#include <linux/string.h>#include <rsbac/types.h>#include <rsbac/aci.h>#include <rsbac/adf_main.h>#include <rsbac/rc.h>#include <rsbac/error.h>#include <rsbac/debug.h>#include <rsbac/helpers.h>#include <rsbac/getname.h>#include <rsbac/rc_getname.h>#include <rsbac/rkmem.h>#include <rsbac/network.h>#include <rsbac/rc_types.h>Go to the source code of this file.
|
||||||||||||||||||||
|
Definition at line 35 of file rc_main.c. References A_local_rc_type, A_rc_role, A_rc_type, A_rc_type_fd, A_rc_type_nt, A_remote_rc_type, FALSE, get_rc_special_right_name(), get_target_name_only(), GRANTED, NOT_GRANTED, rsbac_target_id_t::process, RC, rsbac_attribute_value_t::rc_role, rsbac_attribute_value_t::rc_type, RI_type_comp_dev, RI_type_comp_fd, RI_type_comp_group, RI_type_comp_ipc, RI_type_comp_netdev, RI_type_comp_netobj, RI_type_comp_nettemp, RI_type_comp_process, RI_type_comp_user, rsbac_get_attr, rsbac_kfree(), rsbac_kmalloc(), RSBAC_MAXNAMELEN, rsbac_net_remote_request(), rsbac_printk(), rsbac_rc_check_comp(), T_DEV, T_DIR, T_FIFO, T_FILE, T_GROUP, T_IPC, T_NETDEV, T_NETOBJ, T_NETTEMP, T_PROCESS, T_SYMLINK, T_USER, TRUE, and rsbac_rc_target_id_t::type. Referenced by rsbac_adf_request_rc(). 00039 {
00040 int err;
00041 union rsbac_target_id_t i_tid;
00042 enum rsbac_attribute_t i_attr;
00043 union rsbac_attribute_value_t i_attr_val1;
00044 union rsbac_attribute_value_t i_attr_val2;
00045
00046 union rsbac_rc_target_id_t i_rc_subtid;
00047 enum rsbac_rc_item_t i_rc_item;
00048
00049 /* get rc_role from process */
00050 i_tid.process = caller_pid;
00051 if ((err=rsbac_get_attr(RC,
00052 T_PROCESS,
00053 i_tid,
00054 A_rc_role,
00055 &i_attr_val1,
00056 FALSE)))
00057 {
00058 rsbac_ds_get_error("check_comp_rc", A_rc_role);
00059 return(NOT_GRANTED);
00060 }
00061 switch(target)
00062 {
00063 case T_FILE:
00064 case T_DIR:
00065 case T_FIFO:
00066 case T_SYMLINK:
00067 i_rc_item = RI_type_comp_fd;
00068 i_attr = A_rc_type_fd;
00069 break;
00070 case T_DEV:
00071 i_rc_item = RI_type_comp_dev;
00072 i_attr = A_rc_type;
00073 break;
00074 case T_USER:
00075 i_rc_item = RI_type_comp_user;
00076 i_attr = A_rc_type;
00077 break;
00078 case T_PROCESS:
00079 i_rc_item = RI_type_comp_process;
00080 i_attr = A_rc_type;
00081 break;
00082 case T_IPC:
00083 i_rc_item = RI_type_comp_ipc;
00084 i_attr = A_rc_type;
00085 break;
00086 #if defined(CONFIG_RSBAC_RC_UM_PROT)
00087 case T_GROUP:
00088 i_rc_item = RI_type_comp_group;
00089 i_attr = A_rc_type;
00090 break;
00091 #endif
00092 #if defined(CONFIG_RSBAC_RC_NET_DEV_PROT)
00093 case T_NETDEV:
00094 i_rc_item = RI_type_comp_netdev;
00095 i_attr = A_rc_type;
00096 break;
00097 #endif
00098 #if defined(CONFIG_RSBAC_RC_NET_OBJ_PROT)
00099 case T_NETTEMP:
00100 i_rc_item = RI_type_comp_nettemp;
00101 i_attr = A_rc_type_nt;
00102 break;
00103 case T_NETOBJ:
00104 i_rc_item = RI_type_comp_netobj;
00105 if(rsbac_net_remote_request(request))
00106 i_attr = A_remote_rc_type;
00107 else
00108 i_attr = A_local_rc_type;
00109 break;
00110 #endif
00111 default:
00112 rsbac_printk(KERN_WARNING "check_comp_rc(): invalid target %i!\n",target);
00113 return(NOT_GRANTED);
00114 }
00115
00116 /* get rc_type[_fd|_nt] from target */
00117 if ((err=rsbac_get_attr(RC,
00118 target,
00119 tid,
00120 i_attr,
00121 &i_attr_val2,
00122 TRUE)))
00123 {
00124 rsbac_ds_get_error("check_comp_rc", i_attr);
00125 return(NOT_GRANTED);
00126 }
00127
00128 /* get type_comp_xxx of role */
00129 i_rc_subtid.type = i_attr_val2.rc_type;
00130 if(rsbac_rc_check_comp(i_attr_val1.rc_role,
00131 i_rc_subtid,
00132 i_rc_item,
00133 request))
00134 return(GRANTED);
00135 else
00136 {
00137 #ifdef CONFIG_RSBAC_DEBUG
00138 if(rsbac_debug_adf_rc)
00139 {
00140 char * tmp = rsbac_kmalloc(RSBAC_MAXNAMELEN);
00141
00142 if(tmp)
00143 {
00144 char * tmp2 = rsbac_kmalloc(RSBAC_MAXNAMELEN);
00145 if(tmp2)
00146 {
00147 rsbac_printk(KERN_DEBUG "check_comp_rc(): pid %u (%.15s), owner %u, rc_role %u, %s rc_type %u, request %s -> NOT_GRANTED!\n",
00148 caller_pid, current->comm, current->uid, i_attr_val1.rc_role, get_target_name_only(tmp, target), i_attr_val2.rc_type, get_rc_special_right_name(tmp2, request));
00149 rsbac_kfree(tmp2);
00150 }
00151 rsbac_kfree(tmp);
00152 }
00153 }
00154 #endif
00155 return(NOT_GRANTED);
00156 }
00157 }
|
|
||||||||||||||||
|
Definition at line 160 of file rc_main.c. References A_rc_role, FALSE, get_request_name(), GRANTED, NOT_GRANTED, rsbac_target_id_t::process, RC, rsbac_attribute_value_t::rc_role, RI_type_comp_scd, rsbac_get_attr, rsbac_kfree(), rsbac_kmalloc(), RSBAC_MAXNAMELEN, rsbac_printk(), rsbac_rc_check_comp(), T_PROCESS, and rsbac_rc_target_id_t::type. Referenced by rsbac_adf_request_rc(). 00163 {
00164 int err;
00165 union rsbac_target_id_t i_tid;
00166 union rsbac_attribute_value_t i_attr_val1;
00167
00168 union rsbac_rc_target_id_t i_rc_subtid;
00169
00170 /* get rc_role from process */
00171 i_tid.process = caller_pid;
00172 if ((err=rsbac_get_attr(RC,
00173 T_PROCESS,
00174 i_tid,
00175 A_rc_role,
00176 &i_attr_val1,
00177 FALSE)))
00178 {
00179 rsbac_ds_get_error("check_comp_rc_scd", A_rc_role);
00180 return(NOT_GRANTED);
00181 }
00182 /* get type_comp_scd of role */
00183 i_rc_subtid.type = scd_type;
00184 if(rsbac_rc_check_comp(i_attr_val1.rc_role,
00185 i_rc_subtid,
00186 RI_type_comp_scd,
00187 request))
00188 {
00189 return(GRANTED);
00190 }
00191 else
00192 {
00193 #ifdef CONFIG_RSBAC_DEBUG
00194 if(rsbac_debug_adf_rc)
00195 {
00196 char * tmp = rsbac_kmalloc(RSBAC_MAXNAMELEN);
00197
00198 if(tmp)
00199 {
00200 rsbac_printk(KERN_DEBUG "check_comp_rc_scd(): pid %u (%.15s), owner %u, rc_role %i, scd_type %i, request %s -> NOT_GRANTED!\n",
00201 caller_pid, current->comm, current->uid, i_attr_val1.rc_role, scd_type, get_request_name(tmp,request));
00202 rsbac_kfree(tmp);
00203 }
00204 }
00205 #endif
00206 return(NOT_GRANTED);
00207 }
00208 }
|
|
||||||||||||||||||||||||||||||||
|
Definition at line 472 of file rc_main.c. References A_audit_uid, A_auid_exempt, A_auth_last_auth, A_auth_learn, A_auth_may_set_cap, A_auth_may_setuid, A_fake_root_uid, A_linux_dac_disable, A_local_rc_type, A_log_array_high, A_log_array_low, A_log_program_based, A_log_user_based, A_none, A_pseudo, A_rc_def_role, A_rc_force_role, A_rc_initial_role, A_rc_role, A_rc_type, A_rc_type_fd, A_rc_type_nt, A_remote_ip, A_remote_rc_type, A_symlink_add_rc_role, A_symlink_add_remote_ip, A_symlink_add_uid, AUTH, check_comp_rc(), check_comp_rc_scd(), DO_NOT_CARE, FALSE, FREEZE, GRANTED, rsbac_target_id_t::netobj, NOT_GRANTED, NULL, rsbac_target_id_t::process, R_ACCEPT, R_ADD_TO_KERNEL, R_ALTER, R_APPEND_OPEN, R_BIND, R_CHANGE_GROUP, R_CHANGE_OWNER, R_CHDIR, R_CLONE, R_CONNECT, R_CREATE, R_DELETE, R_EXECUTE, R_GET_PERMISSIONS_DATA, R_GET_STATUS_DATA, R_IOCTL, R_LINK_HARD, R_LISTEN, R_LOCK, R_MAP_EXEC, R_MODIFY_ACCESS_DATA, R_MODIFY_ATTRIBUTE, R_MODIFY_PERMISSIONS_DATA, R_MODIFY_SYSTEM_DATA, R_MOUNT, R_NET_SHUTDOWN, R_READ, R_READ_ATTRIBUTE, R_READ_OPEN, R_READ_WRITE_OPEN, R_RECEIVE, R_REMOVE_FROM_KERNEL, R_RENAME, R_SEARCH, R_SEND, R_SEND_SIGNAL, R_SHUTDOWN, R_SWITCH_LOG, R_SWITCH_MODULE, R_TERMINATE, R_TRACE, R_TRUNCATE, R_UMOUNT, R_WRITE, R_WRITE_OPEN, RC, rsbac_attribute_value_t::rc_role, RC_role_inherit_user, rsbac_attribute_value_t::rc_type, RC_type_inherit_parent, RC_type_inherit_process, RC_type_no_chown, RC_type_no_create, RC_type_no_execute, RC_type_use_new_role_def_create, RCR_ASSIGN, RCR_MODIFY_AUTH, RI_def_fd_create_type, RI_def_fd_ind_create_type, RI_def_group_create_type, RI_def_ipc_create_type, RI_def_process_chown_type, RI_def_process_create_type, RI_def_process_execute_type, RI_def_user_create_type, RI_type_comp_fd, RI_type_comp_group, RI_type_comp_ipc, RI_type_comp_nettemp, RI_type_comp_process, RI_type_comp_user, rsbac_rc_target_id_t::role, RSBAC_EREADFAILED, rsbac_get_attr, rsbac_kfree(), rsbac_kmalloc(), RSBAC_MAXNAMELEN, rsbac_printk(), rsbac_rc_check_comp(), rsbac_rc_check_type_comp(), RSBAC_RC_GENERAL_TYPE, rsbac_rc_get_item(), rsbac_rc_test_assign_roles(), rsbac_rc_test_role_admin(), RST_auth_administration, RT_ROLE, rsbac_target_id_t::scd, rsbac_net_obj_desc_t::sock_p, SOFTMODE, ST_other, T_DEV, T_DIR, T_FIFO, T_FILE, T_GROUP, T_IPC, T_NETDEV, T_NETOBJ, T_NETTEMP, T_NONE, T_PROCESS, T_SCD, T_SYMLINK, T_USER, TRUE, rsbac_rc_target_id_t::type, rsbac_rc_item_value_t::type_id, and UNDEFINED. Referenced by rsbac_adf_request_int(). 00479 {
00480 int err;
00481 enum rsbac_adf_req_ret_t result = DO_NOT_CARE;
00482 union rsbac_attribute_value_t i_attr_val1;
00483 union rsbac_rc_target_id_t i_rc_tid;
00484 union rsbac_rc_target_id_t i_rc_subtid;
00485 union rsbac_rc_item_value_t i_rc_item_val1;
00486 union rsbac_target_id_t i_tid;
00487 union rsbac_attribute_value_t i_attr_val2;
00488
00489 switch (request)
00490 {
00491 case R_ADD_TO_KERNEL:
00492 switch(target)
00493 {
00494 case T_NONE:
00495 /* may add to kernel, if compatible */
00496 return(check_comp_rc_scd(ST_other, request, caller_pid));
00497
00498 case T_FILE:
00499 case T_DEV:
00500 return(check_comp_rc(target, tid, request, caller_pid));
00501
00502 /* all other cases are unknown */
00503 default:
00504 return(DO_NOT_CARE);
00505 }
00506
00507
00508 case R_ALTER:
00509 /* only for IPC */
00510 switch(target)
00511 {
00512 case T_IPC:
00513 return(check_comp_rc(target, tid, request, caller_pid));
00514
00515 /* all other cases are unknown */
00516 default: return(DO_NOT_CARE);
00517 }
00518
00519 case R_APPEND_OPEN:
00520 case R_READ_WRITE_OPEN:
00521 switch(target)
00522 {
00523 case T_FILE:
00524 case T_DEV:
00525 case T_FIFO:
00526 case T_IPC:
00527 return(check_comp_rc(target, tid, request, caller_pid));
00528
00529 /* all other cases are unknown */
00530 default: return(DO_NOT_CARE);
00531 }
00532
00533 case R_CHANGE_GROUP:
00534 switch(target)
00535 {
00536 case T_FILE:
00537 case T_DIR:
00538 case T_FIFO:
00539 case T_SYMLINK:
00540 case T_IPC:
00541 #if defined(CONFIG_RSBAC_RC_UM_PROT)
00542 case T_USER:
00543 #endif
