aci.h File Reference

#include <rsbac/types.h>
#include <linux/init.h>

Go to the source code of this file.

Defines
#define	rsbac_get_attr(module, target, tid, attr, value, inherit)   rsbac_ta_get_attr(0, module, target, tid, attr, value, inherit)
#define	rsbac_set_attr(module, target, tid, attr, value)   rsbac_ta_set_attr(0, module, target, tid, attr, value)
#define	rsbac_remove_target(target, tid)   rsbac_ta_remove_target(0, target, tid)
Functions
int	rsbac_init (kdev_t root_dev) __init
int	rsbac_kthread_notify (rsbac_pid_t pid)
void	rsbac_off (void)
rsbac_boolean_t	rsbac_is_initialized (void)
int	rsbac_mount (struct super_block *sb_p, struct dentry *d_covers)
int	rsbac_umount (struct super_block *sb_p, struct dentry *d_covers)
int	rsbac_free_dat_dentries (void)
int	rsbac_stats (void)
int	rsbac_check (int correct, int check_inode)
int	rsbac_get_parent (enum rsbac_target_t target, union rsbac_target_id_t tid, enum rsbac_target_t *parent_target_p, union rsbac_target_id_t *parent_tid_p)
int	rsbac_ta_get_attr (rsbac_list_ta_number_t ta_number, enum rsbac_switch_target_t module, enum rsbac_target_t target, union rsbac_target_id_t tid, enum rsbac_attribute_t attr, union rsbac_attribute_value_t *value, rsbac_boolean_t inherit)
int	rsbac_ta_set_attr (rsbac_list_ta_number_t ta_number, enum rsbac_switch_target_t module, enum rsbac_target_t target, union rsbac_target_id_t tid, enum rsbac_attribute_t attr, union rsbac_attribute_value_t value)
int	rsbac_ta_remove_target (rsbac_list_ta_number_t ta_number, enum rsbac_target_t target, union rsbac_target_id_t tid)
int	rsbac_ta_list_all_dev (rsbac_list_ta_number_t ta_number, struct rsbac_dev_desc_t **id_pp)
int	rsbac_ta_list_all_user (rsbac_list_ta_number_t ta_number, rsbac_uid_t **id_pp)
int	rsbac_ta_list_all_group (rsbac_list_ta_number_t ta_number, rsbac_gid_t **id_pp)
int	rsbac_mark_kthread (rsbac_pid_t pid)
int	rsbac_kthreads_init (void)

---

Define Documentation

#define rsbac_get_attr (  module, target, tid, attr, value, inherit   )     rsbac_ta_get_attr(0, module, target, tid, attr, value, inherit)

Definition at line 90 of file aci.h. Referenced by adjust_in_out_pp(), auto_read_attr(), auto_read_write_attr(), auto_write_attr(), check_comp_rc(), check_comp_rc_scd(), check_flags_ff(), get_ipc_purpose(), jail_check_sysrole(), jail_get_flags_process(), jail_get_id(), jail_get_id_process(), jail_get_scd_get_process(), jail_get_scd_modify_process(), mac_check_role(), mac_sys_check_role(), na_and_pp_ipc(), na_and_pp_or_cs(), na_dev(), na_ipc(), rsbac_acl_check_right(), rsbac_acl_check_super(), rsbac_acl_sys_get_rights(), rsbac_adf_request_auth(), rsbac_adf_request_cap(), rsbac_adf_request_daz(), rsbac_adf_request_ff(), rsbac_adf_request_int(), rsbac_adf_request_mac(), rsbac_adf_request_pax(), rsbac_adf_request_pm(), rsbac_adf_request_rc(), rsbac_adf_request_res(), rsbac_adf_set_attr(), rsbac_adf_set_attr_auth(), rsbac_adf_set_attr_cap(), rsbac_adf_set_attr_daz(), rsbac_adf_set_attr_jail(), rsbac_adf_set_attr_mac(), rsbac_adf_set_attr_pm(), rsbac_adf_set_attr_rc(), rsbac_adf_set_attr_res(), rsbac_auth_add_p_cap(), rsbac_auth_p_capset_member(), rsbac_auth_remove_p_cap(), rsbac_get_full_path(), rsbac_init(), rsbac_jail_sys_jail(), rsbac_mac_get_curr_level(), rsbac_mac_get_max_level(), rsbac_mac_get_min_level(), rsbac_mac_set_curr_level(), rsbac_pm_change_current_task(), rsbac_pm_create_file(), rsbac_rc_check_type_comp(), rsbac_rc_sys_change_role(), rsbac_rc_sys_get_current_role(), rsbac_rc_sys_get_eff_rights(), rsbac_rc_sys_set_item(), rsbac_rc_test_admin_roles(), rsbac_rc_test_assign_roles(), rsbac_rc_test_role_admin(), rsbac_set_audit_uid(), sys_rsbac_daz_flush_cache(), and tp_check().

#define rsbac_remove_target (  target, tid   )     rsbac_ta_remove_target(0, target, tid)

Definition at line 112 of file aci.h. Referenced by rsbac_adf_request_int(), rsbac_adf_set_attr(), and rsbac_aef_shm_free_security().

#define rsbac_set_attr (  module, target, tid, attr, value   )     rsbac_ta_set_attr(0, module, target, tid, attr, value)

Definition at line 101 of file aci.h. Referenced by auto_read_attr(), auto_read_write_attr(), auto_write_attr(), rsbac_adf_request_daz(), rsbac_adf_request_mac(), rsbac_adf_set_attr(), rsbac_adf_set_attr_auth(), rsbac_adf_set_attr_cap(), rsbac_adf_set_attr_daz(), rsbac_adf_set_attr_jail(), rsbac_adf_set_attr_mac(), rsbac_adf_set_attr_pm(), rsbac_adf_set_attr_rc(), rsbac_jail_sys_jail(), rsbac_mac_set_curr_level(), rsbac_pm_change_current_task(), rsbac_pm_create_file(), rsbac_rc_sys_change_role(), rsbac_set_audit_uid(), sys_rsbac_um_auth_name(), and sys_rsbac_um_auth_uid().

---

Function Documentation

int rsbac_check (  int  correct, int  check_inode )

Referenced by rsbac_do_init(), and sys_rsbac_check().

int rsbac_free_dat_dentries (  void   )

Definition at line 8686 of file aci_data_structures.c. References device_list_head, NULL, RSBAC_ENOTINITIALIZED, rsbac_initialized, and rsbac_printk(). { u_long flags; struct rsbac_device_list_item_t * device_p; if (!rsbac_initialized) { rsbac_printk(KERN_WARNING "rsbac_free_dat_dentry(): RSBAC not initialized\n"); return(-RSBAC_ENOTINITIALIZED); } rsbac_printk(KERN_INFO "rsbac_free_dat_dentry(): freeing dat dir dentries\n"); /* wait for write access to device_list_head */ rsbac_write_lock_irq(&device_list_head.lock, &flags); /* OK, nobody else is working on it... */ device_p = device_list_head.head; while(device_p) { if(device_p->rsbac_dir_dentry_p) { dput(device_p->rsbac_dir_dentry_p); device_p->rsbac_dir_dentry_p = NULL; } device_p = device_p->next; } /* allow access */ rsbac_write_unlock_irq(&device_list_head.lock, &flags); return(0); }

int rsbac_get_parent (  enum rsbac_target_t  target, union rsbac_target_id_t  tid, enum rsbac_target_t *  parent_target_p, union rsbac_target_id_t *  parent_tid_p )

Definition at line 9908 of file aci_data_structures.c. References device_list_head, lookup_device(), RSBAC_EINVALIDPOINTER, RSBAC_EINVALIDTARGET, RSBAC_ENOTFOUND, rsbac_printk(), T_DIR, T_FIFO, T_FILE, and T_SYMLINK. Referenced by copy_fp_cap_set_item(), copy_fp_tru_set_item(), get_attr_fd(), rsbac_acl_get_rights(), and rsbac_acl_get_single_right(). { if(!parent_target_p || !parent_tid_p) return -RSBAC_EINVALIDPOINTER; /* #ifdef CONFIG_RSBAC_DEBUG if (rsbac_debug_ds) { rsbac_printk(KERN_DEBUG "rsbac_get_parent(): Getting file/dir/fifo/symlink parent for device %02u:%02u, inode %lu, dentry_p %p\n", RSBAC_MAJOR(tid.file.device),RSBAC_MINOR(tid.file.device), (u_long) tid.file.inode, tid.file.dentry_p); } #endif */ switch(target) { case T_FILE: case T_DIR: case T_FIFO: case T_SYMLINK: break; default: return -RSBAC_EINVALIDTARGET; } if(!tid.file.dentry_p) return -RSBAC_ENOTFOUND; *parent_target_p = T_DIR; /* Is this dentry root of a mounted device? */ if( tid.file.dentry_p->d_sb && (tid.file.dentry_p->d_sb->s_root == tid.file.dentry_p) ) { struct rsbac_device_list_item_t * device_p; u_long dflags; /* wait for read access to device_list_head */ rsbac_read_lock(&device_list_head.lock, &dflags); device_p = lookup_device(tid.file.device); if( !device_p || !device_p->d_covers || !device_p->d_covers->d_parent || !device_p->d_covers->d_parent->d_inode ) { /* free access to device_list_head */ rsbac_read_unlock(&device_list_head.lock, &dflags); return -RSBAC_ENOTFOUND; } parent_tid_p->dir.device = device_p->d_covers->d_parent->d_sb->s_dev; parent_tid_p->dir.inode = device_p->d_covers->d_parent->d_inode->i_ino; parent_tid_p->dir.dentry_p = device_p->d_covers->d_parent; /* free access to device_list_head */ rsbac_read_unlock(&device_list_head.lock, &dflags); } else { /* no root of filesystem -> use d_parent, dev keeps unchanged */ if(!tid.file.dentry_p->d_parent) { rsbac_printk(KERN_WARNING "rsbac_get_parent(): oops - d_parent is NULL!\n"); return -RSBAC_ENOTFOUND; } if(tid.file.dentry_p == tid.file.dentry_p->d_parent) { rsbac_printk(KERN_WARNING "rsbac_get_parent(): oops - d_parent == dentry_p!\n"); return -RSBAC_ENOTFOUND; } if(!tid.file.dentry_p->d_parent->d_inode) { rsbac_printk(KERN_WARNING "rsbac_get_parent(): oops - d_parent has no d_inode!\n"); return -RSBAC_ENOTFOUND; } parent_tid_p->dir.device = tid.file.device; parent_tid_p->dir.inode = tid.file.dentry_p->d_parent->d_inode->i_ino; parent_tid_p->dir.dentry_p = tid.file.dentry_p->d_parent; } return 0; }

int rsbac_init (  kdev_t  root_dev  )

