin/busybox and domainname which the current process will belong to after
		* execve() succeeds is calculated using /bin/cat rather than /bin/busybox .
		*/
		static LIST_HEAD(tomoyo_alias_list);
		static DECLARE_RWSEM(tomoyo_alias_list_lock);

security/tomoyo/file.c

+115 −6

File changed.

Preview size limit exceeded, changes collapsed.

security/tomoyo/realpath.c

+14 −5

Original line number	Diff line number	Diff line
		@@ -265,7 +265,16 @@ static unsigned int tomoyo_quota_for_savename;
		*/
		#define TOMOYO_MAX_HASH 256

		/* Structure for string data. */
		/*
		* tomoyo_name_entry is a structure which is used for linking
		* "struct tomoyo_path_info" into tomoyo_name_list .
		*
		* Since tomoyo_name_list manages a list of strings which are shared by
		* multiple processes (whereas "struct tomoyo_path_info" inside
		* "struct tomoyo_path_info_with_data" is not shared), a reference counter will
		* be added to "struct tomoyo_name_entry" rather than "struct tomoyo_path_info"
		* when TOMOYO starts supporting garbage collector.
		*/
		struct tomoyo_name_entry {
		struct list_head list;
		struct tomoyo_path_info entry;
		@@ -279,10 +288,10 @@ struct tomoyo_free_memory_block_list {
		};

		/*
		* The list for "struct tomoyo_name_entry".
		*
		* This list is updated only inside tomoyo_save_name(), thus
		* no global mutex exists.
		* tomoyo_name_list is used for holding string data used by TOMOYO.
		* Since same string data is likely used for multiple times (e.g.
		* "/lib/libc-2.5.so"), TOMOYO shares string data in the form of
		* "const struct tomoyo_path_info *".
		*/
		static struct list_head tomoyo_name_list[TOMOYO_MAX_HASH];