00544 return(check_comp_rc(target, tid, request, caller_pid));
00545
00546 /* all other cases are unknown */
00547 default: return(DO_NOT_CARE);
00548 }
00549
00550 case R_CHANGE_OWNER:
00551 switch(target)
00552 {
00553 case T_FILE:
00554 case T_DIR:
00555 case T_FIFO:
00556 case T_SYMLINK:
00557 case T_IPC:
00558 return(check_comp_rc(target, tid, request, caller_pid));
00559
00560 case T_PROCESS:
00561 /* get rc_role from process */
00562 if ((err=rsbac_get_attr(RC, T_PROCESS,
00563 tid,
00564 A_rc_role,
00565 &i_attr_val1,
00566 FALSE)))
00567 {
00568 rsbac_ds_get_error("rsbac_adf_request_rc", A_rc_role);
00569 return(-RSBAC_EREADFAILED);
00570 }
00571 /* get def_process_chown_type of role */
00572 i_rc_tid.role = i_attr_val1.rc_role;
00573 if ((err=rsbac_rc_get_item(0,
00574 RT_ROLE,
00575 i_rc_tid,
00576 i_rc_tid, /* dummy */
00577 RI_def_process_chown_type,
00578 &i_rc_item_val1,
00579 NULL)))
00580 {
00581 rsbac_rc_ds_get_error("rsbac_adf_request_rc()",
00582 RI_def_process_chown_type);
00583 return(-RSBAC_EREADFAILED);
00584 }
00585 if( (i_rc_item_val1.type_id == RC_type_no_chown)
00586 || (i_rc_item_val1.type_id == RC_type_no_create)
00587 )
00588 return(NOT_GRANTED);
00589 else
00590 return(GRANTED);
00591
00592 /* all other cases are unknown */
00593 default:
00594 return(DO_NOT_CARE);
00595 }
00596
00597 case R_CHDIR:
00598 switch(target)
00599 {
00600 case T_DIR:
00601 return(check_comp_rc(target, tid, request, caller_pid));
00602
00603 /* all other cases are unknown */
00604 default: return(DO_NOT_CARE);
00605 }
00606
00607 case R_CLONE:
00608 if (target == T_PROCESS)
00609 {
00610 /* check, whether we may create process of def_process_create_type */
00611 /* get rc_role from process */
00612 i_tid.process = caller_pid;
00613 if ((err=rsbac_get_attr(RC, T_PROCESS,
00614 i_tid,
00615 A_rc_role,
00616 &i_attr_val1,
00617 FALSE)))
00618 {
00619 rsbac_ds_get_error("rsbac_adf_request_rc", A_rc_role);
00620 return(NOT_GRANTED);
00621 }
00622 /* get def_process_create_type of role */
00623 i_rc_tid.role = i_attr_val1.rc_role;
00624 if ((err=rsbac_rc_get_item(0,
00625 RT_ROLE,
00626 i_rc_tid,
00627 i_rc_tid,
00628 RI_def_process_create_type,
00629 &i_rc_item_val1,
00630 NULL)))
00631 {
00632 rsbac_rc_ds_get_error("rsbac_adf_request_rc()",
00633 RI_def_process_create_type);
00634 return(-RSBAC_EREADFAILED);
00635 }
00636 switch(i_rc_item_val1.type_id)
00637 {
00638 case RC_type_no_create:
00639 #ifdef CONFIG_RSBAC_DEBUG
00640 if(rsbac_debug_adf_rc)
00641 rsbac_printk(KERN_DEBUG "rsbac_adf_request_rc(): pid %u (%.15s), owner %u, rc_role %u, def_process_create_type no_create, request CLONE -> NOT_GRANTED!\n",
00642 caller_pid, current->comm, current->uid, i_attr_val1.rc_role);
00643 #endif
00644 return(NOT_GRANTED);
00645
00646 case RC_type_use_new_role_def_create:
00647 /* error - complain and return error */
00648 rsbac_printk(KERN_WARNING
00649 "rsbac_adf_request_rc(): invalid type use_new_role_def_create in def_process_create_type of role %i!\n",
00650 i_attr_val1.rc_role);
00651 return(NOT_GRANTED);
00652
00653 case RC_type_inherit_parent:
00654 case RC_type_inherit_process:
00655 return GRANTED;
00656
00657 default:
00658 /* check, whether role has CREATE right to new type */
00659 /* check type_comp_process of role */
00660 i_rc_subtid.type = i_rc_item_val1.type_id;
00661 if(rsbac_rc_check_comp(i_attr_val1.rc_role,
00662 i_rc_subtid,
00663 RI_type_comp_process,
00664 R_CREATE))
00665 return(GRANTED);
00666 else
00667 {
00668 rsbac_printk(KERN_WARNING
00669 "rsbac_adf_request_rc(): rc_role %i has no CREATE right on its def_process_create_type %i -> NOT_GRANTED!\n",
00670 i_attr_val1.rc_role, i_rc_item_val1.type_id);
00671 return(NOT_GRANTED);
00672 }
00673 }
00674 }
00675 else
00676 return(DO_NOT_CARE);
00677
00678 /* Creating dir or (pseudo) file IN target dir! */
00679 case R_CREATE:
00680 switch(target)
00681 {
00682 case T_DIR:
00683 /* check, whether we may create files/dirs in this dir */
00684 result = check_comp_rc(target, tid, request, caller_pid);
00685 if((result != GRANTED) && (result != DO_NOT_CARE))
00686 return result;
00687
00688 /* check, whether we may create files/dirs of def_fd_create_type */
00689 /* get rc_role from process */
00690 i_tid.process = caller_pid;
00691 if ((err=rsbac_get_attr(RC, T_PROCESS,
00692 i_tid,
00693 A_rc_role,
00694 &i_attr_val1,
00695 FALSE)))
00696 {
00697 rsbac_ds_get_error("rsbac_adf_request_rc", A_rc_role);
00698 return(NOT_GRANTED);
00699 }
00700 /* get def_fd_create_type of role */
00701 /* First get target dir's efftype */
00702 if ((err=rsbac_get_attr(RC,
00703 target,
00704 tid,
00705 A_rc_type_fd,
00706 &i_attr_val2,
00707 TRUE)))
00708 {
00709 rsbac_ds_get_error("rsbac_adf_request_rc", A_rc_type_fd);
00710 return(NOT_GRANTED);
00711 }
00712 i_rc_tid.role = i_attr_val1.rc_role;
00713 i_rc_subtid.type = i_attr_val2.rc_type;
00714 if ((err=rsbac_rc_get_item(0,
00715 RT_ROLE,
00716 i_rc_tid,
00717 i_rc_subtid,
00718 RI_def_fd_ind_create_type,
00719 &i_rc_item_val1,
00720 NULL)))
00721 { /* No individual create type -> try global */
00722 if ((err=rsbac_rc_get_item(0,
00723 RT_ROLE,
00724 i_rc_tid,
00725 i_rc_subtid,
00726 RI_def_fd_create_type,
00727 &i_rc_item_val1,
00728 NULL)))
00729 {
00730 rsbac_rc_ds_get_error("rsbac_adf_request_rc()",
00731 RI_def_fd_create_type);
00732 return(NOT_GRANTED);
00733 }
00734 }
00735 switch(i_rc_item_val1.type_id)
00736 {
00737 case RC_type_no_create:
00738 #ifdef CONFIG_RSBAC_DEBUG
00739 if(rsbac_debug_adf_rc)
00740 rsbac_printk(KERN_DEBUG "rsbac_adf_request_rc(): pid %u (%.15s), owner %u, rc_role %u, def_fd_create_type no_create, request CREATE -> NOT_GRANTED!\n",
00741 caller_pid, current->comm, current->uid, i_attr_val1.rc_role);
00742 #endif
00743 return(NOT_GRANTED);
00744 break;
00745
00746 case RC_type_use_new_role_def_create:
00747 case RC_type_inherit_process:
00748 /* error - complain and return error */
00749 rsbac_printk(KERN_WARNING
00750 "rsbac_adf_request_rc(): invalid type use_new_role_def_create in def_fd_create_type of role %i!\n",
00751 i_attr_val1.rc_role);
00752 return(NOT_GRANTED);
00753
00754 case RC_type_inherit_parent:
00755 return GRANTED;
00756
00757 default:
00758 /* check, whether role has CREATE right to new type */
00759 /* get type_comp_fd of role */
00760 i_rc_subtid.type = i_rc_item_val1.type_id;
00761 if(rsbac_rc_check_comp(i_attr_val1.rc_role,
00762 i_rc_subtid,
00763 RI_type_comp_fd,
00764 R_CREATE))
00765 return(GRANTED);
00766 else
00767 {
00768 rsbac_printk(KERN_WARNING
00769 "rsbac_adf_request_rc(): rc_role %i has no CREATE right on its def_fd_create_type %i -> NOT_GRANTED!\n",
00770 i_attr_val1.rc_role, i_rc_item_val1.type_id);
00771 return(NOT_GRANTED);
00772 }
00773 }
00774
00775 case T_IPC:
00776 /* check, whether we may create IPC of def_ipc_create_type */
00777 /* get rc_role from process */
00778 i_tid.process = caller_pid;
00779 if ((err=rsbac_get_attr(RC, T_PROCESS,
00780 i_tid,
00781 A_rc_role,
00782 &i_attr_val1,
00783 FALSE)))
00784 {
00785 rsbac_ds_get_error("rsbac_adf_request_rc", A_rc_role);
00786 return(NOT_GRANTED);
00787 }
00788 /* get def_ipc_create_type of role */
00789 i_rc_tid.role = i_attr_val1.rc_role;
00790 if ((err=rsbac_rc_get_item(0,
00791 RT_ROLE,
00792 i_rc_tid,
00793 i_rc_tid,
00794 RI_def_ipc_create_type,
00795 &i_rc_item_val1,
00796 NULL)))
00797 {
00798 rsbac_rc_ds_get_error("rsbac_adf_request_rc()",
00799 RI_def_ipc_create_type);
00800 return(NOT_GRANTED);
00801 }
00802 switch(i_rc_item_val1.type_id)
00803 {
00804 case RC_type_no_create:
00805 #ifdef CONFIG_RSBAC_DEBUG
00806 if(rsbac_debug_adf_rc)
00807 rsbac_printk(KERN_DEBUG "rsbac_adf_request_rc(): pid %u (%.15s), owner %u, rc_role %u, def_ipc_create_type no_create, request CREATE -> NOT_GRANTED!\n",
00808 caller_pid, current->comm, current->uid, i_attr_val1.rc_role);
00809 #endif
00810
00811 return(NOT_GRANTED);
00812
00813 case RC_type_use_new_role_def_create:
00814 /* error - complain and return error */
00815 rsbac_printk(KERN_WARNING
00816 "rsbac_adf_request_rc(): invalid type use_new_role_def_create in def_ipc_create_type of role %i!\n",
00817 i_attr_val1.rc_role);
00818 return(NOT_GRANTED);
00819
00820 case RC_type_inherit_parent:
00821 case RC_type_inherit_process:
00822 /* error - complain and return error */
00823 rsbac_printk(KERN_WARNING
00824 "rsbac_adf_request_rc(): invalid type inherit_parent in def_ipc_create_type of role %i!\n",
00825 i_attr_val1.rc_role);
00826 return(NOT_GRANTED);
00827
00828 default:
00829 /* check, whether role has CREATE right to new type */
00830 /* get type_comp_ipc of role */
00831 i_rc_subtid.type = i_rc_item_val1.type_id;
00832 if(rsbac_rc_check_comp(i_attr_val1.rc_role,
00833 i_rc_subtid,
00834 RI_type_comp_ipc,
00835 R_CREATE))
00836 return(GRANTED);
00837 else
00838 {
00839 rsbac_printk(KERN_WARNING
00840 "rsbac_adf_request_rc(): rc_role %i has no CREATE right on its def_ipc_create_type %i -> NOT_GRANTED!\n",
00841 i_attr_val1.rc_role, i_rc_item_val1.type_id);
00842 return(NOT_GRANTED);
00843 }
00844 }
00845
00846 #if defined(CONFIG_RSBAC_RC_UM_PROT)
00847 case T_USER:
00848 /* check, whether we may create USER of def_user_create_type */
00849 /* get rc_role from process */
00850 i_tid.process = caller_pid;
00851 if ((err=rsbac_get_attr(RC, T_PROCESS,
00852 i_tid,
00853 A_rc_role,
00854 &i_attr_val1,
00855 FALSE)))
00856 {
00857 rsbac_ds_get_error("rsbac_adf_request_rc", A_rc_role);
00858 return(NOT_GRANTED);
00859 }
00860 /* get def_user_create_type of role */
00861 i_rc_tid.role = i_attr_val1.rc_role;
00862 if ((err=rsbac_rc_get_item(0,
00863 RT_ROLE,
00864 i_rc_tid,
00865 i_rc_tid,
00866 RI_def_user_create_type,
00867 &i_rc_item_val1,
00868 NULL)))
00869 {
00870 rsbac_rc_ds_get_error("rsbac_adf_request_rc()",
00871 RI_def_user_create_type);
00872 return(NOT_GRANTED);
00873 }
00874 switch(i_rc_item_val1.type_id)
00875 {
00876 case RC_type_no_create:
00877 #ifdef CONFIG_RSBAC_DEBUG
00878 if(rsbac_debug_adf_rc)