Definition at line 8008 of file aci_data_structures.c. References A_rc_def_role, FALSE, GEN, rsbac_kthread_t::list, list_head, NULL, rsbac_kthread_t::pid, rsbac_target_id_t::process, process_handles, rsbac_do_init(), RSBAC_EINVALIDPOINTER, RSBAC_EREINIT, rsbac_get_attr, rsbac_initialized, rsbac_kthread_notify(), rsbac_list_add(), rsbac_list_get_data(), RSBAC_MAC_DEF_INIT_P_FLAGS, RSBAC_MAC_P_FLAGS, rsbac_printk(), RSBAC_RC_GENERAL_ROLE, rsbac_rc_get_boot_role(), rsbac_root_dev, RSBAC_SYSADM_UID, T_PROCESS, user_handles, and wakeup_rsbacd(). { #if defined(CONFIG_RSBAC_MAC) || defined(CONFIG_RSBAC_RC) struct rsbac_kthread_t * rsbac_kthread_entry; struct list_head * p; #ifdef CONFIG_RSBAC_RC struct rsbac_rc_process_aci_t rc_init_p_aci = DEFAULT_RC_P_INIT_ACI; #endif rsbac_pid_t init_pid; #endif int err = 0; #if (defined(CONFIG_RSBAC_AUTO_WRITE) && (CONFIG_RSBAC_AUTO_WRITE > 0)) \ || defined(CONFIG_RSBAC_INIT_THREAD) rsbac_pid_t rsbacd_pid; #endif if (rsbac_initialized) { rsbac_printk(KERN_WARNING "rsbac_init(): RSBAC already initialized\n"); return(-RSBAC_EREINIT); } if (!current->fs) { rsbac_printk(KERN_WARNING "rsbac_init(): current->fs is invalid!\n"); return(-RSBAC_EINVALIDPOINTER); } rsbac_root_dev = root_dev; #if (defined(CONFIG_RSBAC_AUTO_WRITE) && (CONFIG_RSBAC_AUTO_WRITE > 0)) \ || defined(CONFIG_RSBAC_INIT_THREAD) /* init the rsbacd wait queue head */ init_waitqueue_head(&rsbacd_wait); #endif #ifdef CONFIG_RSBAC_INIT_THREAD /* trigger dependency */ #ifdef CONFIG_RSBAC_MAX_INIT_TIME #endif rsbac_printk(KERN_INFO "rsbac_init(): Setting init timeout to %u seconds (%u jiffies).\n", RSBAC_MAX_INIT_TIME, RSBAC_MAX_INIT_TIME * HZ); init_timer(&rsbac_timer); rsbac_timer.function = wakeup_rsbacd; rsbac_timer.data = 0; rsbac_timer.expires = jiffies + (RSBAC_MAX_INIT_TIME * HZ); add_timer(&rsbac_timer); /* Start rsbac thread for init */ rsbacd_pid = kernel_thread(rsbac_initd, NULL, 0); rsbac_printk(KERN_INFO "rsbac_init(): Started rsbac_initd thread with pid %u\n", rsbacd_pid); if(!rsbac_initialized) interruptible_sleep_on(&rsbacd_wait); if(!rsbac_initialized) { rsbac_printk(KERN_ERR "rsbac_init(): *** RSBAC init timed out - RSBAC not correctly initialized! ***\n"); rsbac_printk(KERN_ERR "rsbac_init(): *** Killing rsbac_initd! ***\n"); sys_kill(rsbacd_pid, SIGKILL); rsbac_initialized = FALSE; } #else rsbac_do_init(); #endif #if defined(CONFIG_RSBAC_AUTO_WRITE) && (CONFIG_RSBAC_AUTO_WRITE > 0) if(rsbac_initialized) { /* Start rsbacd thread for auto write */ rsbacd_pid = kernel_thread(rsbacd, NULL, CLONE_FS | CLONE_FILES | CLONE_SIGHAND); if(rsbacd_pid < 0) { rsbac_printk(KERN_ERR "rsbac_init(): *** Starting rsbacd thread failed with error %i! ***\n", rsbacd_pid); } else { rsbac_printk(KERN_INFO "rsbac_init(): Started rsbacd thread with pid %u\n", rsbacd_pid); } } #endif /* Ready. */ /* schedule(); */ #ifdef CONFIG_RSBAC_INIT_THREAD sys_wait4(-1, NULL, WNOHANG, NULL); #endif /* Add all processes to list of processes as init processes */ #if defined(CONFIG_RSBAC_MAC) || defined(CONFIG_RSBAC_RC) { #ifdef CONFIG_RSBAC_MAC struct rsbac_mac_user_aci_t mac_u_aci; #endif #ifdef CONFIG_RSBAC_RC struct rsbac_rc_user_aci_t rc_u_aci; #endif rsbac_uid_t user = RSBAC_SYSADM_UID; rsbac_pid_t pid = 1; struct task_struct * p; union rsbac_target_id_t k_tid; union rsbac_attribute_value_t k_attr_val; rsbac_printk(KERN_INFO "rsbac_init(): Adjusting attributes of existing processes\n"); /* Prepare entries: change standard values to root's values */ #ifdef CONFIG_RSBAC_MAC if(!rsbac_list_get_data(user_handles.mac, &user, &mac_u_aci)) { mac_init_p_aci.owner_sec_level = mac_u_aci.security_level; mac_init_p_aci.owner_initial_sec_level = mac_u_aci.initial_security_level; mac_init_p_aci.current_sec_level = mac_u_aci.initial_security_level; mac_init_p_aci.owner_min_sec_level = mac_u_aci.min_security_level; mac_init_p_aci.mac_owner_categories = mac_u_aci.mac_categories; mac_init_p_aci.mac_owner_initial_categories = mac_u_aci.mac_initial_categories; mac_init_p_aci.mac_curr_categories = mac_u_aci.mac_initial_categories; mac_init_p_aci.mac_owner_min_categories = mac_u_aci.mac_min_categories; mac_init_p_aci.min_write_open = mac_u_aci.security_level; mac_init_p_aci.max_read_open = mac_u_aci.min_security_level; mac_init_p_aci.min_write_categories = mac_u_aci.mac_categories; mac_init_p_aci.max_read_categories = mac_u_aci.mac_min_categories; mac_init_p_aci.mac_process_flags = (mac_u_aci.mac_user_flags & RSBAC_MAC_P_FLAGS) | RSBAC_MAC_DEF_INIT_P_FLAGS; } #endif /* Set process aci - first init */ #ifdef CONFIG_RSBAC_MAC if(rsbac_list_add(process_handles.mac[mac_p_hash(pid)], &pid, &mac_init_p_aci)) rsbac_printk(KERN_WARNING "rsbac_do_init(): MAC ACI for Init process 1 could not be added!\n"); #endif #ifdef CONFIG_RSBAC_RC /* Get boot role */ if(rsbac_rc_get_boot_role(&rc_init_p_aci.rc_role)) { /* none: use root's role */ if(!rsbac_list_get_data(user_handles.rc, &user, &rc_u_aci)) { rc_init_p_aci.rc_role = rc_u_aci.rc_role; } else { /* last resort: general role */ rsbac_ds_get_error("rsbac_do_init", A_rc_def_role); rc_init_p_aci.rc_role = RSBAC_RC_GENERAL_ROLE; } } rc_kernel_p_aci.rc_role = rc_init_p_aci.rc_role; if(rsbac_list_add(process_handles.rc[rc_p_hash(pid)], &pid, &rc_init_p_aci)) rsbac_printk(KERN_WARNING "rsbac_do_init(): RC ACI for Init process 1 could not be added!\n"); #endif read_lock(&tasklist_lock); #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0) for_each_task(p) #else for_each_process(p) #endif { /* not for kernel and init though... */ if(!p->pid || (p->pid == 1)) continue; pid = p->pid; #ifdef CONFIG_RSBAC_DEBUG if (rsbac_debug_ds) { rsbac_printk(KERN_DEBUG "rsbac_do_init(): setting aci for process %u\n", pid); } #endif #ifdef CONFIG_RSBAC_MAC if(rsbac_list_add(process_handles.mac[mac_p_hash(pid)], &pid, &mac_init_p_aci)) rsbac_printk(KERN_WARNING "rsbac_do_init(): MAC ACI for Init process %u could not be added!\n", pid); #endif #ifdef CONFIG_RSBAC_RC k_tid.process = p->pid; if (rsbac_get_attr(GEN, T_PROCESS, k_tid, A_kernel_thread, &k_attr_val, FALSE)) { rsbac_printk(KERN_WARNING "rsbac_do_init(): RC ACI for Kernel thread %u could not be added!\n", pid); } if (k_attr_val.kernel_thread) { if(rsbac_list_add(process_handles.rc[rc_p_hash(pid)], &pid, &rc_kernel_p_aci)) rsbac_printk(KERN_WARNING "rsbac_do_init(): RC ACI for Kernel process %u could not be added!\n", pid); } #endif } read_unlock(&tasklist_lock); } list_for_each(p, &rsbac_kthread->list) { rsbac_kthread_entry = list_entry(p, struct rsbac_kthread_t, list); if (rsbac_kthread_entry->pid != 1 || rsbac_kthread_entry->pid != rsbacd_pid); { rsbac_kthread_notify(rsbac_kthread_entry->pid); /* kernel list implementation is for exclusive * wizards use, let's not free it now till * i know why it oops. doesnt consume much memory * anyway. michal. */ /*list_del(&rsbac_kthread_entry->list); * kfree(rsbac_kthread_entry);*/ } } /* explicitly mark init and rsbacd */ init_pid = 1; #ifdef CONFIG_RSBAC_MAC if (rsbac_list_add(process_handles.mac[mac_p_hash(init_pid)], &init_pid, &mac_init_p_aci)) rsbac_printk(KERN_WARNING "rsbac_do_init(): MAC ACI for \"init\" process could not be added!\n"); if (rsbac_list_add(process_handles.mac[mac_p_hash(rsbacd_pid)], &rsbacd_pid, &mac_init_p_aci)) rsbac_printk(KERN_WARNING "rsbac_do_init(): MAC ACI for \"rsbacd\" process could not be added!\n"); #endif #ifdef CONFIG_RSBAC_RC if (rsbac_list_add(process_handles.rc[rc_p_hash(init_pid)], &init_pid, &rc_init_p_aci)) rsbac_printk(KERN_WARNING "rsbac_do_init(): RC ACI for \"init\" process could not be added!\n"); if (rsbac_list_add(process_handles.rc[rc_p_hash(rsbacd_pid)], &rsbacd_pid, &rc_kernel_p_aci)) rsbac_printk(KERN_WARNING "rsbac_do_init(): RC ACI for \"rsbacd\" process could not be added!\n"); #endif /*kfree(rsbac_kthread);*/ #endif /* MAC or RC */ rsbac_printk(KERN_INFO "rsbac_init(): Ready.\n"); return(err); }

