OSDN -- 开发和下载开源软件
简体中文翻译状态 translation status for zh
  • R/O
  • SSH
  • HTTPS

tomoyo: 提交


Commit MetaInfo

修订版6793 (tree)
时间2020-05-04 14:45:53
作者kumaneko

Log Message

(empty log message)

更改概述

差异

--- trunk/1.8.x/ccs-patch/security/ccsecurity/policy_io.c (revision 6792)
+++ trunk/1.8.x/ccs-patch/security/ccsecurity/policy_io.c (revision 6793)
@@ -491,7 +491,8 @@
491491 static ssize_t ccs_write(struct file *file, const char __user *buf,
492492 size_t count, loff_t *ppos);
493493 static struct ccs_condition *ccs_commit_condition(struct ccs_condition *entry);
494-static struct ccs_condition *ccs_get_condition(struct ccs_acl_param *param);
494+static struct ccs_condition *ccs_get_condition(struct ccs_acl_param *param,
495+ const bool pref);
495496 static struct ccs_domain_info *ccs_find_domain(const char *domainname);
496497 static struct ccs_domain_info *ccs_find_domain_by_qid(unsigned int serial);
497498 static struct ccs_group *ccs_get_group(struct ccs_acl_param *param,
@@ -1955,7 +1956,8 @@
19551956 cp = pos;
19561957 while (*cp && *cp != '/' && *cp != '.' && *cp != ' ')
19571958 cp++;
1958- if (*cp != '.')
1959+ if (memchr(pos, '/', cp - pos + (*cp != '\0')) &&
1960+ strncmp(pos, "auto_domain_transition=\"", 24))
19591961 continue;
19601962 *(pos - 1) = '\0';
19611963 break;
@@ -2012,10 +2014,12 @@
20122014 * ccs_get_condition - Parse condition part.
20132015 *
20142016 * @param: Pointer to "struct ccs_acl_param".
2017+ * @pref: Can include domain transition preference?
20152018 *
20162019 * Returns pointer to "struct ccs_condition" on success, NULL otherwise.
20172020 */
2018-static struct ccs_condition *ccs_get_condition(struct ccs_acl_param *param)
2021+static struct ccs_condition *ccs_get_condition(struct ccs_acl_param *param,
2022+ const bool pref)
20192023 {
20202024 struct ccs_condition *entry = NULL;
20212025 struct ccs_condition_element *condp = NULL;
@@ -2024,7 +2028,8 @@
20242028 struct ccs_argv *argv = NULL;
20252029 struct ccs_envp *envp = NULL;
20262030 struct ccs_condition e = { };
2027- char * const start_of_string = ccs_get_transit_preference(param, &e);
2031+ char * const start_of_string = pref ?
2032+ ccs_get_transit_preference(param, &e) : param->data;
20282033 char * const end_of_string = start_of_string + strlen(start_of_string);
20292034 char *pos;
20302035 rerun:
@@ -3142,23 +3147,21 @@
31423147 struct list_head * const list = param->list;
31433148 BUG_ON(size < sizeof(*entry));
31443149 if (param->data[0]) {
3145- new_entry->cond = ccs_get_condition(param);
3146- if (!new_entry->cond)
3147- return -EINVAL;
31483150 /*
31493151 * Domain transition preference is allowed for only
31503152 * "file execute"/"task auto_execute_handler"/
31513153 * "task denied_auto_execute_handler" entries.
31523154 */
3153- if (new_entry->cond->exec_transit &&
3154- !(new_entry->type == CCS_TYPE_PATH_ACL &&
3155- new_entry->perm == 1 << CCS_TYPE_EXECUTE)
3155+ const bool pref = (new_entry->type == CCS_TYPE_PATH_ACL &&
3156+ new_entry->perm == 1 << CCS_TYPE_EXECUTE)
31563157 #ifdef CONFIG_CCSECURITY_TASK_EXECUTE_HANDLER
3157- && new_entry->type != CCS_TYPE_AUTO_EXECUTE_HANDLER &&