00879 rsbac_printk(KERN_DEBUG "rsbac_adf_request_rc(): pid %u (%.15s), owner %u, rc_role %u, def_user_create_type no_create, request CREATE -> NOT_GRANTED!\n",
00880 caller_pid, current->comm, current->uid, i_attr_val1.rc_role);
00881 #endif
00882 return(NOT_GRANTED);
00883
00884 case RC_type_use_new_role_def_create:
00885 /* error - complain and return error */
00886 rsbac_printk(KERN_WARNING
00887 "rsbac_adf_request_rc(): invalid type use_new_role_def_create in def_user_create_type of role %i!\n",
00888 i_attr_val1.rc_role);
00889 return(NOT_GRANTED);
00890
00891 case RC_type_inherit_parent:
00892 case RC_type_inherit_process:
00893 /* error - complain and return error */
00894 rsbac_printk(KERN_WARNING
00895 "rsbac_adf_request_rc(): invalid type inherit_parent in def_user_create_type of role %i!\n",
00896 i_attr_val1.rc_role);
00897 return(NOT_GRANTED);
00898
00899 default:
00900 /* check, whether role has CREATE right to new type */
00901 /* get type_comp_ipc of role */
00902 i_rc_subtid.type = i_rc_item_val1.type_id;
00903 if(rsbac_rc_check_comp(i_attr_val1.rc_role,
00904 i_rc_subtid,
00905 RI_type_comp_user,
00906 R_CREATE))
00907 return(GRANTED);
00908 else
00909 {
00910 rsbac_printk(KERN_WARNING
00911 "rsbac_adf_request_rc(): rc_role %i has no CREATE right on its def_user_create_type %i -> NOT_GRANTED!\n",
00912 i_attr_val1.rc_role, i_rc_item_val1.type_id);
00913 return(NOT_GRANTED);
00914 }
00915 }
00916
00917 case T_GROUP:
00918 /* check, whether we may create GROUP of def_group_create_type */
00919 /* get rc_role from process */
00920 i_tid.process = caller_pid;
00921 if ((err=rsbac_get_attr(RC, T_PROCESS,
00922 i_tid,
00923 A_rc_role,
00924 &i_attr_val1,
00925 FALSE)))
00926 {
00927 rsbac_ds_get_error("rsbac_adf_request_rc", A_rc_role);
00928 return(NOT_GRANTED);
00929 }
00930 /* get def_user_create_type of role */
00931 i_rc_tid.role = i_attr_val1.rc_role;
00932 if ((err=rsbac_rc_get_item(0,
00933 RT_ROLE,
00934 i_rc_tid,
00935 i_rc_tid,
00936 RI_def_group_create_type,
00937 &i_rc_item_val1,
00938 NULL)))
00939 {
00940 rsbac_rc_ds_get_error("rsbac_adf_request_rc()",
00941 RI_def_group_create_type);
00942 return(NOT_GRANTED);
00943 }
00944 switch(i_rc_item_val1.type_id)
00945 {
00946 case RC_type_no_create:
00947 #ifdef CONFIG_RSBAC_DEBUG
00948 if(rsbac_debug_adf_rc)
00949 rsbac_printk(KERN_DEBUG "rsbac_adf_request_rc(): pid %u (%.15s), owner %u, rc_role %u, def_group_create_type no_create, request CREATE -> NOT_GRANTED!\n",
00950 caller_pid, current->comm, current->uid, i_attr_val1.rc_role);
00951 #endif
00952 return(NOT_GRANTED);
00953
00954 case RC_type_use_new_role_def_create:
00955 /* error - complain and return error */
00956 rsbac_printk(KERN_WARNING
00957 "rsbac_adf_request_rc(): invalid type use_new_role_def_create in def_group_create_type of role %i!\n",
00958 i_attr_val1.rc_role);
00959 return(NOT_GRANTED);
00960
00961 case RC_type_inherit_parent:
00962 case RC_type_inherit_process:
00963 /* error - complain and return error */
00964 rsbac_printk(KERN_WARNING
00965 "rsbac_adf_request_rc(): invalid type inherit_parent in def_group_create_type of role %i!\n",
00966 i_attr_val1.rc_role);
00967 return(NOT_GRANTED);
00968
00969 default:
00970 /* check, whether role has CREATE right to new type */
00971 /* get type_comp_ipc of role */
00972 i_rc_subtid.type = i_rc_item_val1.type_id;
00973 if(rsbac_rc_check_comp(i_attr_val1.rc_role,
00974 i_rc_subtid,
00975 RI_type_comp_group,
00976 R_CREATE))
00977 return(GRANTED);
00978 else
00979 {
00980 rsbac_printk(KERN_WARNING
00981 "rsbac_adf_request_rc(): rc_role %i has no CREATE right on its def_group_create_type %i -> NOT_GRANTED!\n",
00982 i_attr_val1.rc_role, i_rc_item_val1.type_id);
00983 return(NOT_GRANTED);
00984 }
00985 }
00986 #endif /* RSBAC_RC_UM_PROT */
00987
00988 #if defined(CONFIG_RSBAC_RC_NET_OBJ_PROT)
00989 case T_NETTEMP:
00990 /* get rc_role from process */
00991 i_tid.process = caller_pid;
00992 if ((err=rsbac_get_attr(RC,
00993 T_PROCESS,
00994 i_tid,
00995 A_rc_role,
00996 &i_attr_val1,
00997 FALSE)))
00998 {
00999 rsbac_ds_get_error("rsbac_adf_request_rc", A_rc_role);
01000 return(NOT_GRANTED);
01001 }
01002 /* get type_comp_xxx of role - we always use type GENERAL for CREATE */
01003 i_rc_subtid.type = RSBAC_RC_GENERAL_TYPE;
01004 if(rsbac_rc_check_comp(i_attr_val1.rc_role,
01005 i_rc_subtid,
01006 RI_type_comp_nettemp,
01007 request))
01008 return(GRANTED);
01009 else
01010 {
01011 #ifdef CONFIG_RSBAC_DEBUG
01012 if(rsbac_debug_adf_rc)
01013 {
01014 char * tmp = rsbac_kmalloc(RSBAC_MAXNAMELEN);
01015
01016 if(tmp)
01017 {
01018 rsbac_printk(KERN_DEBUG
01019 "rsbac_adf_request_rc(): rc_role is %i, rc_nettemp_type is %i, request is CREATE -> NOT_GRANTED!\n",
01020 i_attr_val1.rc_role, RSBAC_RC_GENERAL_TYPE);
01021 rsbac_kfree(tmp);
01022 }
01023 }
01024 #endif
01025 return(NOT_GRANTED);
01026 }
01027
01028 case T_NETOBJ:
01029 /* check, whether we may create NETOBJ of this type */
01030 return(check_comp_rc(target, tid, request, caller_pid));
01031 #endif
01032
01033 /* all other cases are unknown */
01034 default: return(DO_NOT_CARE);
01035 }
01036
01037 case R_DELETE:
01038 switch(target)
01039 {
01040 case T_FILE:
01041 case T_DIR:
01042 case T_FIFO:
01043 case T_SYMLINK:
01044 case T_IPC:
01045 #if defined(CONFIG_RSBAC_RC_NET_OBJ_PROT)
01046 case T_NETTEMP:
01047 case T_NETOBJ:
01048 #endif
01049 #if defined(CONFIG_RSBAC_RC_UM_PROT)
01050 case T_USER:
01051 case T_GROUP:
01052 #endif
01053 return(check_comp_rc(target, tid, request, caller_pid));
01054
01055 /* all other cases are unknown */
01056 default: return(DO_NOT_CARE);
01057 }
01058
01059 case R_EXECUTE:
01060 switch(target)
01061 {
01062 case T_FILE:
01063 /* get rc_role from process */
01064 if ((err=rsbac_get_attr(RC, T_PROCESS,
01065 tid,
01066 A_rc_role,
01067 &i_attr_val1,
01068 FALSE)))
01069 {
01070 rsbac_ds_get_error("rsbac_adf_request_rc", A_rc_role);
01071 return(NOT_GRANTED);
01072 }
01073 /* get def_process_execute_type of role */
01074 i_rc_tid.role = i_attr_val1.rc_role;
01075 if ((err=rsbac_rc_get_item(0,
01076 RT_ROLE,
01077 i_rc_tid,
01078 i_rc_tid,
01079 RI_def_process_execute_type,
01080 &i_rc_item_val1,
01081 NULL)))
01082 {
01083 rsbac_rc_ds_get_error("rsbac_adf_request_rc()",
01084 RI_def_process_execute_type);
01085 return(NOT_GRANTED);
01086 }
01087 if(i_rc_item_val1.type_id == RC_type_no_execute)
01088 return(NOT_GRANTED);
01089 else
01090 return(check_comp_rc(target, tid, request, caller_pid));
01091
01092 /* all other cases are unknown */
01093 default:
01094 return(DO_NOT_CARE);
01095 }
01096
01097 case R_GET_PERMISSIONS_DATA:
01098 switch(target)
01099 {
01100 case T_SCD:
01101 return(check_comp_rc_scd(tid.scd, request, caller_pid));
01102 case T_FILE:
01103 case T_DIR:
01104 case T_FIFO:
01105 case T_SYMLINK:
01106 case T_IPC:
01107 case T_DEV:
01108 #if defined(CONFIG_RSBAC_RC_NET_OBJ_PROT)
01109 case T_NETOBJ:
01110 #endif
01111 #if defined(CONFIG_RSBAC_RC_UM_PROT)
01112 case T_USER:
01113 case T_GROUP:
01114 #endif
01115 return(check_comp_rc(target, tid, request, caller_pid));
01116
01117 default:
01118 return(DO_NOT_CARE);
01119 };
01120
01121 case R_GET_STATUS_DATA:
01122 switch(target)
01123 {
01124 case T_SCD:
01125 return(check_comp_rc_scd(tid.scd, request, caller_pid));
01126 case T_FILE:
01127 case T_DIR:
01128 case T_FIFO:
01129 case T_SYMLINK:
01130 case T_IPC:
01131 case T_PROCESS:
01132 case T_DEV:
01133 #if defined(CONFIG_RSBAC_RC_UM_PROT)
01134 case T_USER:
01135 case T_GROUP:
01136 #endif
01137 return(check_comp_rc(target, tid, request, caller_pid));
01138
01139 #if defined(CONFIG_RSBAC_RC_NET_DEV_PROT)
01140 case T_NETDEV:
01141 return(check_comp_rc(target, tid, request, caller_pid));
01142 #endif
01143 #if defined(CONFIG_RSBAC_RC_NET_OBJ_PROT)
01144 case T_NETOBJ:
01145 return(check_comp_rc(target, tid, request, caller_pid));
01146 #endif
01147
01148 default:
01149 return(DO_NOT_CARE);
01150 }
01151
01152 case R_LINK_HARD:
01153 switch(target)
01154 {
01155 case T_FILE:
01156 case T_FIFO:
01157 case T_SYMLINK:
01158 return(check_comp_rc(target, tid, request, caller_pid));
01159
01160 /* all other cases are unknown */
01161 default: return(DO_NOT_CARE);
01162 }
01163
01164 case R_MAP_EXEC:
01165 switch(target)
01166 {
01167 case T_FILE:
01168 return(check_comp_rc(target, tid, request, caller_pid));
01169
01170 /* all other cases are unknown */
01171 default:
01172 return(DO_NOT_CARE);
01173 }
01174
01175 case R_MODIFY_ACCESS_DATA:
01176 switch(target)
01177 {
01178 case T_FILE:
01179 case T_DIR:
01180 case T_FIFO:
01181 case T_SYMLINK:
01182 return(check_comp_rc(target, tid, request, caller_pid));
01183
01184 /* all other cases are unknown */
01185 default: return(DO_NOT_CARE);
01186 }
01187
01188 case R_MODIFY_ATTRIBUTE:
01189 switch(attr)
01190 { /* owner must be changed by other request to prevent inconsistency */
01191 case A_owner:
01192 return(NOT_GRANTED);
01193 case A_rc_type:
01194 case A_local_rc_type:
01195 case A_remote_rc_type:
01196 case A_rc_type_fd:
01197 case A_rc_type_nt:
01198 /* Granted on target? */
01199 result = check_comp_rc(target, tid, request, caller_pid);
01200 if( (result == GRANTED)
01201 || (result == DO_NOT_CARE)
01202 )
01203 {
01204 /* Granted on type? */
01205 result = rsbac_rc_check_type_comp(target, attr_val.rc_type, RCR_ASSIGN, caller_pid);
01206 if( (result == GRANTED)
01207 || (result == DO_NOT_CARE)
01208 )
01209 return result;
01210 }
01211 /* Classical admin_type check */
01212 if ((err=rsbac_rc_test_role_admin(TRUE)))
01213 return(NOT_GRANTED);
01214 else
01215 return(GRANTED);
01216
01217 case A_rc_force_role:
01218 case A_rc_initial_role:
01219 case A_rc_role:
01220 case A_rc_def_role:
01221 /* Granted on target? */
01222 result = check_comp_rc(target, tid, request, caller_pid);
01223 if( (result == GRANTED)
01224 || (result == DO_NOT_CARE)
01225 )
01226 {
01227 /* test assign_roles of process / modify */
01228 if (!(err=rsbac_rc_test_assign_roles(target, tid, attr, attr_val.rc_role)))
01229 return(GRANTED);
01230 }
01231 /* Classical admin_type check */