rsbac_boolean_t rsbac_is_initialized (  void   )

Definition at line 8241 of file aci_data_structures.c. References rsbac_initialized. Referenced by rsbac_acl_add_to_acl_entry(), rsbac_acl_get_mask(), rsbac_acl_get_rights(), rsbac_acl_get_single_right(), rsbac_acl_get_tlist(), rsbac_acl_remove_acl(), rsbac_acl_remove_acl_entry(), rsbac_acl_remove_from_acl_entry(), rsbac_acl_set_acl_entry(), rsbac_acl_set_mask(), rsbac_adf_request_int(), rsbac_adf_set_attr(), rsbac_auth_add_to_f_capset(), rsbac_auth_add_to_p_capset(), rsbac_auth_clear_f_capset(), rsbac_auth_clear_p_capset(), rsbac_auth_copy_fp_capset(), rsbac_auth_copy_pp_capset(), rsbac_auth_get_f_caplist(), rsbac_auth_get_p_caplist(), rsbac_auth_p_capset_member(), rsbac_auth_remove_from_f_capset(), rsbac_auth_remove_from_p_capset(), rsbac_check_acl(), rsbac_init_acl(), rsbac_init_auth(), rsbac_init_daz(), rsbac_init_mac(), rsbac_init_pm(), rsbac_init_rc(), rsbac_init_um(), rsbac_mac_add_to_f_truset(), rsbac_mac_add_to_p_truset(), rsbac_mac_clear_f_truset(), rsbac_mac_clear_p_truset(), rsbac_mac_copy_fp_truset(), rsbac_mac_copy_pp_truset(), rsbac_mac_get_f_trulist(), rsbac_mac_get_p_trulist(), rsbac_mac_p_truset_member(), rsbac_mac_remove_from_f_truset(), rsbac_mac_remove_from_p_truset(), rsbac_mount_acl(), rsbac_mount_auth(), rsbac_mount_mac(), rsbac_pm(), rsbac_pm_change_current_task(), rsbac_rc_check_comp(), rsbac_rc_copy_role(), rsbac_rc_copy_type(), rsbac_rc_get_item(), rsbac_rc_get_list(), rsbac_rc_set_item(), rsbac_reg_init(), rsbac_stats_acl(), rsbac_stats_auth(), rsbac_stats_mac(), rsbac_stats_pm(), rsbac_stats_rc(), rsbac_stats_um(), rsbac_um_add_gm(), rsbac_um_add_group(), rsbac_um_add_user(), rsbac_um_get_group_item(), rsbac_um_get_user_item(), rsbac_um_mod_group(), rsbac_um_mod_user(), rsbac_um_remove_gm(), rsbac_umount_acl(), rsbac_umount_auth(), and rsbac_umount_mac(). { return rsbac_initialized; }

int rsbac_kthread_notify (  rsbac_pid_t  pid  )

Definition at line 8246 of file aci_data_structures.c. References process_handles, rsbac_initialized, rsbac_list_add(), and rsbac_printk(). Referenced by rsbac_init(). { if (!rsbac_initialized) return 0; /* Set process aci */ #ifdef CONFIG_RSBAC_MAC if(rsbac_list_add(process_handles.mac[mac_p_hash(pid)], &pid, &mac_init_p_aci)) rsbac_printk(KERN_WARNING "rsbac_do_init(): MAC ACI for kernel process %u could not be added!", pid); #endif #ifdef CONFIG_RSBAC_RC if(rsbac_list_add(process_handles.rc[rc_p_hash(pid)], &pid, &rc_kernel_p_aci)) rsbac_printk(KERN_WARNING "rsbac_do_init(): RC ACI for kernel process %u could not be added!", pid); #endif return 0; }

int rsbac_kthreads_init (  void   )

Definition at line 7984 of file aci_data_structures.c. References rsbac_kthread_t::list. { rsbac_kthread_size_t = sizeof(struct rsbac_kthread_t); rsbac_kthread = kmalloc(rsbac_kthread_size_t, GFP_ATOMIC); INIT_LIST_HEAD(&rsbac_kthread->list); return 0; }

int rsbac_mark_kthread (  rsbac_pid_t  pid  )

Definition at line 7992 of file aci_data_structures.c. References rsbac_kthread_t::list, rsbac_kthread_t::pid, and rsbac_initialized. { struct rsbac_kthread_t * rsbac_kthread_new; if (rsbac_initialized) return 0; rsbac_kthread_new = kmalloc(rsbac_kthread_size_t, GFP_ATOMIC); rsbac_kthread_new->pid = pid; list_add(&rsbac_kthread_new->list, &rsbac_kthread->list); return 0; }

int rsbac_mount (  struct super_block *  sb_p, struct dentry *  d_covers )