3158- new_entry->type != CCS_TYPE_DENIED_EXECUTE_HANDLER
3158+ || new_entry->type == CCS_TYPE_AUTO_EXECUTE_HANDLER
3159+ || new_entry->type == CCS_TYPE_DENIED_EXECUTE_HANDLER
31593160 #endif
3160- )
3161- return -EINVAL;
3161+ ;
3162+ new_entry->cond = ccs_get_condition(param, pref);
3163+ if (!new_entry->cond)
3164+ return error;
31623165 }
31633166 if (mutex_lock_interruptible(&ccs_policy_lock))
31643167 return -ENOMEM;
--- trunk/1.8.x/ccs-tools/usr_sbin/editpolicy_offline.c (revision 6792)
+++ trunk/1.8.x/ccs-tools/usr_sbin/editpolicy_offline.c (revision 6793)
@@ -1544,7 +1544,8 @@
15441544 cp = pos;
15451545 while (*cp && *cp != '/' && *cp != '.' && *cp != ' ')
15461546 cp++;
1547- if (*cp != '.')
1547+ if (memchr(pos, '/', cp - pos + (*cp != '\0')) &&
1548+ strncmp(pos, "auto_domain_transition=\"", 24))
15481549 continue;
15491550 *(pos - 1) = '\0';
15501551 break;
@@ -2029,10 +2030,12 @@
20292030 * ccs_get_condition - Parse condition part.
20302031 *
20312032 * @param: Pointer to "struct ccs_acl_param".
2033+ * @pref: Can include domain transition preference?
20322034 *
20332035 * Returns pointer to "struct ccs_condition" on success, NULL otherwise.
20342036 */
2035-static struct ccs_condition *ccs_get_condition(struct ccs_acl_param *param)
2037+static struct ccs_condition *ccs_get_condition(struct ccs_acl_param *param,
2038+ const bool pref)
20362039 {
20372040 struct ccs_condition *entry = NULL;
20382041 struct ccs_condition_element *condp = NULL;
@@ -2041,7 +2044,8 @@
20412044 struct ccs_argv *argv = NULL;
20422045 struct ccs_envp *envp = NULL;
20432046 struct ccs_condition e = { };
2044- char * const start_of_string = ccs_get_transit_preference(param, &e);
2047+ char * const start_of_string = pref ?
2048+ ccs_get_transit_preference(param, &e) : param->data;
20452049 char * const end_of_string = start_of_string + strlen(start_of_string);
20462050 char *pos;
20472051 rerun:
@@ -2283,21 +2287,19 @@
22832287 struct ccs_acl_info *entry;
22842288 struct list_head * const list = param->list;
22852289 if (param->data[0]) {
2286- new_entry->cond = ccs_get_condition(param);
2287- if (!new_entry->cond)
2288- return -EINVAL;
22892290 /*
22902291 * Domain transition preference is allowed for only
22912292 * "file execute"/"task auto_execute_handler"/
22922293 * "task denied_execute_handler" entries.
22932294 */
2294- if (new_entry->cond->exec_transit &&
2295- !(new_entry->type == CCS_TYPE_PATH_ACL &&
2296- container_of(new_entry, struct ccs_path_acl, head)->perm
2297- == 1 << CCS_TYPE_EXECUTE) &&
2298- new_entry->type != CCS_TYPE_AUTO_EXECUTE_HANDLER &&
2299- new_entry->type != CCS_TYPE_DENIED_EXECUTE_HANDLER)
2300- goto out;
2295+ const bool pref = (new_entry->type == CCS_TYPE_PATH_ACL &&
2296+ container_of(new_entry, struct ccs_path_acl, head)->perm
2297+ == 1 << CCS_TYPE_EXECUTE) ||
2298+ new_entry->type == CCS_TYPE_AUTO_EXECUTE_HANDLER ||
2299+ new_entry->type == CCS_TYPE_DENIED_EXECUTE_HANDLER;
2300+ new_entry->cond = ccs_get_condition(param, pref);
2301+ if (!new_entry->cond)
2302+ return error;
23012303 }
23022304 list_for_each_entry(entry, list, list) {
23032305 if (!ccs_same_acl_head(entry, new_entry) ||
Show on old repository browser