01232 if (rsbac_rc_test_role_admin(TRUE))
01233 return(NOT_GRANTED);
01234 else
01235 return(GRANTED);
01236
01237 /* you may only change a user's pseudo, if you also may assign her role */
01238 case A_pseudo:
01239 if(target != T_USER)
01240 return UNDEFINED;
01241 /* test assign_roles of process for user's role only */
01242 if (rsbac_rc_test_assign_roles(target, tid, A_rc_def_role, RC_role_inherit_user))
01243 return(NOT_GRANTED);
01244 else
01245 return(GRANTED);
01246
01247 #ifdef CONFIG_RSBAC_RC_GEN_PROT
01248 case A_log_array_low:
01249 case A_log_array_high:
01250 case A_log_program_based:
01251 case A_log_user_based:
01252 case A_symlink_add_remote_ip:
01253 case A_symlink_add_uid:
01254 case A_symlink_add_rc_role:
01255 case A_linux_dac_disable:
01256 case A_fake_root_uid:
01257 case A_audit_uid:
01258 case A_auid_exempt:
01259 case A_remote_ip:
01260 /* Explicitely granted? */
01261 result = check_comp_rc(target, tid, request, caller_pid);
01262 if( (result == GRANTED)
01263 || (result == DO_NOT_CARE)
01264 )
01265 return result;
01266 /* Failed -> Classical admin_type check / modify */
01267 if (rsbac_rc_test_role_admin(TRUE))
01268 return(NOT_GRANTED);
01269 else
01270 return(GRANTED);
01271 #endif
01272
01273 /* All attributes (remove target!) */
01274 case A_none:
01275 switch(target)
01276 {
01277 case T_USER:
01278 /* test assign_roles of process for user's role */
01279 if ((err=rsbac_rc_test_assign_roles(target, tid, A_rc_def_role, RC_role_inherit_user)))
01280 return(NOT_GRANTED);
01281 else
01282 return(GRANTED);
01283
01284 default:
01285 /* Explicitely granted? */
01286 return(check_comp_rc(target, tid, request, caller_pid));
01287 }
01288
01289 #ifdef CONFIG_RSBAC_RC_AUTH_PROT
01290 case A_auth_may_setuid:
01291 case A_auth_may_set_cap:
01292 case A_auth_start_uid:
01293 case A_auth_start_euid:
01294 case A_auth_start_gid:
01295 case A_auth_start_egid:
01296 case A_auth_program_file:
01297 case A_auth_learn:
01298 case A_auth_add_f_cap:
01299 case A_auth_remove_f_cap:
01300 case A_auth_last_auth:
01301 /* may manipulate auth capabilities, if allowed in general... */
01302 result = check_comp_rc_scd(RST_auth_administration, request, caller_pid);
01303 if( (result == GRANTED)
01304 || (result == DO_NOT_CARE)
01305 )
01306 {
01307 /* ...and for this target */
01308 result = check_comp_rc(target, tid, RCR_MODIFY_AUTH, caller_pid);
01309 if( (result == GRANTED)
01310 || (result == DO_NOT_CARE)
01311 )
01312 return result;
01313 }
01314 /* Last chance: classical admin_type check */
01315 if ((err=rsbac_rc_test_role_admin(TRUE)))
01316 return(NOT_GRANTED);
01317 else
01318 return(GRANTED);
01319 #endif
01320
01321 default:
01322 return(DO_NOT_CARE);
01323 }
01324
01325 case R_MODIFY_PERMISSIONS_DATA:
01326 switch(target)
01327 {
01328 case T_FILE:
01329 case T_DIR:
01330 case T_FIFO:
01331 case T_SYMLINK:
01332 case T_IPC:
01333 case T_DEV:
01334 #if defined(CONFIG_RSBAC_RC_UM_PROT)
01335 case T_USER:
01336 case T_GROUP:
01337 #endif
01338 #if defined(CONFIG_RSBAC_RC_NET_OBJ_PROT)
01339 case T_NETOBJ:
01340 #endif
01341 return(check_comp_rc(target, tid, request, caller_pid));
01342
01343 case T_SCD:
01344 return(check_comp_rc_scd(tid.scd, request, caller_pid));
01345
01346 #ifdef CONFIG_RSBAC_ALLOW_DAC_DISABLE
01347 case T_NONE:
01348 /* may turn off Linux DAC, if compatible */
01349 return(check_comp_rc_scd(ST_other, request, caller_pid));
01350 #endif
01351
01352 /* all other cases are unknown */
01353 default: return(DO_NOT_CARE);
01354 }
01355
01356 case R_MODIFY_SYSTEM_DATA:
01357 switch(target)
01358 {
01359 case T_SCD:
01360 return(check_comp_rc_scd(tid.scd, request, caller_pid));
01361
01362 case T_DEV:
01363 case T_PROCESS:
01364 #if defined(CONFIG_RSBAC_RC_NET_DEV_PROT)
01365 case T_NETDEV:
01366 #endif
01367 #if defined(CONFIG_RSBAC_RC_NET_OBJ_PROT)
01368 case T_NETOBJ:
01369 #endif
01370 return(check_comp_rc(target, tid, request, caller_pid));
01371
01372 /* all other cases are unknown */
01373 default: return(DO_NOT_CARE);
01374 }
01375
01376 case R_MOUNT:
01377 switch(target)
01378 {
01379 case T_FILE:
01380 case T_DIR:
01381 case T_DEV:
01382 return(check_comp_rc(target, tid, request, caller_pid));
01383
01384 /* all other cases are unknown */
01385 default: return(DO_NOT_CARE);
01386 }
01387
01388 case R_READ:
01389 case R_WRITE:
01390 switch(target)
01391 {
01392 case T_DIR:
01393 case T_IPC:
01394 #ifdef CONFIG_RSBAC_RW
01395 case T_FILE:
01396 case T_FIFO:
01397 case T_DEV:
01398 #endif
01399 #if defined(CONFIG_RSBAC_RC_UM_PROT)
01400 case T_USER:
01401 case T_GROUP:
01402 #endif
01403 #if defined(CONFIG_RSBAC_RC_NET_OBJ_PROT)
01404 #if defined(CONFIG_RSBAC_NET_OBJ_RW)
01405 case T_NETTEMP:
01406 #endif
01407 #endif
01408 return(check_comp_rc(target, tid, request, caller_pid));
01409
01410 case T_SCD:
01411 return(check_comp_rc_scd(tid.scd, request, caller_pid));
01412
01413 #if defined(CONFIG_RSBAC_RC_NET_OBJ_PROT)
01414 #if defined(CONFIG_RSBAC_NET_OBJ_RW)
01415 case T_NETOBJ:
01416 #if defined(CONFIG_RSBAC_RC_NET_OBJ_UNIX_PROCESS)
01417 if( tid.netobj.sock_p
01418 && tid.netobj.sock_p->ops
01419 && (tid.netobj.sock_p->ops->family == AF_UNIX)
01420 && tid.netobj.sock_p->sk
01421 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
01422 && tid.netobj.sock_p->sk->sk_peercred.pid
01423 #else
01424 && tid.netobj.sock_p->sk->peercred.pid
01425 #endif
01426 )
01427 {
01428 enum rsbac_adf_req_ret_t tmp_result;
01429
01430 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
01431 i_tid.process = tid.netobj.sock_p->sk->sk_peercred.pid;
01432 #else
01433 i_tid.process = tid.netobj.sock_p->sk->peercred.pid;
01434 #endif
01435 if(request == R_READ)
01436 tmp_result = check_comp_rc(T_PROCESS, i_tid, R_RECEIVE, caller_pid);
01437 else
01438 tmp_result = check_comp_rc(T_PROCESS, i_tid, R_SEND, caller_pid);
01439 if( (tmp_result == NOT_GRANTED)
01440 || (tmp_result == UNDEFINED)
01441 )
01442 return tmp_result;
01443 }
01444 #endif /* UNIX_PROCESS */
01445 return(check_comp_rc(target, tid, request, caller_pid));
01446 #endif
01447 #endif
01448
01449 /* all other cases are unknown */
01450 default: return(DO_NOT_CARE);
01451 }
01452
01453 case R_READ_ATTRIBUTE:
01454 switch(attr)
01455 {
01456 case A_rc_type:
01457 case A_rc_type_fd:
01458 case A_rc_type_nt:
01459 case A_rc_force_role:
01460 case A_rc_initial_role:
01461 case A_rc_role:
01462 case A_rc_def_role:
01463 case A_pseudo:
01464 #ifdef CONFIG_RSBAC_RC_GEN_PROT
01465 case A_owner:
01466 case A_log_array_low:
01467 case A_log_array_high:
01468 case A_log_program_based:
01469 case A_log_user_based:
01470 case A_symlink_add_remote_ip:
01471 case A_symlink_add_uid:
01472 case A_symlink_add_rc_role:
01473 case A_linux_dac_disable:
01474 case A_fake_root_uid:
01475 case A_audit_uid:
01476 case A_auid_exempt:
01477 case A_remote_ip:
01478 #endif
01479 /* Explicitely granted? */
01480 result = check_comp_rc(target, tid, request, caller_pid);
01481 if( (result == GRANTED)
01482 || (result == DO_NOT_CARE)
01483 )
01484 return result;
01485 /* Failed -> Classical admin_type check / modify */
01486 if (rsbac_rc_test_role_admin(FALSE))
01487 return(NOT_GRANTED);
01488 else
01489 return(GRANTED);
01490
01491 #ifdef CONFIG_RSBAC_RC_AUTH_PROT
01492 case A_auth_may_setuid:
01493 case A_auth_may_set_cap:
01494 case A_auth_start_uid:
01495 case A_auth_start_euid:
01496 case A_auth_start_gid:
01497 case A_auth_start_egid:
01498 case A_auth_program_file:
01499 case A_auth_learn:
01500 case A_auth_add_f_cap:
01501 case A_auth_remove_f_cap:
01502 case A_auth_last_auth:
01503 /* may read auth capabilities, if compatible */
01504 result = check_comp_rc_scd(RST_auth_administration, request, caller_pid);
01505 if( (result == GRANTED)
01506 || (result == DO_NOT_CARE)
01507 )
01508 return result;
01509 /* Failed -> Classical admin_type check / modify */
01510 if (rsbac_rc_test_role_admin(FALSE))
01511 return(NOT_GRANTED);
01512 else
01513 return(GRANTED);
01514 #endif
01515
01516 default:
01517 return(DO_NOT_CARE);
01518 }
01519
01520 case R_READ_OPEN:
01521 switch(target)
01522 {
01523 case T_FILE:
01524 case T_FIFO:
01525 case T_DEV:
01526 case T_IPC:
01527 return(check_comp_rc(target, tid, request, caller_pid));
01528
01529 /* all other cases are unknown */
01530 default: return(DO_NOT_CARE);
01531 }
01532
01533 case R_REMOVE_FROM_KERNEL:
01534 switch(target)
01535 {
01536 case T_NONE:
01537 return(check_comp_rc_scd(ST_other, request, caller_pid));
01538
01539 case T_FILE:
01540 case T_DEV:
01541 return(check_comp_rc(target, tid, request, caller_pid));
01542
01543 /* all other cases are unknown */
01544 default: return(DO_NOT_CARE);
01545 }
01546
01547 case R_RENAME:
01548 switch(target)
01549 {
01550 case T_FILE:
01551 case T_DIR:
01552 case T_FIFO:
01553 case T_SYMLINK:
01554 #if defined(CONFIG_RSBAC_RC_UM_PROT)
01555 case T_USER:
01556 case T_GROUP:
01557 #endif
01558 return(check_comp_rc(target, tid, request, caller_pid));
01559
01560 /* all other cases are unknown */
01561 default: return(DO_NOT_CARE);
01562 }
01563
01564 case R_SEARCH:
01565 switch(target)
01566 {
01567 case T_DIR:
01568 case T_SYMLINK:
01569 #if defined(CONFIG_RSBAC_RC_UM_PROT)
01570 case T_USER:
01571 case T_GROUP:
01572 #endif
01573 return(check_comp_rc(target, tid, request, caller_pid));
01574
01575 /* all other cases are unknown */
01576 default: return(DO_NOT_CARE);
01577 }
01578
01579 case R_SEND_SIGNAL:
01580 case R_TRACE:
01581 if (target == T_PROCESS)
01582 return(check_comp_rc(target, tid, request, caller_pid));
01583 else
01584 return(DO_NOT_CARE);
01585
01586 case R_SHUTDOWN:
01587 switch(target)
01588 {
01589 case T_NONE:
01590 return(check_comp_rc_scd(ST_other, request, caller_pid));
01591
01592 /* all other cases are unknown */
01593 default: return(DO_NOT_CARE);
01594 }
01595
01596 case R_SWITCH_LOG:
01597 switch(target)
01598 {
01599 case T_NONE:
01600 return(check_comp_rc_scd(ST_other, request, caller_pid));
01601
01602 /* all other cases are unknown */