Definition at line 8268 of file aci_data_structures.c. References add_device_item(), clear_device_item(), create_device_item(), device_list_head, get_error_name(), lookup_device(), NULL, register_fd_lists(), rsbac_debug_no_write, RSBAC_ECOULDNOTADDDEVICE, RSBAC_EINVALIDPOINTER, RSBAC_ENOTINITIALIZED, rsbac_init(), rsbac_initialized, rsbac_kfree(), rsbac_kmalloc(), rsbac_list_mount(), RSBAC_MAXNAMELEN, rsbac_mount_acl(), rsbac_mount_auth(), rsbac_mount_mac(), rsbac_mount_reg(), rsbac_printk(), rsbac_root_dev, rsbac_write_sem, sysfs_covered_p, SYSFS_MAGIC, sysfs_sb_p, and TRUE. Referenced by get_attr_fd(), rsbac_aef_sb_post_addmount(), rsbac_aef_sb_umount_busy(), rsbac_do_init(), rsbac_get_super_block(), rsbac_ta_remove_target(), and set_attr_fd(). { int err = 0; struct rsbac_device_list_item_t * device_p; struct rsbac_device_list_item_t * new_device_p; u_long flags; rsbac_boolean_t old_no_write; if(!sb_p) { rsbac_printk(KERN_WARNING "rsbac_mount(): called with NULL pointer\n"); return -RSBAC_EINVALIDPOINTER; } if (!rsbac_initialized) { #ifdef CONFIG_RSBAC_INIT_DELAY #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0) if( !RSBAC_MAJOR(rsbac_delayed_root) && !RSBAC_MINOR(rsbac_delayed_root) && rsbac_delayed_root_str[0] ) { /* translate string to kdev_t */ char * p = rsbac_delayed_root_str; u_int major = 0; u_int minor = 0; major = simple_strtoul(p, NULL, 0); while((*p != ':') && (*p != '\0')) p++; if(*p) { p++; minor = simple_strtoul(p, NULL, 0); } rsbac_delayed_root = RSBAC_MKDEV(major,minor); } #endif if( !rsbac_no_delay_init && ( ( !RSBAC_MAJOR(rsbac_delayed_root) && !RSBAC_MINOR(rsbac_delayed_root) && (MAJOR(sb_p->s_dev) > 1) ) || ( ( RSBAC_MAJOR(rsbac_delayed_root) || RSBAC_MINOR(rsbac_delayed_root) ) && ( (MAJOR(sb_p->s_dev) == RSBAC_MAJOR(rsbac_delayed_root)) && ( !RSBAC_MINOR(rsbac_delayed_root) || (MINOR(sb_p->s_dev) == RSBAC_MINOR(rsbac_delayed_root)) ) ) ) ) ) { if(RSBAC_MAJOR(rsbac_delayed_root) || RSBAC_MINOR(rsbac_delayed_root)) { rsbac_printk(KERN_INFO "rsbac_mount(): forcing delayed RSBAC init on DEV %02u:%02u, matching %02u:%02u!\n", MAJOR(sb_p->s_dev), MINOR(sb_p->s_dev), RSBAC_MAJOR(rsbac_delayed_root), RSBAC_MINOR(rsbac_delayed_root)); } else { rsbac_printk(KERN_INFO "rsbac_mount(): forcing delayed RSBAC init on DEV %02u:%02u!\n", MAJOR(sb_p->s_dev), MINOR(sb_p->s_dev)); } rsbac_init(sb_p->s_dev); return 0; } #endif rsbac_printk(KERN_WARNING "rsbac_mount(): RSBAC not initialized while mounting DEV %02u:%02u, delaying\n", MAJOR(sb_p->s_dev), MINOR(sb_p->s_dev)); #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0) if( (sb_p->s_magic == SYSFS_MAGIC) && !RSBAC_MAJOR(sb_p->s_dev) ) { rsbac_printk(KERN_WARNING "rsbac_mount(): sysfs mount detected, keeping values for later use\n"); sysfs_sb_p = sb_p; sysfs_covered_p = d_covers; } #endif #ifdef CONFIG_DEVFS_MOUNT if( (sb_p->s_magic == DEVFS_SUPER_MAGIC) && !RSBAC_MAJOR(sb_p->s_dev) ) { rsbac_printk(KERN_WARNING "rsbac_mount(): devfs mount detected, keeping values for later use\n"); devfs_sb_p = sb_p; devfs_covered_p = d_covers; } #endif return(-RSBAC_ENOTINITIALIZED); } #ifdef CONFIG_RSBAC_DEBUG if (rsbac_debug_ds) { rsbac_printk(KERN_DEBUG "rsbac_mount(): mounting device %02u:%02u\n", MAJOR(sb_p->s_dev), MINOR(sb_p->s_dev)); } if(rsbac_debug_stack) { unsigned long * n = (unsigned long *) (current+1); while (!*n) n++; rsbac_printk(KERN_DEBUG "rsbac_mount: free stack: %lu\n", (unsigned long) n - (unsigned long)(current+1)); } #endif down(&rsbac_write_sem); old_no_write = rsbac_debug_no_write; rsbac_debug_no_write = TRUE; up(&rsbac_write_sem); /* wait for read access to device_list_head */ rsbac_read_lock(&device_list_head.lock, &flags); device_p = lookup_device(sb_p->s_dev); /* repeated mount? */ if(device_p) { rsbac_printk(KERN_INFO "rsbac_mount: repeated mount %u of device %02u:%02u\n", device_p->mount_count, MAJOR(sb_p->s_dev), MINOR(sb_p->s_dev)); device_p->mount_count++; if( d_covers && !device_p->d_covers && (MAJOR(sb_p->s_dev) != MAJOR(rsbac_root_dev)) && (MINOR(sb_p->s_dev) != MINOR(rsbac_root_dev)) ) { rsbac_printk(KERN_WARNING "rsbac_mount: replacing NULL d_covers with new value %p as inheritance parent\n", d_covers); device_p->d_covers = d_covers; } rsbac_read_unlock(&device_list_head.lock, &flags); } else { rsbac_read_unlock(&device_list_head.lock, &flags); /* OK, go on */ new_device_p = create_device_item(sb_p, d_covers); #ifdef CONFIG_RSBAC_DEBUG if(rsbac_debug_stack) { unsigned long * n = (unsigned long *) (current+1); while (!*n) n++; rsbac_printk(KERN_DEBUG "rsbac_mount: after creating device item: free stack: %lu\n", (unsigned long) n - (unsigned long)(current+1)); } #endif if(!new_device_p) { rsbac_debug_no_write = old_no_write; return -RSBAC_ECOULDNOTADDDEVICE; } rsbac_read_lock(&device_list_head.lock, &flags); /* make sure to only add, if this device item has not been added in the meantime */ device_p = lookup_device(sb_p->s_dev); if(device_p) { rsbac_printk(KERN_WARNING "rsbac_mount(): mount race for device %02u:%02u detected!\n", MAJOR(sb_p->s_dev), MINOR(sb_p->s_dev)); device_p->mount_count++; rsbac_read_unlock(&device_list_head.lock, &flags); clear_device_item(new_device_p); } else { rsbac_read_unlock(&device_list_head.lock, &flags); rsbac_write_lock(&device_list_head.lock, &flags); device_p = add_device_item(new_device_p); rsbac_write_unlock(&device_list_head.lock, &flags); if(!device_p) { rsbac_printk(KERN_WARNING "rsbac_mount: adding device %02u:%02u failed!\n", MAJOR(sb_p->s_dev), MINOR(sb_p->s_dev)); clear_device_item(new_device_p); rsbac_debug_no_write = old_no_write; return -RSBAC_ECOULDNOTADDDEVICE; } } /* Generic lists */ rsbac_list_mount(sb_p->s_dev); /* we do not lock device head - we know the device_p and hope for the best... */ /* also, we are within kernel mount sem */ if((err = register_fd_lists(new_device_p, sb_p->s_dev))) { char * tmp; tmp = rsbac_kmalloc(RSBAC_MAXNAMELEN); if(tmp) { rsbac_printk(KERN_WARNING "rsbac_mount(): File/Dir ACI registration failed for dev %02u:%02u, err %s!\n", MAJOR(sb_p->s_dev), MINOR(sb_p->s_dev), get_error_name(tmp,err)); rsbac_kfree(tmp); } } #ifdef CONFIG_RSBAC_DEBUG if(rsbac_debug_stack) { unsigned long * n = (unsigned long *) (current+1); while (!*n) n++; rsbac_printk(KERN_DEBUG "rsbac_mount: after registering fd lists: free stack: %lu\n", (unsigned long) n - (unsigned long)(current+1)); } #endif } /* call other mount functions */ /****** MAC *******/ #if defined(CONFIG_RSBAC_MAC) rsbac_mount_mac(sb_p->s_dev); #ifdef CONFIG_RSBAC_DEBUG if(rsbac_debug_stack) { unsigned long * n = (unsigned long *) (current+1); while (!*n) n++; rsbac_printk(KERN_DEBUG "rsbac_mount: after mount_mac: free stack: %lu\n", (unsigned long) n - (unsigned long)(current+1)); } #endif #endif /****** AUTH *******/ #if defined(CONFIG_RSBAC_AUTH) rsbac_mount_auth(sb_p->s_dev); #ifdef CONFIG_RSBAC_DEBUG if(rsbac_debug_stack) { unsigned long * n = (unsigned long *) (current+1); while (!*n) n++; rsbac_printk(KERN_DEBUG "rsbac_mount: after mount_auth: free stack: %lu\n", (unsigned long) n - (unsigned long)(current+1)); } #endif #endif /****** ACL *******/ #if defined(CONFIG_RSBAC_ACL) rsbac_mount_acl(sb_p->s_dev); #ifdef CONFIG_RSBAC_DEBUG if(rsbac_debug_stack) { unsigned long * n = (unsigned long *) (current+1); while (!*n) n++; rsbac_printk(KERN_DEBUG "rsbac_mount: after mount_acl: free stack: %lu\n", (unsigned long) n - (unsigned long)(current+1)); } #endif #endif /****** REG *******/ #if defined(CONFIG_RSBAC_REG) rsbac_mount_reg(sb_p->s_dev); #ifdef CONFIG_RSBAC_DEBUG if(rsbac_debug_stack) { unsigned long * n = (unsigned long *) (current+1); while (!*n) n++; rsbac_printk(KERN_DEBUG "rsbac_mount: after mount_reg: free stack: %lu\n", (unsigned long) n - (unsigned long)(current+1)); } #endif #endif /* REG */ rsbac_debug_no_write = old_no_write; return(err); }

void rsbac_off (  void   )

int rsbac_stats (  void   )

