에프에이리눅스 / 1611_0007_prime_oven

Blame view

kernel/linux-imx6_3.14.28/security/tomoyo/load_policy.c 2.55 KB
edit raw normal view history
6b13f685e   김민수   BSP 최초 추가 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
 
  /*
   * security/tomoyo/load_policy.c
   *
   * Copyright (C) 2005-2011  NTT DATA CORPORATION
   */
  
  #include "common.h"
  
  #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER
  
  /*
   * Path to the policy loader. (default = CONFIG_SECURITY_TOMOYO_POLICY_LOADER)
   */
  static const char *tomoyo_loader;
  
  /**
   * tomoyo_loader_setup - Set policy loader.
   *
   * @str: Program to use as a policy loader (e.g. /sbin/tomoyo-init ).
   *
   * Returns 0.
   */
  static int __init tomoyo_loader_setup(char *str)
  {
  	tomoyo_loader = str;
  	return 0;
  }
  
  __setup("TOMOYO_loader=", tomoyo_loader_setup);
  
  /**
   * tomoyo_policy_loader_exists - Check whether /sbin/tomoyo-init exists.
   *
   * Returns true if /sbin/tomoyo-init exists, false otherwise.
   */
  static bool tomoyo_policy_loader_exists(void)
  {
  	struct path path;
  	if (!tomoyo_loader)
  		tomoyo_loader = CONFIG_SECURITY_TOMOYO_POLICY_LOADER;
  	if (kern_path(tomoyo_loader, LOOKUP_FOLLOW, &path)) {
  		printk(KERN_INFO "Not activating Mandatory Access Control "
  		       "as %s does not exist.
  ", tomoyo_loader);
  		return false;
  	}
  	path_put(&path);
  	return true;
  }
  
  /*
   * Path to the trigger. (default = CONFIG_SECURITY_TOMOYO_ACTIVATION_TRIGGER)
   */
  static const char *tomoyo_trigger;
  
  /**
   * tomoyo_trigger_setup - Set trigger for activation.
   *
   * @str: Program to use as an activation trigger (e.g. /sbin/init ).
   *
   * Returns 0.
   */
  static int __init tomoyo_trigger_setup(char *str)
  {
  	tomoyo_trigger = str;
  	return 0;
  }
  
  __setup("TOMOYO_trigger=", tomoyo_trigger_setup);
  
  /**
   * tomoyo_load_policy - Run external policy loader to load policy.
   *
   * @filename: The program about to start.
   *
   * This function checks whether @filename is /sbin/init , and if so
   * invoke /sbin/tomoyo-init and wait for the termination of /sbin/tomoyo-init
   * and then continues invocation of /sbin/init.
   * /sbin/tomoyo-init reads policy files in /etc/tomoyo/ directory and
   * writes to /sys/kernel/security/tomoyo/ interfaces.
   *
   * Returns nothing.
   */
  void tomoyo_load_policy(const char *filename)
  {
  	static bool done;
  	char *argv[2];
  	char *envp[3];
  
  	if (tomoyo_policy_loaded || done)
  		return;
  	if (!tomoyo_trigger)
  		tomoyo_trigger = CONFIG_SECURITY_TOMOYO_ACTIVATION_TRIGGER;
  	if (strcmp(filename, tomoyo_trigger))
  		return;
  	if (!tomoyo_policy_loader_exists())
  		return;
  	done = true;
  	printk(KERN_INFO "Calling %s to load policy. Please wait.
  ",
  	       tomoyo_loader);
  	argv[0] = (char *) tomoyo_loader;
  	argv[1] = NULL;
  	envp[0] = "HOME=/";
  	envp[1] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
  	envp[2] = NULL;
  	call_usermodehelper(argv[0], argv, envp, UMH_WAIT_PROC);
  	tomoyo_check_profile();
  }
  
  #endif