01603 default: return(DO_NOT_CARE);
01604 }
01605
01606 case R_SWITCH_MODULE:
01607 switch(target)
01608 {
01609 case T_NONE:
01610 /* we need the switch_target */
01611 if(attr != A_switch_target)
01612 return(UNDEFINED);
01613 /* do not care for other modules */
01614 if( (attr_val.switch_target != RC)
01615 #ifdef CONFIG_RSBAC_SOFTMODE
01616 && (attr_val.switch_target != SOFTMODE)
01617 #endif
01618 #ifdef CONFIG_RSBAC_FREEZE
01619 && (attr_val.switch_target != FREEZE)
01620 #endif
01621 #ifdef CONFIG_RSBAC_RC_AUTH_PROT
01622 && (attr_val.switch_target != AUTH)
01623 #endif
01624 )
01625 return(DO_NOT_CARE);
01626 return(check_comp_rc_scd(ST_other, request, caller_pid));
01627
01628 /* all other cases are unknown */
01629 default: return(DO_NOT_CARE);
01630 }
01631
01632 case R_TERMINATE:
01633 if (target == T_PROCESS)
01634 return(DO_NOT_CARE);
01635 else
01636 return(DO_NOT_CARE);
01637
01638 case R_TRUNCATE:
01639 switch(target)
01640 {
01641 case T_FILE:
01642 return(check_comp_rc(target, tid, request, caller_pid));
01643
01644 /* all other cases are unknown */
01645 default: return(DO_NOT_CARE);
01646 }
01647
01648 case R_WRITE_OPEN:
01649 switch(target)
01650 {
01651 case T_FILE:
01652 case T_DEV:
01653 case T_FIFO:
01654 case T_IPC:
01655 return(check_comp_rc(target, tid, request, caller_pid));
01656
01657 /* all other cases are unknown */
01658 default: return(DO_NOT_CARE);
01659 }
01660
01661 case R_UMOUNT:
01662 switch(target)
01663 {
01664 case T_FILE:
01665 case T_DIR:
01666 case T_DEV:
01667 return(check_comp_rc(target, tid, request, caller_pid));
01668
01669 /* all other cases are unknown */
01670 default: return(DO_NOT_CARE);
01671 }
01672
01673
01674 #if defined(CONFIG_RSBAC_NET)
01675 case R_BIND:
01676 switch(target)
01677 {
01678 #if defined(CONFIG_RSBAC_RC_NET_DEV_PROT)
01679 case T_NETDEV:
01680 return(check_comp_rc(target, tid, request, caller_pid));
01681 #endif
01682
01683 #if defined(CONFIG_RSBAC_RC_NET_OBJ_PROT)
01684 case T_NETOBJ:
01685 return(check_comp_rc(target, tid, request, caller_pid));
01686 #endif
01687
01688 /* all other cases are undefined */
01689 default: return(DO_NOT_CARE);
01690 }
01691 #endif
01692
01693 case R_SEND:
01694 switch(target)
01695 {
01696 case T_DEV:
01697 return(check_comp_rc(target, tid, request, caller_pid));
01698
01699 #if defined(CONFIG_RSBAC_RC_NET_OBJ_PROT)
01700 case T_NETOBJ:
01701 #if defined(CONFIG_RSBAC_RC_NET_OBJ_UNIX_PROCESS)
01702 if( tid.netobj.sock_p
01703 && tid.netobj.sock_p->ops
01704 && (tid.netobj.sock_p->ops->family == AF_UNIX)
01705 && tid.netobj.sock_p->sk
01706 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
01707 && tid.netobj.sock_p->sk->sk_peercred.pid
01708 #else
01709 && tid.netobj.sock_p->sk->peercred.pid
01710 #endif
01711 )
01712 {
01713 enum rsbac_adf_req_ret_t tmp_result;
01714
01715 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
01716 i_tid.process = tid.netobj.sock_p->sk->sk_peercred.pid;
01717 #else
01718 i_tid.process = tid.netobj.sock_p->sk->peercred.pid;
01719 #endif
01720 tmp_result = check_comp_rc(T_PROCESS, i_tid, request, caller_pid);
01721 if( (tmp_result == NOT_GRANTED)
01722 || (tmp_result == UNDEFINED)
01723 )
01724 return tmp_result;
01725 }
01726 #endif /* UNIX_PROCESS */
01727
01728 return(check_comp_rc(target, tid, request, caller_pid));
01729 #endif /* NET_OBJ_PROT */
01730
01731 /* all other cases are undefined */
01732 default: return(DO_NOT_CARE);
01733 }
01734
01735 #if defined(CONFIG_RSBAC_RC_NET_OBJ_PROT)
01736 case R_LISTEN:
01737 case R_NET_SHUTDOWN:
01738 switch(target)
01739 {
01740 case T_NETOBJ:
01741 return(check_comp_rc(target, tid, request, caller_pid));
01742
01743 /* all other cases are undefined */
01744 default: return(DO_NOT_CARE);
01745 }
01746 case R_ACCEPT:
01747 case R_CONNECT:
01748 case R_RECEIVE:
01749 switch(target)
01750 {
01751 case T_NETOBJ:
01752 #if defined(CONFIG_RSBAC_RC_NET_OBJ_UNIX_PROCESS)
01753 if( tid.netobj.sock_p
01754 && tid.netobj.sock_p->ops
01755 && (tid.netobj.sock_p->ops->family == AF_UNIX)
01756 && tid.netobj.sock_p->sk
01757 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
01758 && tid.netobj.sock_p->sk->sk_peercred.pid
01759 #else
01760 && tid.netobj.sock_p->sk->peercred.pid
01761 #endif
01762 )
01763 {
01764 enum rsbac_adf_req_ret_t tmp_result;
01765
01766 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
01767 i_tid.process = tid.netobj.sock_p->sk->sk_peercred.pid;
01768 #else
01769 i_tid.process = tid.netobj.sock_p->sk->peercred.pid;
01770 #endif
01771 tmp_result = check_comp_rc(T_PROCESS, i_tid, request, caller_pid);
01772 if( (tmp_result == NOT_GRANTED)
01773 || (tmp_result == UNDEFINED)
01774 )
01775 return tmp_result;
01776 }
01777 #endif /* UNIX_PROCESS */
01778
01779 return(check_comp_rc(target, tid, request, caller_pid));
01780
01781 /* all other cases are undefined */
01782 default: return(DO_NOT_CARE);
01783 }
01784 #endif
01785
01786 case R_IOCTL:
01787 switch(target)
01788 {
01789 case T_DEV:
01790 #if defined(CONFIG_RSBAC_RC_NET_OBJ_PROT)
01791 case T_NETOBJ:
01792 #endif
01793 return(check_comp_rc(target, tid, request, caller_pid));
01794
01795 default:
01796 return(DO_NOT_CARE);
01797 }
01798
01799 case R_LOCK:
01800 switch(target)
01801 {
01802 case T_FILE:
01803 case T_DIR:
01804 case T_FIFO:
01805 case T_SYMLINK:
01806 return(check_comp_rc(target, tid, request, caller_pid));
01807
01808 default:
01809 return(DO_NOT_CARE);
01810 }
01811
01812 /*********************/
01813 default: return DO_NOT_CARE;
01814 }
01815
01816 return result;
01817 } /* end of rsbac_adf_request_rc() */
|
|
||||||||||||||||||||||||||||||||||||||||
|
Definition at line 1831 of file rc_main.c. References A_rc_def_role, A_rc_force_role, A_rc_initial_role, A_rc_role, A_rc_type, A_rc_type_fd, FALSE, GEN, NULL, rsbac_attribute_value_t::owner, rsbac_target_id_t::process, R_CHANGE_OWNER, R_CLONE, R_CREATE, R_EXECUTE, RC, rsbac_attribute_value_t::rc_def_role, RC_default_root_dir_force_role, RC_default_root_dir_initial_role, rsbac_attribute_value_t::rc_force_role, rsbac_attribute_value_t::rc_initial_role, rsbac_attribute_value_t::rc_role, RC_role_inherit_parent, RC_role_inherit_process, RC_role_inherit_up_mixed, RC_role_inherit_user, RC_role_max_value, RC_role_min_special, RC_role_use_force_role, rsbac_attribute_value_t::rc_type, rsbac_attribute_value_t::rc_type_fd, RC_type_inherit_parent, RC_type_inherit_process, RC_type_no_chown, RC_type_no_create, RC_type_no_execute, RC_type_use_new_role_def_create, RI_def_fd_create_type, RI_def_fd_ind_create_type, RI_def_group_create_type, RI_def_ipc_create_type, RI_def_process_chown_type, RI_def_process_create_type, RI_def_process_execute_type, RI_def_user_create_type, rsbac_rc_target_id_t::role, RSBAC_EDECISIONMISMATCH, RSBAC_EINVALIDATTR, RSBAC_EINVALIDVALUE, RSBAC_EREADFAILED, RSBAC_EWRITEFAILED, rsbac_get_attr, rsbac_printk(), RSBAC_RC_GENERAL_ROLE, RSBAC_RC_GENERAL_TYPE, rsbac_rc_get_item(), RSBAC_RC_KERNEL_P_TYPE, rsbac_set_attr, RT_ROLE, T_DIR, T_FILE, T_GROUP, T_IPC, T_PROCESS, T_USER, TRUE, rsbac_rc_target_id_t::type, rsbac_rc_item_value_t::type_id, and rsbac_target_id_t::user. Referenced by rsbac_adf_set_attr(). 01841 {
01842 int err;
01843 union rsbac_target_id_t i_tid;
01844 union rsbac_attribute_value_t i_attr_val1;
01845 union rsbac_attribute_value_t i_attr_val2;
01846 union rsbac_rc_target_id_t i_rc_tid;
01847 union rsbac_rc_target_id_t i_rc_subtid;
01848 union rsbac_rc_item_value_t i_rc_item_val1;
01849
01850 switch (request)
01851 {
01852 case R_CHANGE_OWNER:
01853 switch (target)
01854 {
01855 case T_PROCESS:
01856 /* setting owner for process is done in main dispatcher */
01857 /* Here we have to adjust the rc_type and set the rc_role */
01858 /* to the new owner's rc_def_role */
01859 if(attr != A_owner)
01860 return(-RSBAC_EINVALIDATTR);
01861
01862 /* get old rc_role from process */
01863 i_tid.process = caller_pid;
01864 if ((err=rsbac_get_attr(RC, T_PROCESS,
01865 i_tid,
01866 A_rc_role,
01867 &i_attr_val1,
01868 TRUE)))
01869 {
01870 rsbac_ds_get_error("rsbac_adf_set_attr_rc", A_rc_role);
01871 return(-RSBAC_EREADFAILED);
01872 }
01873 /* get def_process_chown_type of old role */
01874 i_rc_tid.role = i_attr_val1.rc_role;
01875 if ((err=rsbac_rc_get_item(0,
01876 RT_ROLE,
01877 i_rc_tid,
01878 i_rc_tid,
01879 RI_def_process_chown_type,
01880 &i_rc_item_val1,
01881 NULL)))
01882 {
01883 rsbac_rc_ds_get_error("rsbac_adf_set_attr_rc()",
01884 RI_def_process_chown_type);
01885 return(-RSBAC_EREADFAILED);
01886 }
01887
01888 /* get rc_force_role from process */
01889 i_tid.process = caller_pid;
01890 if ((err=rsbac_get_attr(RC, T_PROCESS,
01891 i_tid,
01892 A_rc_force_role,
01893 &i_attr_val1,
01894 TRUE)))
01895 {
01896 rsbac_ds_get_error("rsbac_adf_set_attr_rc", A_rc_force_role);
01897 return(-RSBAC_EREADFAILED);
01898 }
01899 /* only set to user's rc_def_role, if indicated by force_role, otherwise keep */
01900 if( (i_attr_val1.rc_force_role == RC_role_inherit_user)
01901 || (i_attr_val1.rc_force_role == RC_role_inherit_up_mixed)
01902 )
01903 {
01904 /* get rc_def_role from new owner */
01905 i_tid.user = attr_val.owner;
01906 if ((err=rsbac_get_attr(RC, T_USER,
01907 i_tid,
01908 A_rc_def_role,
01909 &i_attr_val1,
01910 TRUE)))
01911 {
01912 rsbac_ds_get_error("rsbac_adf_set_attr_rc", A_rc_def_role);
01913 return(-RSBAC_EREADFAILED);
01914 }
01915 /* check rc_def_role, warn, if unusable */
01916 if(i_attr_val1.rc_def_role > RC_role_max_value)
01917 {
01918 rsbac_printk(KERN_WARNING
01919 "rsbac_adf_set_attr_rc(): rc_def_role %u of user %u is higher than MAX_ROLE %u, setting role of process %u to GENERAL_ROLE %u!\n",
01920 i_attr_val1.rc_def_role, attr_val.owner, RC_role_max_value, caller_pid, RSBAC_RC_GENERAL_ROLE);
01921 i_attr_val1.rc_def_role = RSBAC_RC_GENERAL_ROLE;
01922 }
01923 /* set new rc_role for process */
01924 i_tid.process = caller_pid;
01925 if ((err=rsbac_set_attr(RC, T_PROCESS,
01926 i_tid,
01927 A_rc_role,
01928 i_attr_val1)))
01929 {