Definition at line 8721 of file aci_data_structures.c. { struct rsbac_device_list_item_t * device_p; int i; u_long fd_count = 0, fd_sum = 0; u_long dev_sum = 0; u_long ipc_sum = 0; u_long user_sum = 0; u_long process_sum = 0; #if defined(CONFIG_RSBAC_UM) u_long group_sum = 0; #endif #if defined(CONFIG_RSBAC_NET_OBJ) u_long nettemp_sum = 0; u_long lnetobj_sum = 0; u_long rnetobj_sum = 0; #endif u_long total_sum = 0; long tmp_count; u_long dflags; if (!rsbac_initialized) { rsbac_printk(KERN_WARNING "rsbac_stats(): RSBAC not initialized\n"); return(-RSBAC_ENOTINITIALIZED); } /* wait for read access to device_list_head */ rsbac_read_lock(&device_list_head.lock, &dflags); /* OK, go on */ /* rsbac_printk(KERN_INFO "rsbac_stats(): currently %u processes working on file/dir aci\n", device_list_head.lock.lock); */ device_p = device_list_head.head; while (device_p) { /* for all sublists */ fd_count = 0; for (i=0; i < RSBAC_GEN_NR_FD_LISTS; i++) { tmp_count = rsbac_list_count(device_p->handles.gen[i]); if(tmp_count > 0) fd_count+=tmp_count; } rsbac_printk(KERN_INFO "Device %02u:%02u fd_items: %lu GEN", RSBAC_MAJOR(device_p->id), RSBAC_MINOR(device_p->id), fd_count); fd_sum += fd_count; #if defined(CONFIG_RSBAC_MAC) fd_count = 0; for (i=0; i < RSBAC_MAC_NR_FD_LISTS; i++) { tmp_count = rsbac_list_count(device_p->handles.mac[i]); if(tmp_count > 0) fd_count+=tmp_count; } rsbac_printk(", %lu MAC", fd_count); fd_sum += fd_count; #endif #if defined(CONFIG_RSBAC_PM) fd_count = 0; for (i=0; i < RSBAC_PM_NR_FD_LISTS; i++) { tmp_count = rsbac_list_count(device_p->handles.pm[i]); if(tmp_count > 0) fd_count+=tmp_count; } rsbac_printk(", %lu PM", fd_count); fd_sum += fd_count; #endif #if defined(CONFIG_RSBAC_DAZ) fd_count = 0; for (i=0; i < RSBAC_DAZ_NR_FD_LISTS; i++) { tmp_count = rsbac_list_count(device_p->handles.daz[i]); if(tmp_count > 0) fd_count+=tmp_count; } rsbac_printk(", %lu DAZ", fd_count); fd_sum += fd_count; #if defined(CONFIG_RSBAC_DAZ_CACHE) fd_count = 0; for (i=0; i < RSBAC_DAZ_SCANNED_NR_FD_LISTS; i++) { tmp_count = rsbac_list_count(device_p->handles.dazs[i]); if(tmp_count > 0) fd_count+=tmp_count; } rsbac_printk(", %lu DAZ_SCANNED", fd_count); fd_sum += fd_count; #endif #endif #if defined(CONFIG_RSBAC_FF) fd_count = 0; for (i=0; i < RSBAC_FF_NR_FD_LISTS; i++) { tmp_count = rsbac_list_count(device_p->handles.ff[i]); if(tmp_count > 0) fd_count+=tmp_count; } rsbac_printk(", %lu FF", fd_count); fd_sum += fd_count; #endif #if defined(CONFIG_RSBAC_RC) fd_count = 0; for (i=0; i < RSBAC_RC_NR_FD_LISTS; i++) { tmp_count = rsbac_list_count(device_p->handles.rc[i]); if(tmp_count > 0) fd_count+=tmp_count; } rsbac_printk(", %lu RC", fd_count); fd_sum += fd_count; #endif #if defined(CONFIG_RSBAC_AUTH) fd_count = 0; for (i=0; i < RSBAC_AUTH_NR_FD_LISTS; i++) { tmp_count = rsbac_list_count(device_p->handles.auth[i]); if(tmp_count > 0) fd_count+=tmp_count; } rsbac_printk(", %lu AUTH", fd_count); fd_sum += fd_count; #endif #if defined(CONFIG_RSBAC_CAP) fd_count = 0; for (i=0; i < RSBAC_CAP_NR_FD_LISTS; i++) { tmp_count = rsbac_list_count(device_p->handles.cap[i]); if(tmp_count > 0) fd_count+=tmp_count; } rsbac_printk(", %lu CAP", fd_count); fd_sum += fd_count; #endif #if defined(CONFIG_RSBAC_RES) fd_count = 0; for (i=0; i < RSBAC_RES_NR_FD_LISTS; i++) { tmp_count = rsbac_list_count(device_p->handles.res[i]); if(tmp_count > 0) fd_count+=tmp_count; } rsbac_printk(", %lu RES", fd_count); fd_sum += fd_count; #endif #if defined(CONFIG_RSBAC_PAX) fd_count = 0; for (i=0; i < RSBAC_PAX_NR_FD_LISTS; i++) { tmp_count = rsbac_list_count(device_p->handles.pax[i]); if(tmp_count > 0) fd_count+=tmp_count; } rsbac_printk(", %lu PAX", fd_count); fd_sum += fd_count; #endif rsbac_printk("\n"); device_p = device_p->next; } rsbac_printk(KERN_INFO "rsbac_stats(): Sum of %u Devices with %lu fd-items\n", device_list_head.count, fd_sum); /* free access to device_list_head */ rsbac_read_unlock(&device_list_head.lock, &dflags); total_sum += fd_sum; /* dev lists */ tmp_count = rsbac_list_count(dev_handles.gen); rsbac_printk(KERN_INFO "DEV items: %lu GEN", tmp_count); dev_sum += tmp_count; #if defined(CONFIG_RSBAC_MAC) tmp_count = rsbac_list_count(dev_handles.mac); rsbac_printk(", %lu MAC", tmp_count); dev_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_PM) tmp_count = rsbac_list_count(dev_handles.pm); rsbac_printk(", %lu PM", tmp_count); dev_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_RC) tmp_count = rsbac_list_count(dev_major_handles.rc); rsbac_printk(", %lu major RC", tmp_count); dev_sum += tmp_count; tmp_count = rsbac_list_count(dev_handles.rc); rsbac_printk(", %lu RC", tmp_count); dev_sum += tmp_count; #endif rsbac_printk("\n"); rsbac_printk(KERN_INFO "Sum of %lu DEV items\n", dev_sum); total_sum += dev_sum; /* ipc lists */ rsbac_printk(KERN_INFO "IPC items: no GEN"); #if defined(CONFIG_RSBAC_MAC) tmp_count = rsbac_list_count(ipc_handles.mac); rsbac_printk(", %lu MAC", tmp_count); ipc_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_PM) tmp_count = rsbac_list_count(ipc_handles.pm); rsbac_printk(", %lu PM", tmp_count); ipc_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_RC) tmp_count = rsbac_list_count(ipc_handles.rc); rsbac_printk(", %lu RC", tmp_count); ipc_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_JAIL) tmp_count = rsbac_list_count(ipc_handles.jail); rsbac_printk(", %lu JAIL", tmp_count); ipc_sum += tmp_count; #endif rsbac_printk("\n"); rsbac_printk(KERN_INFO "Sum of %lu IPC items\n", ipc_sum); total_sum += ipc_sum; /* user lists */ tmp_count = rsbac_list_count(user_handles.gen); rsbac_printk(KERN_INFO "USER items: %lu GEN", tmp_count); user_sum += tmp_count; #if defined(CONFIG_RSBAC_MAC) tmp_count = rsbac_list_count(user_handles.mac); rsbac_printk(", %lu MAC", tmp_count); user_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_PM) tmp_count = rsbac_list_count(user_handles.pm); rsbac_printk(", %lu PM", tmp_count); user_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_DAZ) tmp_count = rsbac_list_count(user_handles.daz); rsbac_printk(", %lu DAZ", tmp_count); user_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_RC) tmp_count = rsbac_list_count(user_handles.rc); rsbac_printk(", %lu RC", tmp_count); user_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_AUTH) tmp_count = rsbac_list_count(user_handles.auth); rsbac_printk(", %lu AUTH", tmp_count); user_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_CAP) tmp_count = rsbac_list_count(user_handles.cap); rsbac_printk(", %lu CAP", tmp_count); user_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_JAIL) tmp_count = rsbac_list_count(user_handles.jail); rsbac_printk(", %lu JAIL", tmp_count); user_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_RES) tmp_count = rsbac_list_count(user_handles.res); rsbac_printk(", %lu RES", tmp_count); user_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_PAX) tmp_count = rsbac_list_count(user_handles.pax); rsbac_printk(", %lu PAX", tmp_count); user_sum += tmp_count; #endif rsbac_printk("\n"); rsbac_printk(KERN_INFO "Sum of %lu USER items\n", user_sum); total_sum += user_sum; /* process lists */ tmp_count = 0; for(i=0; i<CONFIG_RSBAC_GEN_NR_P_LISTS; i++) tmp_count += rsbac_list_count(process_handles.gen[i]); rsbac_printk(KERN_INFO "PROCESS items: %lu GEN", tmp_count); process_sum += tmp_count; #if defined(CONFIG_RSBAC_MAC) tmp_count = 0; for(i=0; i<CONFIG_RSBAC_MAC_NR_P_LISTS; i++) tmp_count += rsbac_list_count(process_handles.mac[i]); rsbac_printk(", %lu MAC", tmp_count); process_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_PM) tmp_count = rsbac_list_count(process_handles.pm); rsbac_printk(", %lu PM", tmp_count); process_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_DAZ) tmp_count = rsbac_list_count(process_handles.daz); rsbac_printk(", %lu DAZ", tmp_count); process_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_RC) tmp_count = 0; for(i=0; i<CONFIG_RSBAC_RC_NR_P_LISTS; i++) tmp_count += rsbac_list_count(process_handles.rc[i]); rsbac_printk(", %lu RC", tmp_count); process_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_AUTH) tmp_count = rsbac_list_count(process_handles.auth); rsbac_printk(", %lu AUTH", tmp_count); process_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_CAP) tmp_count = rsbac_list_count(process_handles.cap); rsbac_printk(", %lu CAP", tmp_count); process_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_JAIL) tmp_count = 0; for(i=0; i<CONFIG_RSBAC_JAIL_NR_P_LISTS; i++) tmp_count += rsbac_list_count(process_handles.jail[i]); rsbac_printk(", %lu JAIL", tmp_count); process_sum += tmp_count; #endif rsbac_printk("\n"); rsbac_printk(KERN_INFO "Sum of %lu PROCESS items\n", process_sum); total_sum += process_sum; #if defined(CONFIG_RSBAC_UM) /* group lists */ rsbac_printk(KERN_INFO "GROUP items: "); #if defined(CONFIG_RSBAC_RC_UM_PROT) tmp_count = rsbac_list_count(group_handles.rc); rsbac_printk("%lu RC", tmp_count); user_sum += tmp_count; #endif rsbac_printk("\n"); rsbac_printk(KERN_INFO "Sum of %lu GROUP items\n", group_sum); total_sum += group_sum; #endif #if defined(CONFIG_RSBAC_NET_OBJ) /* nettemp lists */ rsbac_printk(KERN_INFO "NETTEMP items: "); #if defined(CONFIG_RSBAC_MAC) tmp_count = rsbac_list_count(nettemp_handles.mac); rsbac_printk("%lu MAC, ", tmp_count); nettemp_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_PM) tmp_count = rsbac_list_count(nettemp_handles.pm); rsbac_printk("%lu PM, ", tmp_count); nettemp_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_RC) tmp_count = rsbac_list_count(nettemp_handles.rc); rsbac_printk("%lu RC, ", tmp_count); nettemp_sum += tmp_count; #endif rsbac_printk("\n"); rsbac_printk(KERN_INFO "Sum of %lu NETTEMP items\n", nettemp_sum); total_sum += nettemp_sum; /* local netobj lists */ rsbac_printk(KERN_INFO "Local NETOBJ items:"); #if defined(CONFIG_RSBAC_MAC) tmp_count = rsbac_list_count(lnetobj_handles.mac); rsbac_printk(" %lu MAC,", tmp_count); lnetobj_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_PM) tmp_count = rsbac_list_count(lnetobj_handles.pm); rsbac_printk(" %lu PM,", tmp_count); lnetobj_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_RC) tmp_count = rsbac_list_count(lnetobj_handles.rc); rsbac_printk(" %lu RC", tmp_count); lnetobj_sum += tmp_count; #endif rsbac_printk("\n"); rsbac_printk(KERN_INFO "Sum of %lu Local NETOBJ items\n", lnetobj_sum); total_sum += lnetobj_sum; /* remote netobj lists */ rsbac_printk(KERN_INFO "Remote NETOBJ items:"); #if defined(CONFIG_RSBAC_MAC) tmp_count = rsbac_list_count(rnetobj_handles.mac); rsbac_printk(" %lu MAC,", tmp_count); rnetobj_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_PM) tmp_count = rsbac_list_count(rnetobj_handles.pm); rsbac_printk(" %lu PM,", tmp_count); rnetobj_sum += tmp_count; #endif #if defined(CONFIG_RSBAC_RC) tmp_count = rsbac_list_count(rnetobj_handles.rc); rsbac_printk(" %lu RC", tmp_count); rnetobj_sum += tmp_count; #endif rsbac_printk("\n"); rsbac_printk(KERN_INFO "Sum of %lu Remote NETOBJ items\n", rnetobj_sum); total_sum += rnetobj_sum; #endif /* NET_OBJ */ rsbac_printk(KERN_INFO "Total of %lu registered rsbac-items\n", total_sum); rsbac_printk(KERN_INFO "adf_request calls: file: %lu, dir: %lu, fifo: %lu, symlink: %lu, dev: %lu, ipc: %lu, scd: %lu, user: %lu, process: %lu, netdev: %lu, nettemp: %lu, netobj: %lu\n", rsbac_adf_request_count[T_FILE], rsbac_adf_request_count[T_DIR], rsbac_adf_request_count[T_FIFO], rsbac_adf_request_count[T_SYMLINK], rsbac_adf_request_count[T_DEV], rsbac_adf_request_count[T_IPC], rsbac_adf_request_count[T_SCD], rsbac_adf_request_count[T_USER], rsbac_adf_request_count[T_PROCESS], rsbac_adf_request_count[T_NETDEV], rsbac_adf_request_count[T_NETTEMP], rsbac_adf_request_count[T_NETOBJ]); rsbac_printk(KERN_INFO "adf_set_attr calls: file: %lu, dir: %lu, fifo: %lu, symlink: %lu, dev: %lu, ipc: %lu, scd: %lu, user: %lu, process: %lu, netdev: %lu, nettemp: %lu, netobj: %lu\n", rsbac_adf_set_attr_count[T_FILE], rsbac_adf_set_attr_count[T_DIR], rsbac_adf_set_attr_count[T_FIFO], rsbac_adf_set_attr_count[T_SYMLINK], rsbac_adf_set_attr_count[T_DEV], rsbac_adf_set_attr_count[T_IPC], rsbac_adf_set_attr_count[T_SCD], rsbac_adf_set_attr_count[T_USER], rsbac_adf_set_attr_count[T_PROCESS], rsbac_adf_set_attr_count[T_NETDEV], rsbac_adf_set_attr_count[T_NETTEMP], rsbac_adf_set_attr_count[T_NETOBJ]); #if defined(CONFIG_RSBAC_PM) rsbac_stats_pm(); #endif #if defined(CONFIG_RSBAC_RC) rsbac_stats_rc(); #endif #if defined(CONFIG_RSBAC_AUTH) rsbac_stats_auth(); #endif #if defined(CONFIG_RSBAC_ACL) rsbac_stats_acl(); #endif return(0); }

int rsbac_ta_get_attr (  rsbac_list_ta_number_t  ta_number, enum rsbac_switch_target_t  module, enum rsbac_target_t  target, union rsbac_target_id_t  tid, enum rsbac_attribute_t  attr, union rsbac_attribute_value_t *  value, rsbac_boolean_t  inherit )

Definition at line 12133 of file aci_data_structures.c. References rsbac_target_id_t::dev, get_attr_dev(), get_attr_fd(), get_attr_ipc(), get_attr_process(), get_attr_user(), RSBAC_EINVALIDPOINTER, RSBAC_EINVALIDTARGET, RSBAC_ENOTINITIALIZED, rsbac_initialized, rsbac_printk(), T_DEV, T_DIR, T_FIFO, T_FILE, T_GROUP, T_IPC, T_NETDEV, T_NETOBJ, T_NETTEMP, T_PROCESS, T_SYMLINK, and T_USER. Referenced by rsbac_pm(), sys_rsbac_get_attr(), and sys_rsbac_get_attr_n(). { int err = 0; if (!rsbac_initialized) { rsbac_printk(KERN_WARNING "rsbac_get_attr(): RSBAC not initialized\n"); return(-RSBAC_ENOTINITIALIZED); } if (!value) return(-RSBAC_EINVALIDPOINTER); if (in_interrupt()) { rsbac_printk(KERN_WARNING "rsbac_get_attr(): called from interrupt!\n"); } #ifdef CONFIG_RSBAC_XSTATS get_attr_count[target]++; #endif switch (target) { case T_FILE: case T_DIR: case T_FIFO: case T_SYMLINK: return get_attr_fd(ta_number, module, target, &tid, attr, value, inherit); case T_DEV: return get_attr_dev(ta_number, module, target, tid.dev, attr, value, inherit); case T_IPC: return get_attr_ipc(ta_number, module, target, &tid, attr, value, inherit); case T_USER: return get_attr_user(ta_number, module, target, &tid, attr, value, inherit); case T_PROCESS: return get_attr_process(ta_number, module, target, &tid, attr, value, inherit); #ifdef CONFIG_RSBAC_UM case T_GROUP: return get_attr_group(ta_number, module, target, &tid, attr, value, inherit); #endif /* CONFIG_RSBAC_UM */ #ifdef CONFIG_RSBAC_NET_DEV case T_NETDEV: return get_attr_netdev(ta_number, module, target, &tid, attr, value, inherit); #endif #ifdef CONFIG_RSBAC_NET_OBJ case T_NETTEMP: return get_attr_nettemp(ta_number, module, target, &tid, attr, value, inherit); case T_NETOBJ: return get_attr_netobj(ta_number, module, target, &tid, attr, value, inherit); #endif /* NET_OBJ */ /* switch target: no valid target */ default: return -RSBAC_EINVALIDTARGET; } return err; } /* end of rsbac_get_attr() */

int rsbac_ta_list_all_dev (  rsbac_list_ta_number_t  ta_number, struct rsbac_dev_desc_t **  id_pp )

Definition at line 14867 of file aci_data_structures.c. References D_block, D_block_major, dev_handles, dev_major_handles, NULL, RSBAC_ENOMEM, rsbac_ta_list_count(), rsbac_ta_list_exist(), rsbac_ta_list_get_all_desc(), rsbac_vfree, and rsbac_vmalloc. Referenced by sys_rsbac_list_all_dev(). { int count=0; int tmp_count; tmp_count = rsbac_ta_list_count(ta_number, dev_handles.gen); if(tmp_count > 0) count += tmp_count; #if defined(CONFIG_RSBAC_MAC) tmp_count = rsbac_ta_list_count(ta_number, dev_handles.mac); if(tmp_count > 0) count += tmp_count; #endif #if defined(CONFIG_RSBAC_PM) tmp_count = rsbac_ta_list_count(ta_number, dev_handles.pm); if(tmp_count > 0) count += tmp_count; #endif #if defined(CONFIG_RSBAC_RC) tmp_count = rsbac_ta_list_count(ta_number, dev_major_handles.rc); if(tmp_count > 0) count += tmp_count; tmp_count = rsbac_ta_list_count(ta_number, dev_handles.rc); if(tmp_count > 0) count += tmp_count; #endif if(id_pp) { struct rsbac_dev_desc_t * i_id_p = NULL; char * pos = NULL; #if defined(CONFIG_RSBAC_MAC) || defined(CONFIG_RSBAC_PM) || defined(CONFIG_RSBAC_RC) u_int i; #endif if(count > 0) { int i_count = 0; i_count = count + 20; /* max value to expect */ *id_pp = rsbac_vmalloc(i_count * sizeof(**id_pp)); if(!*id_pp) return -RSBAC_ENOMEM; pos = (char *) *id_pp; tmp_count = rsbac_ta_list_get_all_desc(ta_number, dev_handles.gen, (void **) &i_id_p); if(tmp_count > 0) { if(tmp_count > i_count) tmp_count = i_count; memcpy(pos, i_id_p, tmp_count * sizeof(*i_id_p)); rsbac_vfree(i_id_p); count = tmp_count; i_count -= tmp_count; pos += tmp_count * sizeof(*i_id_p); } else count = 0; #if defined(CONFIG_RSBAC_MAC) if(i_count) { tmp_count = rsbac_ta_list_get_all_desc(ta_number, dev_handles.mac, (void **) &i_id_p); if(tmp_count > 0) { if(tmp_count > i_count) tmp_count = i_count; for(i=0; i< tmp_count; i++) { if(!rsbac_ta_list_exist(ta_number, dev_handles.gen, &i_id_p[i])) { memcpy(pos, &i_id_p[i], sizeof(*i_id_p)); pos += sizeof(*i_id_p); count++; i_count--; } } rsbac_vfree(i_id_p); } } #endif #if defined(CONFIG_RSBAC_PM) if(i_count) { tmp_count = rsbac_ta_list_get_all_desc(ta_number, dev_handles.pm, (void **) &i_id_p); if(tmp_count > 0) { if(tmp_count > i_count) tmp_count = i_count; for(i=0; i< tmp_count; i++) { if(!rsbac_ta_list_exist(ta_number, dev_handles.gen, &i_id_p[i])) #if defined(CONFIG_RSBAC_MAC) if(!rsbac_ta_list_exist(ta_number, dev_handles.mac, &i_id_p[i])) #endif { memcpy(pos, &i_id_p[i], sizeof(*i_id_p)); pos += sizeof(*i_id_p); count++; i_count--; } } rsbac_vfree(i_id_p); } } #endif #if defined(CONFIG_RSBAC_RC) if(i_count) { tmp_count = rsbac_ta_list_get_all_desc(ta_number, dev_major_handles.rc, (void **) &i_id_p); if(tmp_count > 0) { if(tmp_count > i_count) tmp_count = i_count; for(i=0; i< tmp_count; i++) { i_id_p[i].type += (D_block_major - D_block); memcpy(pos, &i_id_p[i], sizeof(*i_id_p)); pos += sizeof(*i_id_p); count++; i_count--; } rsbac_vfree(i_id_p); } } if(i_count) { tmp_count = rsbac_ta_list_get_all_desc(ta_number, dev_handles.rc, (void **) &i_id_p); if(tmp_count > 0) { if(tmp_count > i_count) tmp_count = i_count; for(i=0; i< tmp_count; i++) { if(!rsbac_ta_list_exist(ta_number, dev_handles.gen, &i_id_p[i])) #if defined(CONFIG_RSBAC_MAC) if(!rsbac_ta_list_exist(ta_number, dev_handles.mac, &i_id_p[i])) #endif #if defined(CONFIG_RSBAC_PM) if(!rsbac_ta_list_exist(ta_number, dev_handles.pm, &i_id_p[i])) #endif { memcpy(pos, &i_id_p[i], sizeof(*i_id_p)); pos += sizeof(*i_id_p); count++; i_count--; } } rsbac_vfree(i_id_p); } } #endif if(!count) rsbac_vfree(*id_pp); } } return count; }

int rsbac_ta_list_all_group (  rsbac_list_ta_number_t  ta_number, rsbac_gid_t **  id_pp )