01930 rsbac_ds_set_error("rsbac_adf_set_attr_rc", A_rc_role);
01931 return(-RSBAC_EWRITEFAILED);
01932 }
01933 }
01934 else /* set it to the force_role, if real role) */
01935 if( (i_attr_val1.rc_force_role <= RC_role_max_value)
01936 )
01937 {
01938 /* set new rc_role for process */
01939 i_tid.process = caller_pid;
01940 if ((err=rsbac_set_attr(RC, T_PROCESS,
01941 i_tid,
01942 A_rc_role,
01943 i_attr_val1)))
01944 {
01945 rsbac_ds_set_error("rsbac_adf_set_attr_rc", A_rc_role);
01946 return(-RSBAC_EWRITEFAILED);
01947 }
01948 }
01949
01950 /* adjust type: switch on def_process_chown_type of old role */
01951 switch(i_rc_item_val1.type_id)
01952 {
01953 case RC_type_inherit_parent:
01954 case RC_type_inherit_process:
01955 /* keep old type */
01956 break;
01957 case RC_type_use_new_role_def_create:
01958 /* Cannot adjust, if new role is no real role */
01959 if(i_attr_val1.rc_role > RC_role_max_value)
01960 break;
01961 /* get def_process_create_type of new role */
01962 i_rc_tid.role = i_attr_val1.rc_role;
01963 if ((err=rsbac_rc_get_item(0,
01964 RT_ROLE,
01965 i_rc_tid,
01966 i_rc_tid,
01967 RI_def_process_create_type,
01968 &i_rc_item_val1,
01969 NULL)))
01970 {
01971 rsbac_rc_ds_get_error("rsbac_adf_set_attr_rc()",
01972 RI_def_process_create_type);
01973 return(-RSBAC_EREADFAILED);
01974 }
01975 switch(i_rc_item_val1.type_id)
01976 {
01977 case RC_type_inherit_parent:
01978 case RC_type_inherit_process:
01979 /* keep old type */
01980 break;
01981 case RC_type_use_new_role_def_create:
01982 /* error - complain, but keep type (inherit) */
01983 rsbac_printk(KERN_WARNING
01984 "rsbac_adf_set_attr_rc(): invalid type use_new_role_def_create in def_process_create_type of role %i!\n",
01985 i_attr_val1.rc_role);
01986 break;
01987 case RC_type_no_create:
01988 /* set rc_type for process to general */
01989 i_rc_item_val1.type_id = RSBAC_RC_GENERAL_TYPE;
01990 /* fall through */
01991 default:
01992 /* set rc_type for process */
01993 i_attr_val1.rc_type = i_rc_item_val1.type_id;
01994 if ((err=rsbac_set_attr(RC, T_PROCESS,
01995 i_tid,
01996 A_rc_type,
01997 i_attr_val1)))
01998 {
01999 rsbac_ds_set_error("rsbac_adf_set_attr_rc", A_rc_type);
02000 return(-RSBAC_EWRITEFAILED);
02001 }
02002 }
02003 break;
02004 case RC_type_no_create:
02005 case RC_type_no_chown:
02006 /* set rc_type for process to general */
02007 i_rc_item_val1.type_id = RSBAC_RC_GENERAL_TYPE;
02008 /* fall through */
02009 default:
02010 /* set rc_type for process */
02011 i_attr_val1.rc_type = i_rc_item_val1.type_id;
02012 if ((err=rsbac_set_attr(RC, T_PROCESS,
02013 i_tid,
02014 A_rc_type,
02015 i_attr_val1)))
02016 {
02017 rsbac_ds_set_error("rsbac_adf_set_attr_rc", A_rc_type);
02018 return(-RSBAC_EWRITEFAILED);
02019 }
02020 }
02021
02022 return 0;
02023
02024 /* all other cases */
02025 default:
02026 return 0;
02027 }
02028
02029 case R_CLONE:
02030 if (target == T_PROCESS)
02031 {
02032 /* get rc_role from process */
02033 if ((err=rsbac_get_attr(RC, T_PROCESS,
02034 tid,
02035 A_rc_role,
02036 &i_attr_val1,
02037 FALSE)))
02038 {
02039 rsbac_ds_get_error("rsbac_adf_set_attr_rc", A_rc_role);
02040 return(-RSBAC_EREADFAILED);
02041 }
02042
02043 /* get rc_force_role from process */
02044 if ((err=rsbac_get_attr(RC, T_PROCESS,
02045 tid,
02046 A_rc_force_role,
02047 &i_attr_val2,
02048 FALSE)))
02049 {
02050 rsbac_ds_get_error("rsbac_adf_set_attr_rc", A_rc_force_role);
02051 return(-RSBAC_EREADFAILED);
02052 }
02053
02054 /* set rc_role for new process */
02055 if ((err=rsbac_set_attr(RC, T_PROCESS,
02056 new_tid,
02057 A_rc_role,
02058 i_attr_val1)))
02059 {
02060 rsbac_ds_set_error("rsbac_adf_set_attr_rc", A_rc_role);
02061 return(-RSBAC_EWRITEFAILED);
02062 }
02063
02064 /* set rc_force_role for new process */
02065 if ((err=rsbac_set_attr(RC, T_PROCESS,
02066 new_tid,
02067 A_rc_force_role,
02068 i_attr_val2)))
02069 {
02070 rsbac_ds_set_error("rsbac_adf_set_attr_rc", A_rc_force_role);
02071 return(-RSBAC_EWRITEFAILED);
02072 }
02073 /* YAMVH - Yet Another Michal's Verid Hack
02074 * check for parent process type, if kernel thread
02075 * just inherit it. saves us marking each process
02076 * separately. */
02077 if ((err = rsbac_get_attr(GEN, T_PROCESS,
02078 tid,
02079 A_kernel_thread,
02080 &i_attr_val1,
02081 FALSE))) {
02082 rsbac_ds_get_error("rsbac_adf_set_attr_rc()",
02083 A_rc_type);
02084 return (-RSBAC_EREADFAILED);
02085 }
02086 if (i_attr_val1.kernel_thread) {
02087 i_attr_val1.rc_type = RSBAC_RC_KERNEL_P_TYPE;
02088 if ((err = rsbac_set_attr(RC, T_PROCESS,
02089 new_tid,
02090 A_rc_type,
02091 i_attr_val1))) {
02092 rsbac_ds_set_error("rsbac_adf_set_attr_rc",
02093 A_rc_type);
02094 return (-RSBAC_EWRITEFAILED);
02095 }
02096
02097 }
02098 break;
02099
02100 /* get def_process_create_type of role */
02101 i_rc_tid.role = i_attr_val1.rc_role;
02102 if ((err=rsbac_rc_get_item(0,
02103 RT_ROLE,
02104 i_rc_tid,
02105 i_rc_tid,
02106 RI_def_process_create_type,
02107 &i_rc_item_val1,
02108 NULL)))
02109 {
02110 rsbac_rc_ds_get_error("rsbac_adf_set_attr_rc()",
02111 RI_def_process_create_type);
02112 return(-RSBAC_EREADFAILED);
02113 }
02114 switch(i_rc_item_val1.type_id)
02115 {
02116 case RC_type_inherit_parent:
02117 case RC_type_inherit_process:
02118 /* copy old type */
02119 /* get rc_type from old process */
02120 if ((err=rsbac_get_attr(RC, T_PROCESS,
02121 tid,
02122 A_rc_type,
02123 &i_attr_val1,
02124 FALSE)))
02125 {
02126 rsbac_ds_get_error("rsbac_adf_set_attr_rc", A_rc_type);
02127 return(-RSBAC_EREADFAILED);
02128 }
02129 /* set rc_type for new process */
02130 if ((err=rsbac_set_attr(RC, T_PROCESS,
02131 new_tid,
02132 A_rc_type,
02133 i_attr_val1)))
02134 {
02135 rsbac_ds_set_error("rsbac_adf_set_attr_rc", A_rc_type);
02136 return(-RSBAC_EWRITEFAILED);
02137 }
02138 break;
02139 case RC_type_no_create:
02140 return(-RSBAC_EDECISIONMISMATCH);
02141 case RC_type_use_new_role_def_create:
02142 /* error - complain, but keep type (inherit) */
02143 rsbac_printk(KERN_WARNING
02144 "rsbac_adf_set_attr_rc(): invalid type use_new_role_def_create in def_process_create_type of role %i!\n",
02145 i_attr_val1.rc_role);
02146 return(-RSBAC_EINVALIDVALUE);
02147 default:
02148 /* set rc_type for new process */
02149 i_attr_val1.rc_type = i_rc_item_val1.type_id;
02150 if ((err=rsbac_set_attr(RC, T_PROCESS,
02151 new_tid,
02152 A_rc_type,
02153 i_attr_val1)))
02154 {
02155 rsbac_ds_set_error("rsbac_adf_set_attr_rc", A_rc_type);
02156 return(-RSBAC_EWRITEFAILED);
02157 }
02158 }
02159 return(0);
02160 }
02161 else
02162 return(0);
02163
02164 case R_CREATE:
02165 switch(target)
02166 {
02167 /* Creating dir or (pseudo) file IN target dir! */
02168 case T_DIR:
02169 /* Mode of created item is ignored! */
02170 /* get rc_role from process */
02171 i_tid.process = caller_pid;
02172 if ((err=rsbac_get_attr(RC, T_PROCESS,
02173 i_tid,
02174 A_rc_role,
02175 &i_attr_val1,
02176 FALSE)))
02177 {
02178 rsbac_ds_get_error("rsbac_adf_set_attr_rc", A_rc_role);
02179 return(-RSBAC_EREADFAILED);
02180 }
02181 /* get def_fd_create_type of role */
02182 /* First get target dir's efftype */
02183 if ((err=rsbac_get_attr(RC,
02184 target,
02185 tid,
02186 A_rc_type_fd,
02187 &i_attr_val2,
02188 TRUE)))
02189 {
02190 rsbac_ds_get_error("rsbac_adf_request_rc", A_rc_type_fd);
02191 return(-RSBAC_EREADFAILED);
02192 }
02193 i_rc_tid.role = i_attr_val1.rc_role;
02194 i_rc_subtid.type = i_attr_val2.rc_type;
02195 if ((err=rsbac_rc_get_item(0,
02196 RT_ROLE,
02197 i_rc_tid,
02198 i_rc_subtid,
02199 RI_def_fd_ind_create_type,
02200 &i_rc_item_val1,
02201 NULL)))
02202 { /* No individual create type -> try global */
02203 if ((err=rsbac_rc_get_item(0,
02204 RT_ROLE,
02205 i_rc_tid,
02206 i_rc_subtid,
02207 RI_def_fd_create_type,
02208 &i_rc_item_val1,
02209 NULL)))
02210 {
02211 rsbac_rc_ds_get_error("rsbac_adf_set_attr_rc()",
02212 RI_def_fd_create_type);
02213 return(-RSBAC_EREADFAILED);
02214 }
02215 }
02216 switch(i_rc_item_val1.type_id)
02217 {
02218 case RC_type_no_create:
02219 return(-RSBAC_EDECISIONMISMATCH);
02220 break;
02221
02222 case RC_type_use_new_role_def_create:
02223 case RC_type_inherit_process:
02224 /* error - complain and return error */
02225 rsbac_printk(KERN_WARNING
02226 "rsbac_adf_set_attr_rc(): invalid type use_new_role_def_create in def_fd_create_type of role %i!\n",
02227 i_attr_val1.rc_role);
02228 return(-RSBAC_EINVALIDVALUE);
02229
02230 case RC_type_inherit_parent:
02231 default:
02232 /* get type from new target */
02233 if ((err=rsbac_get_attr(RC, new_target,
02234 new_tid,
02235 A_rc_type_fd,
02236 &i_attr_val1,
02237 FALSE)))
02238 {
02239 rsbac_ds_get_error("rsbac_adf_set_attr_rc", A_rc_type_fd);
02240 return(-RSBAC_EREADFAILED);
02241 }
02242 /* set it for new target, if different */
02243 if(i_attr_val1.rc_type_fd != i_rc_item_val1.type_id)
02244 {
02245 i_attr_val1.rc_type_fd = i_rc_item_val1.type_id;
02246 if ((err=rsbac_set_attr(RC, new_target,
02247 new_tid,
02248 A_rc_type_fd,
02249 i_attr_val1)))
02250 {
02251 rsbac_ds_set_error("rsbac_adf_set_attr_rc", A_rc_type_fd);
02252 return(-RSBAC_EWRITEFAILED);
02253 }
02254 }
02255 }
02256 return(0);
02257
02258 case T_IPC:
02259 /* get rc_role from process */
02260 i_tid.process = caller_pid;
02261 if ((err=rsbac_get_attr(RC, T_PROCESS,
02262 i_tid,
02263 A_rc_role,
02264 &i_attr_val1,
02265 FALSE)))
02266 {
02267 rsbac_ds_get_error("rsbac_adf_set_attr_rc", A_rc_role);
02268 return(-RSBAC_EREADFAILED);
02269 }
02270 /* get def_ipc_create_type of role */
02271 i_rc_tid.role = i_attr_val1.rc_role;
02272 if ((err=rsbac_rc_get_item(0,
02273 RT_ROLE,
02274 i_rc_tid,
02275 i_rc_tid,
02276 RI_def_ipc_create_type,
02277 &i_rc_item_val1,
02278 NULL)))
02279 {
02280 rsbac_rc_ds_get_error("rsbac_adf_set_attr_rc()",
02281 RI_def_ipc_create_type);
02282 return(-RSBAC_EREADFAILED);
02283 }
02284 switch(i_rc_item_val1.type_id)
02285 {
02286 case RC_type_no_create:
02287 return(-RSBAC_EDECISIONMISMATCH);
02288 break;
02289
02290 case RC_type_use_new_role_def_create:
02291 /* error - complain and return error */