Definition at line 15192 of file aci_data_structures.c. References NULL, RSBAC_ENOMEM, rsbac_ta_list_count(), rsbac_ta_list_get_all_desc(), rsbac_vfree, and rsbac_vmalloc. Referenced by sys_rsbac_list_all_group(). { #if defined(CONFIG_RSBAC_RC_UM_PROT) int count=0; int tmp_count; tmp_count = rsbac_ta_list_count(ta_number, group_handles.rc); if(tmp_count > 0) count += tmp_count; if(id_pp) { if(count > 0) { int i_count; rsbac_gid_t * i_id_p = NULL; i_count = count + 20; /* max value to expect */ *id_pp = rsbac_vmalloc(i_count * sizeof(**id_pp)); if(!*id_pp) return -RSBAC_ENOMEM; tmp_count = rsbac_ta_list_get_all_desc(ta_number, group_handles.rc, (void **) &i_id_p); if(tmp_count > 0) { if(tmp_count > i_count) tmp_count = i_count; memcpy(*id_pp, i_id_p, tmp_count * sizeof(*i_id_p)); rsbac_vfree(i_id_p); count = tmp_count; i_count -= tmp_count; } else count = 0; if(!count) rsbac_vfree(*id_pp); } } return count; #else return 0; #endif }

int rsbac_ta_list_all_user (  rsbac_list_ta_number_t  ta_number, rsbac_uid_t **  id_pp )

Definition at line 15072 of file aci_data_structures.c. References copy_new_uids(), NULL, RSBAC_ENOMEM, rsbac_ta_list_count(), rsbac_ta_list_get_all_desc(), rsbac_vfree, rsbac_vmalloc, and user_handles. Referenced by sys_rsbac_list_all_user(). { int count=0; int tmp_count; tmp_count = rsbac_ta_list_count(ta_number, user_handles.gen); if(tmp_count > 0) count += tmp_count; #if defined(CONFIG_RSBAC_MAC) tmp_count = rsbac_ta_list_count(ta_number, user_handles.mac); if(tmp_count > 0) count += tmp_count; #endif #if defined(CONFIG_RSBAC_PM) tmp_count = rsbac_ta_list_count(ta_number, user_handles.pm); if(tmp_count > 0) count += tmp_count; #endif #if defined(CONFIG_RSBAC_DAZ) tmp_count = rsbac_ta_list_count(ta_number, user_handles.daz); if(tmp_count > 0) count += tmp_count; #endif #if defined(CONFIG_RSBAC_FF) tmp_count = rsbac_ta_list_count(ta_number, user_handles.ff); if(tmp_count > 0) count += tmp_count; #endif #if defined(CONFIG_RSBAC_RC) tmp_count = rsbac_ta_list_count(ta_number, user_handles.rc); if(tmp_count > 0) count += tmp_count; #endif #if defined(CONFIG_RSBAC_AUTH) tmp_count = rsbac_ta_list_count(ta_number, user_handles.auth); if(tmp_count > 0) count += tmp_count; #endif #if defined(CONFIG_RSBAC_CAP) tmp_count = rsbac_ta_list_count(ta_number, user_handles.cap); if(tmp_count > 0) count += tmp_count; #endif #if defined(CONFIG_RSBAC_JAIL) tmp_count = rsbac_ta_list_count(ta_number, user_handles.jail); if(tmp_count > 0) count += tmp_count; #endif #if defined(CONFIG_RSBAC_PAX) tmp_count = rsbac_ta_list_count(ta_number, user_handles.pax); if(tmp_count > 0) count += tmp_count; #endif #if defined(CONFIG_RSBAC_RES) tmp_count = rsbac_ta_list_count(ta_number, user_handles.res); if(tmp_count > 0) count += tmp_count; #endif if(id_pp) { if(count > 0) { int i_count; rsbac_uid_t * i_id_p = NULL; i_count = count + 20; /* max value to expect */ *id_pp = rsbac_vmalloc(i_count * sizeof(**id_pp)); if(!*id_pp) return -RSBAC_ENOMEM; tmp_count = rsbac_ta_list_get_all_desc(ta_number, user_handles.gen, (void **) &i_id_p); if(tmp_count > 0) { if(tmp_count > i_count) tmp_count = i_count; memcpy(*id_pp, i_id_p, tmp_count * sizeof(*i_id_p)); rsbac_vfree(i_id_p); count = tmp_count; i_count -= tmp_count; } else count = 0; #if defined(CONFIG_RSBAC_MAC) copy_new_uids(user_handles.mac, ta_number, &count, &i_count, *id_pp); #endif #if defined(CONFIG_RSBAC_PM) copy_new_uids(user_handles.pm, ta_number, &count, &i_count, *id_pp); #endif #if defined(CONFIG_RSBAC_DAZ) copy_new_uids(user_handles.daz, ta_number, &count, &i_count, *id_pp); #endif #if defined(CONFIG_RSBAC_FF) copy_new_uids(user_handles.ff, ta_number, &count, &i_count, *id_pp); #endif #if defined(CONFIG_RSBAC_RC) copy_new_uids(user_handles.rc, ta_number, &count, &i_count, *id_pp); #endif #if defined(CONFIG_RSBAC_AUTH) copy_new_uids(user_handles.auth, ta_number, &count, &i_count, *id_pp); #endif #if defined(CONFIG_RSBAC_CAP) copy_new_uids(user_handles.cap, ta_number, &count, &i_count, *id_pp); #endif #if defined(CONFIG_RSBAC_JAIL) copy_new_uids(user_handles.jail, ta_number, &count, &i_count, *id_pp); #endif #if defined(CONFIG_RSBAC_PAX) copy_new_uids(user_handles.pax, ta_number, &count, &i_count, *id_pp); #endif #if defined(CONFIG_RSBAC_RES) copy_new_uids(user_handles.res, ta_number, &count, &i_count, *id_pp); #endif if(!count) rsbac_vfree(*id_pp); } } return count; }

int rsbac_ta_remove_target (  rsbac_list_ta_number_t  ta_number, enum rsbac_target_t  target, union rsbac_target_id_t  tid )