02292 rsbac_printk(KERN_WARNING
02293 "rsbac_adf_set_attr_rc(): invalid type use_new_role_def_create in def_ipc_create_type of role %i!\n",
02294 i_attr_val1.rc_role);
02295 return(-RSBAC_EINVALIDVALUE);
02296
02297 case RC_type_inherit_parent:
02298 case RC_type_inherit_process:
02299 /* error - complain and return error */
02300 rsbac_printk(KERN_WARNING
02301 "rsbac_adf_set_attr_rc(): invalid type inherit_parent in def_ipc_create_type of role %i!\n",
02302 i_attr_val1.rc_role);
02303 return -RSBAC_EINVALIDVALUE;
02304
02305 default:
02306 /* set rc_type for ipc target */
02307 i_attr_val1.rc_type = i_rc_item_val1.type_id;
02308 /* get type from target */
02309 if ((err=rsbac_get_attr(RC,
02310 target,
02311 tid,
02312 A_rc_type,
02313 &i_attr_val2,
02314 FALSE)))
02315 {
02316 rsbac_ds_get_error("rsbac_adf_set_attr_rc", A_rc_type);
02317 return(-RSBAC_EREADFAILED);
02318 }
02319 /* set it for new target, if different */
02320 if(i_attr_val1.rc_type != i_attr_val2.rc_type)
02321 {
02322 if ((err=rsbac_set_attr(RC, target,
02323 tid,
02324 A_rc_type,
02325 i_attr_val1)))
02326 {
02327 rsbac_ds_set_error("rsbac_adf_set_attr_rc", A_rc_type);
02328 return(-RSBAC_EWRITEFAILED);
02329 }
02330 }
02331 }
02332 return 0;
02333
02334 case T_USER:
02335 /* get rc_role from process */
02336 i_tid.process = caller_pid;
02337 if ((err=rsbac_get_attr(RC, T_PROCESS,
02338 i_tid,
02339 A_rc_role,
02340 &i_attr_val1,
02341 FALSE)))
02342 {
02343 rsbac_ds_get_error("rsbac_adf_set_attr_rc", A_rc_role);
02344 return -RSBAC_EREADFAILED;
02345 }
02346 /* get def_user_create_type of role */
02347 i_rc_tid.role = i_attr_val1.rc_role;
02348 if ((err=rsbac_rc_get_item(0,
02349 RT_ROLE,
02350 i_rc_tid,
02351 i_rc_tid,
02352 RI_def_user_create_type,
02353 &i_rc_item_val1,
02354 NULL)))
02355 {
02356 rsbac_rc_ds_get_error("rsbac_adf_set_attr_rc()",
02357 RI_def_user_create_type);
02358 return -RSBAC_EREADFAILED;
02359 }
02360 switch(i_rc_item_val1.type_id)
02361 {
02362 case RC_type_no_create:
02363 #ifdef CONFIG_RSBAC_DEBUG
02364 if(rsbac_debug_adf_rc)
02365 rsbac_printk(KERN_DEBUG "rsbac_adf_set_attr_rc(): pid %u (%.15s), owner %u, rc_role %u, def_user_create_type no_create, request CREATE -> NOT_GRANTED!\n",
02366 caller_pid, current->comm, current->uid, i_attr_val1.rc_role);
02367 #endif
02368 return -RSBAC_EDECISIONMISMATCH;
02369
02370 case RC_type_use_new_role_def_create:
02371 /* error - complain and return error */
02372 rsbac_printk(KERN_WARNING
02373 "rsbac_adf_set_attr_rc(): invalid type use_new_role_def_create in def_user_create_type of role %i!\n",
02374 i_attr_val1.rc_role);
02375 return -RSBAC_EINVALIDVALUE;
02376
02377 case RC_type_inherit_parent:
02378 case RC_type_inherit_process:
02379 /* error - complain and return error */
02380 rsbac_printk(KERN_WARNING
02381 "rsbac_adf_set_attr_rc(): invalid type inherit_parent in def_user_create_type of role %i!\n",
02382 i_attr_val1.rc_role);
02383 return -RSBAC_EINVALIDVALUE;
02384
02385 default:
02386 /* set rc_type for user target */
02387 i_attr_val1.rc_type = i_rc_item_val1.type_id;
02388 /* get type from target */
02389 if ((err=rsbac_get_attr(RC,
02390 target,
02391 tid,
02392 A_rc_type,
02393 &i_attr_val2,
02394 FALSE)))
02395 {
02396 rsbac_ds_get_error("rsbac_adf_set_attr_rc", A_rc_type);
02397 return(-RSBAC_EREADFAILED);
02398 }
02399 /* set it for new target, if different */
02400 if(i_attr_val1.rc_type != i_attr_val2.rc_type)
02401 {
02402 if ((err=rsbac_set_attr(RC, target,
02403 tid,
02404 A_rc_type,
02405 i_attr_val1)))
02406 {
02407 rsbac_ds_set_error("rsbac_adf_set_attr_rc", A_rc_type);
02408 return(-RSBAC_EWRITEFAILED);
02409 }
02410 }
02411 }
02412 return 0;
02413
02414 case T_GROUP:
02415 /* get rc_role from process */
02416 i_tid.process = caller_pid;
02417 if ((err=rsbac_get_attr(RC, T_PROCESS,
02418 i_tid,
02419 A_rc_role,
02420 &i_attr_val1,
02421 FALSE)))
02422 {
02423 rsbac_ds_get_error("rsbac_adf_set_attr_rc", A_rc_role);
02424 return -RSBAC_EREADFAILED;
02425 }
02426 /* get def_group_create_type of role */
02427 i_rc_tid.role = i_attr_val1.rc_role;
02428 if ((err=rsbac_rc_get_item(0,
02429 RT_ROLE,
02430 i_rc_tid,
02431 i_rc_tid,
02432 RI_def_group_create_type,
02433 &i_rc_item_val1,
02434 NULL)))
02435 {
02436 rsbac_rc_ds_get_error("rsbac_adf_set_attr_rc()",
02437 RI_def_group_create_type);
02438 return -RSBAC_EREADFAILED;
02439 }
02440 switch(i_rc_item_val1.type_id)
02441 {
02442 case RC_type_no_create:
02443 #ifdef CONFIG_RSBAC_DEBUG
02444 if(rsbac_debug_adf_rc)
02445 rsbac_printk(KERN_DEBUG "rsbac_adf_set_attr_rc(): pid %u (%.15s), owner %u, rc_role %u, def_group_create_type no_create, request CREATE -> NOT_GRANTED!\n",
02446 caller_pid, current->comm, current->uid, i_attr_val1.rc_role);
02447 #endif
02448 return -RSBAC_EDECISIONMISMATCH;
02449
02450 case RC_type_use_new_role_def_create:
02451 /* error - complain and return error */
02452 rsbac_printk(KERN_WARNING
02453 "rsbac_adf_set_attr_rc(): invalid type use_new_role_def_create in def_group_create_type of role %i!\n",
02454 i_attr_val1.rc_role);
02455 return -RSBAC_EINVALIDVALUE;
02456
02457 case RC_type_inherit_parent:
02458 case RC_type_inherit_process:
02459 /* error - complain and return error */
02460 rsbac_printk(KERN_WARNING
02461 "rsbac_adf_set_attr_rc(): invalid type inherit_parent in def_group_create_type of role %i!\n",
02462 i_attr_val1.rc_role);
02463 return -RSBAC_EINVALIDVALUE;
02464
02465 default:
02466 /* set rc_type for user target */
02467 i_attr_val1.rc_type = i_rc_item_val1.type_id;
02468 /* get type from target */
02469 if ((err=rsbac_get_attr(RC,
02470 target,
02471 tid,
02472 A_rc_type,
02473 &i_attr_val2,
02474 FALSE)))
02475 {
02476 rsbac_ds_get_error("rsbac_adf_set_attr_rc", A_rc_type);
02477 return(-RSBAC_EREADFAILED);
02478 }
02479 /* set it for new target, if different */
02480 if(i_attr_val1.rc_type != i_attr_val2.rc_type)
02481 {
02482 if ((err=rsbac_set_attr(RC, target,
02483 tid,
02484 A_rc_type,
02485 i_attr_val1)))
02486 {
02487 rsbac_ds_set_error("rsbac_adf_set_attr_rc", A_rc_type);
02488 return(-RSBAC_EWRITEFAILED);
02489 }
02490 }
02491 }
02492 return 0;
02493
02494 /* all other cases are unknown */
02495 default:
02496 return 0;
02497 }
02498
02499 case R_EXECUTE:
02500 switch(target)
02501 {
02502 case T_FILE:
02503 /* get rc_force_role from target file */
02504 if ((err=rsbac_get_attr(RC, T_FILE,
02505 tid,
02506 A_rc_force_role,
02507 &i_attr_val1,
02508 TRUE)))
02509 {
02510 rsbac_ds_get_error("rsbac_adf_set_attr_rc", A_rc_force_role);
02511 return(-RSBAC_EREADFAILED);
02512 }
02513 /* check rc_force_role, warn, if unusable */
02514 if( (i_attr_val1.rc_force_role > RC_role_max_value)
02515 && (i_attr_val1.rc_force_role < RC_role_min_special)
02516 )
02517 {
02518 rsbac_printk(KERN_WARNING
02519 "rsbac_adf_set_attr_rc(): rc_force_role %u of file %u on device %02u:%02u is higher than MAX_ROLE %u, setting forced role of process %u to default value %u!\n",
02520 i_attr_val1.rc_force_role, tid.file.inode,
02521 MAJOR(tid.file.device), MINOR(tid.file.device),
02522 RC_role_max_value, caller_pid, RC_default_root_dir_force_role);
02523 i_attr_val1.rc_force_role = RC_default_root_dir_force_role;
02524 }
02525 /* set rc_force_role for this process to keep track of it later */
02526 i_tid.process = caller_pid;
02527 if ((err=rsbac_set_attr(RC, T_PROCESS,
02528 i_tid,
02529 A_rc_force_role,
02530 i_attr_val1)))
02531 {
02532 rsbac_ds_set_error("rsbac_adf_set_attr_rc", A_rc_force_role);
02533 return(-RSBAC_EWRITEFAILED);
02534 }
02535 /* get rc_initial_role from target file */
02536 if ((err=rsbac_get_attr(RC, T_FILE,
02537 tid,
02538 A_rc_initial_role,
02539 &i_attr_val2,
02540 TRUE)))
02541 {
02542 rsbac_ds_get_error("rsbac_adf_set_attr_rc", A_rc_initial_role);
02543 return(-RSBAC_EREADFAILED);
02544 }
02545 /* check rc_initial_role, warn, if unusable */
02546 if( (i_attr_val2.rc_initial_role > RC_role_max_value)
02547 && (i_attr_val2.rc_initial_role != RC_role_use_force_role)
02548 )
02549 {
02550 rsbac_printk(KERN_WARNING
02551 "rsbac_adf_set_attr_rc(): rc_initial_role %u of file %u on device %02u:%02u is higher than MAX_ROLE %u, setting initial role of process %u to default value %u!\n",
02552 i_attr_val2.rc_initial_role, tid.file.inode,
02553 MAJOR(tid.file.device), MINOR(tid.file.device),
02554 RC_role_max_value, caller_pid, RC_default_root_dir_initial_role);
02555 i_attr_val2.rc_initial_role = RC_default_root_dir_initial_role;
02556 }
02557 if(i_attr_val2.rc_initial_role == RC_role_use_force_role)
02558 {
02559 switch(i_attr_val1.rc_force_role)
02560 {
02561 case RC_role_inherit_user:
02562 /* get rc_def_role from process owner */
02563 i_tid.user = owner;
02564 if ((err=rsbac_get_attr(RC, T_USER,
02565 i_tid,
02566 A_rc_def_role,
02567 &i_attr_val1,
02568 TRUE)))
02569 {
02570 rsbac_ds_get_error("rsbac_adf_set_attr_rc", A_rc_def_role);
02571 return(-RSBAC_EREADFAILED);
02572 }
02573 /* set it for this process */
02574 i_tid.process = caller_pid;
02575 if ((err=rsbac_set_attr(RC, T_PROCESS,
02576 i_tid,
02577 A_rc_role,
02578 i_attr_val1)))
02579 {
02580 rsbac_ds_set_error("rsbac_adf_set_attr_rc", A_rc_role);
02581 return(-RSBAC_EWRITEFAILED);
02582 }
02583 break;
02584
02585 case RC_role_inherit_parent:
02586 case RC_role_inherit_process:
02587 case RC_role_inherit_up_mixed:
02588 /* keep current role */
02589 break;
02590
02591 default:
02592 /* set forced role for this process */
02593 i_tid.process = caller_pid;
02594 if ((err=rsbac_set_attr(RC, T_PROCESS,
02595 i_tid,
02596 A_rc_role,
02597 i_attr_val1)))
02598 {
02599 rsbac_ds_set_error("rsbac_adf_set_attr_rc", A_rc_role);
02600 return(-RSBAC_EWRITEFAILED);
02601 }
02602 }
02603 }
02604 else /* use initial_role */
02605 {
02606 /* set initial role for this process */
02607 i_tid.process = caller_pid;
02608 if ((err=rsbac_set_attr(RC, T_PROCESS,
02609 i_tid,
02610 A_rc_role,
02611 i_attr_val2)))
02612 {
02613 rsbac_ds_set_error("rsbac_adf_set_attr_rc", A_rc_role);
02614 return(-RSBAC_EWRITEFAILED);
02615 }
02616 }
02617 /* Get role of process. */
02618 i_tid.process = caller_pid;
02619 if ((err=rsbac_get_attr(RC, T_PROCESS,
02620 i_tid,
02621 A_rc_role,
02622 &i_attr_val1,
02623 FALSE)))
02624 {
02625 rsbac_ds_get_error("rsbac_adf_set_attr_rc", A_rc_role);
02626 return(-RSBAC_EREADFAILED);
02627 }
02628 /* get def_process_execute_type of role */
02629 i_rc_tid.role = i_attr_val1.rc_role;
02630 if ((err=rsbac_rc_get_item(0,
02631 RT_ROLE,
02632 i_rc_tid,
02633 i_rc_tid,
02634 RI_def_process_execute_type,
02635 &i_rc_item_val1,
02636 NULL)))
02637 {
02638 rsbac_rc_ds_get_error("rsbac_adf_set_attr_rc()",
02639 RI_def_process_execute_type);
02640 return(-RSBAC_EREADFAILED);
02641 }
02642 switch(i_rc_item_val1.type_id)
02643 {
02644 case RC_type_no_create:
02645 case RC_type_use_new_role_def_create:
02646 /* Cannot reset, because of unusable default -> warn and keep */
02647 rsbac_printk(KERN_WARNING
02648 "rsbac_adf_set_attr_rc(): invalid type in def_process_execute_type of role %i!\n",
02649 i_attr_val1.rc_role);
02650 return(-RSBAC_EINVALIDVALUE);
02651 case RC_type_inherit_parent:
02652 case RC_type_inherit_process:
02653 break;
02654 case RC_type_no_execute:
02655 return(-RSBAC_EDECISIONMISMATCH);
02656 default:
02657 /* set rc_type for process */
02658 i_attr_val1.rc_type = i_rc_item_val1.type_id;
02659 if ((err=rsbac_set_attr(RC, T_PROCESS,
02660 i_tid,
02661 A_rc_type,
02662 i_attr_val1)))
02663 {
02664 rsbac_ds_set_error("rsbac_adf_set_attr_rc", A_rc_type);
02665 return(-RSBAC_EWRITEFAILED);
02666 }
02667 }
02668 /* type and role are set - ready. */
02669 return 0;
02670
02671 /* all other cases are unknown */
02672 default:
02673 return 0;
02674 }
02675
02676
02677 /*********************/
02678 default: return 0;
02679 }
02680
02681 return 0;
02682 } /* end of rsbac_adf_set_attr_rc() */
|
|
||||||||||||||||||||
|
Definition at line 313 of file rc_main.c. References A_rc_role, FALSE, get_rc_special_right_name(), GRANTED, NOT_GRANTED, rsbac_target_id_t::process, RC, rsbac_attribute_value_t::rc_role, RC_type_max_value, RCR_ASSIGN, RI_type_comp_dev, RI_type_comp_fd, RI_type_comp_group, RI_type_comp_ipc, RI_type_comp_netdev, RI_type_comp_netobj, RI_type_comp_nettemp, RI_type_comp_process, RI_type_comp_user, rsbac_get_attr, rsbac_kfree(), rsbac_kmalloc(), RSBAC_MAXNAMELEN, rsbac_printk(), rsbac_rc_check_comp(), T_DEV, T_DIR, T_FD, T_FIFO, T_FILE, T_GROUP, T_IPC, T_NETDEV, T_NETOBJ, T_NETTEMP, T_PROCESS, T_SYMLINK, T_USER, and rsbac_rc_target_id_t::type. Referenced by rsbac_adf_request_rc(), rsbac_rc_sys_copy_type(), rsbac_rc_sys_get_item(), and rsbac_rc_sys_set_item(). 00317 {
00318 int err;
00319 union rsbac_target_id_t i_tid;
00320 union rsbac_attribute_value_t i_attr_val1;
00321
00322 union rsbac_rc_target_id_t i_rc_subtid;
00323 enum rsbac_rc_item_t i_rc_item;
00324
00325 if(!caller_pid)
00326 caller_pid = current->pid;
00327 /*
00328 * we don't care about tried assignments of special type values,
00329 * but deny other accesses to those
00330 */
00331 if(type > RC_type_max_value)
00332 {
00333 if(request == RCR_ASSIGN)
00334 return GRANTED;
00335 else
00336 return NOT_GRANTED;
00337 }
00338
00339 /* get rc_role from process */
00340 i_tid.process = caller_pid;
00341 if ((err=rsbac_get_attr(RC,
00342 T_PROCESS,
00343 i_tid,
00344 A_rc_role,
00345 &i_attr_val1,
00346 FALSE)))
00347 {
00348 rsbac_ds_get_error("rsbac_rc_check_type_comp", A_rc_role);
00349 return(NOT_GRANTED);
00350 }
00351 switch(target)
00352 {
00353 case T_FILE:
00354 case T_DIR:
00355 case T_FIFO:
00356 case T_SYMLINK:
00357 case T_FD:
00358 i_rc_item = RI_type_comp_fd;
00359 break;
00360 case T_DEV:
00361 i_rc_item = RI_type_comp_dev;
00362 break;
00363 case T_USER:
00364 i_rc_item = RI_type_comp_user;
00365 break;
00366 case T_PROCESS:
00367 i_rc_item = RI_type_comp_process;
00368 break;
00369 case T_IPC:
00370 i_rc_item = RI_type_comp_ipc;
00371 break;
00372 #if defined(CONFIG_RSBAC_RC_UM_PROT)
00373 case T_GROUP:
00374 i_rc_item = RI_type_comp_group;
00375 break;
00376 #endif
00377 #if defined(CONFIG_RSBAC_RC_NET_DEV_PROT)
00378 case T_NETDEV:
00379 i_rc_item = RI_type_comp_netdev;
00380 break;
00381 #endif
00382 #if defined(CONFIG_RSBAC_RC_NET_OBJ_PROT)
00383 case T_NETTEMP:
00384 i_rc_item = RI_type_comp_nettemp;
00385 break;
00386 case T_NETOBJ:
00387 i_rc_item = RI_type_comp_netobj;
00388 break;
00389 #endif
00390
00391 default:
00392 rsbac_printk(KERN_WARNING "rsbac_rc_check_type_comp(): invalid target %i!\n",target);
00393 return(NOT_GRANTED);
00394 }
00395 /* check type_comp_xxx of role */
00396 i_rc_subtid.type = type;
00397 if(rsbac_rc_check_comp(i_attr_val1.rc_role,
00398 i_rc_subtid,
00399 i_rc_item,
00400 request))
00401 return(GRANTED);
00402 else
00403 {
00404 #ifdef CONFIG_RSBAC_DEBUG
00405 if(rsbac_debug_adf_rc)
00406 {
00407 char * tmp = rsbac_kmalloc(RSBAC_MAXNAMELEN);
00408
00409 if(tmp)
00410 {
00411 rsbac_printk(KERN_DEBUG "rsbac_rc_check_type_comp(): rc_role is %i, rc_type is %i, request is %s -> NOT_GRANTED!\n",
00412 i_attr_val1.rc_role, type, get_rc_special_right_name(tmp, request));
00413 rsbac_kfree(tmp);
00414 }
00415 }
00416 #endif
00417 return(NOT_GRANTED);
00418 }
00419 }
|
|
||||||||||||
|
Definition at line 211 of file rc_main.c. References A_rc_role, rsbac_target_id_t::process, R_NONE, RC, rsbac_attribute_value_t::rc_role, RC_role_max_value, RI_admin_roles, RI_assign_roles, rsbac_rc_target_id_t::role, RSBAC_EINVALIDVALUE, RSBAC_EREADFAILED, rsbac_get_attr, rsbac_rc_check_comp(), T_PROCESS, and TRUE. Referenced by rsbac_rc_sys_copy_role(), rsbac_rc_sys_get_item(), and rsbac_rc_sys_set_item(). 00212 {
00213 int err;
00214 union rsbac_target_id_t i_tid;
00215 union rsbac_attribute_value_t i_attr_val1;
00216 union rsbac_rc_target_id_t i_rc_subtid;
00217
00218 if(t_role > RC_role_max_value)
00219 return -RSBAC_EINVALIDVALUE;
00220 /* get rc_role of process */
00221 i_tid.process = current->pid;
00222 if ((err=rsbac_get_attr(RC, T_PROCESS,
00223 i_tid,
00224 A_rc_role,
00225 &i_attr_val1,
00226 TRUE)))
00227 {
00228 rsbac_ds_get_error("rsbac_rc_test_admin_roles", A_rc_role);
00229 return -RSBAC_EREADFAILED;
00230 }
00231
00232 i_rc_subtid.role = t_role;
00233 /* read_only? -> assign_roles membership is enough */
00234 if(!modify)
00235 {
00236 if(rsbac_rc_check_comp(i_attr_val1.rc_role,
00237 i_rc_subtid,
00238 RI_assign_roles,
00239 R_NONE))
00240 return 0;
00241 /* fall through */
00242 }
00243 /* check admin_roles of role */
00244 if(rsbac_rc_check_comp(i_attr_val1.rc_role,
00245 i_rc_subtid,
00246 RI_admin_roles,
00247 R_NONE))
00248 return 0;
00249 else
00250 return -EPERM;
00251 }
|
|
||||||||||||||||||||
|
Definition at line 254 of file rc_main.c. References A_rc_role, rsbac_target_id_t::process, R_NONE, RC, rsbac_attribute_value_t::rc_role, RC_role_inherit_user, RC_role_max_value, RI_assign_roles, rsbac_rc_target_id_t::role, RSBAC_EINVALIDVALUE, RSBAC_EREADFAILED, rsbac_get_attr, rsbac_rc_check_comp(), T_NONE, T_PROCESS, and TRUE. Referenced by rsbac_adf_request_rc(). 00258 {
00259 int err;
00260 union rsbac_target_id_t i_tid;
00261 union rsbac_attribute_value_t i_attr_val1;
00262 union rsbac_attribute_value_t i_attr_val2;
00263 union rsbac_rc_target_id_t i_rc_subtid;
00264
00265 if( ( (t_role > RC_role_max_value)
00266 && (t_role != RC_role_inherit_user)
00267 )
00268 || (target >= T_NONE)
00269 )
00270 return -RSBAC_EINVALIDVALUE;
00271 /* get rc_role of process */
00272 i_tid.process = current->pid;
00273 if ((err=rsbac_get_attr(RC, T_PROCESS,
00274 i_tid,
00275 A_rc_role,
00276 &i_attr_val1,
00277 TRUE)))
00278 {
00279 rsbac_ds_get_error("rsbac_rc_test_assign_roles", A_rc_role);
00280 return -RSBAC_EREADFAILED;
00281 }
00282 /* get old role of target */
00283 if ((err=rsbac_get_attr(RC,
00284 target,
00285 tid,
00286 attr,
00287 &i_attr_val2,
00288 TRUE)))
00289 {
00290 rsbac_ds_get_error("rsbac_rc_test_assign_roles", attr);
00291 return -RSBAC_EREADFAILED;
00292 }
00293
00294 i_rc_subtid.role = i_attr_val2.rc_role;
00295 if(!rsbac_rc_check_comp(i_attr_val1.rc_role,
00296 i_rc_subtid,
00297 RI_assign_roles,
00298 R_NONE))
00299 return -EPERM;
00300 if(t_role != RC_role_inherit_user)
00301 {
00302 i_rc_subtid.role = t_role;
00303 if(!rsbac_rc_check_comp(i_attr_val1.rc_role,
00304 i_rc_subtid,
00305 RI_assign_roles,
00306 R_NONE))
00307 return -EPERM;
00308 }
00309 return 0;
00310 }
|
|
|
Definition at line 422 of file rc_main.c. References A_rc_role, rsbac_rc_item_value_t::admin_type, NULL, rsbac_target_id_t::process, RC, rsbac_attribute_value_t::rc_role, RC_role_admin, RC_system_admin, RI_admin_type, rsbac_rc_target_id_t::role, RSBAC_EREADFAILED, rsbac_get_attr, rsbac_rc_get_item(), RT_ROLE, T_PROCESS, and TRUE. Referenced by rsbac_adf_request_rc(), rsbac_rc_sys_copy_role(), rsbac_rc_sys_copy_type(), rsbac_rc_sys_get_item(), and rsbac_rc_sys_set_item(). 00423 {
00424 int err;
00425 union rsbac_target_id_t i_tid;
00426 union rsbac_attribute_value_t i_attr_val1;
00427 union rsbac_rc_target_id_t i_rc_tid;
00428 union rsbac_rc_item_value_t i_rc_item_val1;
00429
00430 /* get rc_role of process */
00431 i_tid.process = current->pid;
00432 if ((err=rsbac_get_attr(RC, T_PROCESS,
00433 i_tid,
00434 A_rc_role,
00435 &i_attr_val1,
00436 TRUE)))
00437 {
00438 rsbac_ds_get_error("rsbac_rc_test_role_admin", A_rc_role);
00439 return -RSBAC_EREADFAILED;
00440 }
00441
00442 /* get admin_type of role */
00443 i_rc_tid.role = i_attr_val1.rc_role;
00444 if ((err=rsbac_rc_get_item(0,
00445 RT_ROLE,
00446 i_rc_tid,
00447 i_rc_tid, /* dummy */
00448 RI_admin_type,
00449 &i_rc_item_val1,
00450 NULL)))
00451 {
00452 rsbac_rc_ds_get_error("rsbac_rc_test_role_admin", RI_admin_type);
00453 return -RSBAC_EREADFAILED;
00454 }
00455
00456 /* allow, if RC_role_admin or (read_only and RC_system_admin) */
00457 if ( (i_rc_item_val1.admin_type == RC_role_admin)
00458 || ( !modify
00459 && (i_rc_item_val1.admin_type == RC_system_admin)
00460 )
00461 )
00462 return 0;
00463 else
00464 return -EPERM;
00465 }
|
1.4.2