Definition at line 14431 of file aci_data_structures.c. References D_char, rsbac_target_id_t::dev, dev_handles, device_list_head, gen_fd_hash(), gen_p_hash(), rsbac_target_id_t::group, rsbac_target_id_t::ipc, ipc_handles, lookup_device(), rsbac_target_id_t::netdev, rsbac_target_id_t::netobj, rsbac_target_id_t::nettemp, NULL, rsbac_target_id_t::process, process_handles, rsbac_acl_remove_acl(), rsbac_auth_remove_f_capsets(), rsbac_auth_remove_p_capsets(), RSBAC_EINVALIDDEV, RSBAC_EINVALIDTARGET, RSBAC_ENOTINITIALIZED, rsbac_initialized, rsbac_mac_remove_f_trusets(), rsbac_mac_remove_p_trusets(), rsbac_mount(), rsbac_printk(), rsbac_ta_list_remove(), rsbac_net_obj_desc_t::sock_p, T_DEV, T_DIR, T_FIFO, T_FILE, T_GROUP, T_IPC, T_NETDEV, T_NETOBJ, T_NETTEMP, T_NETTEMP_NT, T_PROCESS, T_SYMLINK, T_USER, rsbac_dev_desc_t::type, rsbac_target_id_t::user, and user_handles. Referenced by rsbac_pm(), sys_rsbac_remove_target(), and sys_rsbac_remove_target_n(). { int error=0; struct rsbac_device_list_item_t * device_p; u_long dflags; if (!rsbac_initialized) { rsbac_printk(KERN_WARNING "rsbac_remove_target(): RSBAC not initialized\n"); return(-RSBAC_ENOTINITIALIZED); } if (in_interrupt()) { rsbac_printk(KERN_WARNING "rsbac_remove_target(): called from interrupt!\n"); } switch (target) { case T_FILE: case T_DIR: case T_FIFO: case T_SYMLINK: /* #ifdef CONFIG_RSBAC_DEBUG if (rsbac_debug_ds) rsbac_printk(KERN_DEBUG "%s\n", "rsbac_remove_target(): Removing file/dir/fifo/symlink ACI"); #endif */ #if defined(CONFIG_RSBAC_MAC) /* file and dir items can also have mac_f_trusets -> remove first */ if( (target == T_FILE) || (target == T_DIR) ) error = rsbac_mac_remove_f_trusets(tid.file); #endif #if defined(CONFIG_RSBAC_AUTH) /* file and dir items can also have auth_f_capsets -> remove first */ if( (target == T_FILE) || (target == T_DIR) ) error = rsbac_auth_remove_f_capsets(tid.file); #endif #if defined(CONFIG_RSBAC_ACL) /* items can also have an acl_fd_item -> remove first */ error = rsbac_acl_remove_acl(ta_number, target, tid); #endif /* wait for read access to device_list_head */ rsbac_read_lock(&device_list_head.lock, &dflags); /* OK, go on */ /* lookup device */ device_p = lookup_device(tid.file.device); if (!device_p) { struct super_block * sb_p; rsbac_read_unlock(&device_list_head.lock, &dflags); #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0) sb_p = user_get_super(tid.file.device); #else sb_p = get_super(tid.file.device); #endif if(sb_p) { rsbac_printk(KERN_INFO "rsbac_remove_target(): auto-mounting device %02u:%02u\n", RSBAC_MAJOR(tid.file.device), RSBAC_MINOR(tid.file.device)); rsbac_mount(sb_p, NULL); /* free super_block pointer */ drop_super(sb_p); rsbac_read_lock(&device_list_head.lock, &dflags); device_p = lookup_device(tid.file.device); if (!device_p) { rsbac_printk(KERN_WARNING "rsbac_remove_target(): unknown device %02u:%02u\n", RSBAC_MAJOR(tid.file.device), RSBAC_MINOR(tid.file.device)); rsbac_read_unlock(&device_list_head.lock, &dflags); return -RSBAC_EINVALIDDEV; } } else return -RSBAC_EINVALIDDEV; } rsbac_ta_list_remove(ta_number, device_p->handles.gen[gen_fd_hash(tid.file.inode)], &tid.file.inode); #if defined(CONFIG_RSBAC_MAC) rsbac_ta_list_remove(ta_number, device_p->handles.mac[mac_fd_hash(tid.file.inode)], &tid.file.inode); #endif #if defined(CONFIG_RSBAC_PM) rsbac_ta_list_remove(ta_number, device_p->handles.pm[pm_fd_hash(tid.file.inode)], &tid.file.inode); #endif #if defined(CONFIG_RSBAC_DAZ) rsbac_ta_list_remove(ta_number, device_p->handles.daz[daz_fd_hash(tid.file.inode)], &tid.file.inode); #if defined(CONFIG_RSBAC_DAZ_CACHE) rsbac_ta_list_remove(ta_number, device_p->handles.dazs[daz_scanned_fd_hash(tid.file.inode)], &tid.file.inode); #endif #endif #if defined(CONFIG_RSBAC_FF) rsbac_ta_list_remove(ta_number, device_p->handles.ff[ff_fd_hash(tid.file.inode)], &tid.file.inode); #endif #if defined(CONFIG_RSBAC_RC) rsbac_ta_list_remove(ta_number, device_p->handles.rc[rc_fd_hash(tid.file.inode)], &tid.file.inode); #endif #if defined(CONFIG_RSBAC_AUTH) rsbac_ta_list_remove(ta_number, device_p->handles.auth[auth_fd_hash(tid.file.inode)], &tid.file.inode); #endif #if defined(CONFIG_RSBAC_CAP) rsbac_ta_list_remove(ta_number, device_p->handles.cap[cap_fd_hash(tid.file.inode)], &tid.file.inode); #endif #if defined(CONFIG_RSBAC_PAX) rsbac_ta_list_remove(ta_number, device_p->handles.pax[pax_fd_hash(tid.file.inode)], &tid.file.inode); #endif #if defined(CONFIG_RSBAC_RES) rsbac_ta_list_remove(ta_number, device_p->handles.res[res_fd_hash(tid.file.inode)], &tid.file.inode); #endif /* free access to device_list_head */ rsbac_read_unlock(&device_list_head.lock, &dflags); break; case T_DEV: { if(tid.dev.type > D_char) return -RSBAC_EINVALIDTARGET; /* #ifdef CONFIG_RSBAC_DEBUG if (rsbac_debug_ds) rsbac_printk(KERN_DEBUG "%s\n", "rsbac_remove_target(): Removing dev ACI"); #endif */ rsbac_ta_list_remove(ta_number, dev_handles.gen, &tid.dev); #if defined(CONFIG_RSBAC_MAC) rsbac_ta_list_remove(ta_number, dev_handles.mac, &tid.dev); #endif #if defined(CONFIG_RSBAC_PM) rsbac_ta_list_remove(ta_number, dev_handles.pm, &tid.dev); #endif #if defined(CONFIG_RSBAC_RC) rsbac_ta_list_remove(ta_number, dev_handles.rc, &tid.dev); #endif } break; case T_IPC: /* #ifdef CONFIG_RSBAC_DEBUG if (rsbac_debug_ds) rsbac_printk(KERN_DEBUG "rsbac_remove_target(): Removing ipc ACI\n"); #endif */ #if defined(CONFIG_RSBAC_MAC) rsbac_ta_list_remove(ta_number, ipc_handles.mac, &tid.ipc); #endif #if defined(CONFIG_RSBAC_PM) rsbac_ta_list_remove(ta_number, ipc_handles.pm, &tid.ipc); #endif #if defined(CONFIG_RSBAC_RC) rsbac_ta_list_remove(ta_number, ipc_handles.rc, &tid.ipc); #endif #if defined(CONFIG_RSBAC_JAIL) rsbac_ta_list_remove(ta_number, ipc_handles.jail, &tid.ipc); #endif break; case T_USER: /* #ifdef CONFIG_RSBAC_DEBUG if (rsbac_debug_ds) rsbac_printk(KERN_DEBUG "%s\n", "rsbac_remove_target(): Removing user ACI"); #endif */ rsbac_ta_list_remove(ta_number, user_handles.gen, &tid.user); #if defined(CONFIG_RSBAC_MAC) rsbac_ta_list_remove(ta_number, user_handles.mac, &tid.user); #endif #if defined(CONFIG_RSBAC_PM) rsbac_ta_list_remove(ta_number, user_handles.pm, &tid.user); #endif #if defined(CONFIG_RSBAC_DAZ) rsbac_ta_list_remove(ta_number, user_handles.daz, &tid.user); #endif #if defined(CONFIG_RSBAC_FF) rsbac_ta_list_remove(ta_number, user_handles.ff, &tid.user); #endif #if defined(CONFIG_RSBAC_RC) rsbac_ta_list_remove(ta_number, user_handles.rc, &tid.user); #endif #if defined(CONFIG_RSBAC_AUTH) rsbac_ta_list_remove(ta_number, user_handles.auth, &tid.user); #endif #if defined(CONFIG_RSBAC_CAP) rsbac_ta_list_remove(ta_number, user_handles.cap, &tid.user); #endif #if defined(CONFIG_RSBAC_JAIL) rsbac_ta_list_remove(ta_number, user_handles.jail, &tid.user); #endif #if defined(CONFIG_RSBAC_PAX) rsbac_ta_list_remove(ta_number, user_handles.pax, &tid.user); #endif #if defined(CONFIG_RSBAC_RES) rsbac_ta_list_remove(ta_number, user_handles.res, &tid.user); #endif break; case T_PROCESS: /* too noisy... kicked out. #ifdef CONFIG_RSBAC_DEBUG if (rsbac_debug_ds) rsbac_printk(KERN_DEBUG "rsbac_remove_target(): Removing process ACI\n"); #endif */ #if defined(CONFIG_RSBAC_ACL) /* process items can also have an acl_p_item -> remove first */ error = rsbac_acl_remove_acl(ta_number, target, tid); #endif rsbac_ta_list_remove(ta_number, process_handles.gen[gen_p_hash(tid.process)], &tid.process); #if defined(CONFIG_RSBAC_MAC) /* process items can also have mac_p_trusets -> remove first */ error = rsbac_mac_remove_p_trusets(tid.process); rsbac_ta_list_remove(ta_number, process_handles.mac[mac_p_hash(tid.process)], &tid.process); #endif #if defined(CONFIG_RSBAC_PM) rsbac_ta_list_remove(ta_number, process_handles.pm, &tid.process); #endif #if defined(CONFIG_RSBAC_DAZ) rsbac_ta_list_remove(ta_number, process_handles.daz, &tid.process); #endif #if defined(CONFIG_RSBAC_RC) rsbac_ta_list_remove(ta_number, process_handles.rc[rc_p_hash(tid.process)], &tid.process); #endif #if defined(CONFIG_RSBAC_AUTH) /* process items can also have auth_p_capsets -> remove first */ error = rsbac_auth_remove_p_capsets(tid.process); rsbac_ta_list_remove(ta_number, process_handles.auth, &tid.process); #endif #if defined(CONFIG_RSBAC_CAP) rsbac_ta_list_remove(ta_number, process_handles.cap, &tid.process); #endif #if defined(CONFIG_RSBAC_JAIL) rsbac_ta_list_remove(ta_number, process_handles.jail[jail_p_hash(tid.process)], &tid.process); #endif break; #ifdef CONFIG_RSBAC_UM case T_GROUP: /* #ifdef CONFIG_RSBAC_DEBUG if (rsbac_debug_ds) rsbac_printk(KERN_DEBUG "rsbac_remove_target(): Removing group ACI\n"); #endif */ #if defined(CONFIG_RSBAC_RC_UM_PROT) rsbac_ta_list_remove(ta_number, group_handles.rc, &tid.group); #endif break; #endif /* CONFIG_RSBAC_UM */ #ifdef CONFIG_RSBAC_NET_DEV case T_NETDEV: #if defined(CONFIG_RSBAC_IND_NETDEV_LOG) rsbac_ta_list_remove(ta_number, netdev_handles.gen, &tid.netdev); #endif #if defined(CONFIG_RSBAC_RC) rsbac_ta_list_remove(ta_number, netdev_handles.rc, &tid.netdev); #endif break; #endif #ifdef CONFIG_RSBAC_NET_OBJ case T_NETTEMP: /* too noisy... kicked out. #ifdef CONFIG_RSBAC_DEBUG if (rsbac_debug_ds) rsbac_printk(KERN_DEBUG "rsbac_remove_target(): Removing nettemp ACI\n"); #endif */ #if defined(CONFIG_RSBAC_IND_NETOBJ_LOG) rsbac_ta_list_remove(ta_number, nettemp_handles.gen, &tid.nettemp); #endif #if defined(CONFIG_RSBAC_MAC) rsbac_ta_list_remove(ta_number, nettemp_handles.mac, &tid.nettemp); #endif #if defined(CONFIG_RSBAC_PM) rsbac_ta_list_remove(ta_number, nettemp_handles.pm, &tid.nettemp); #endif #if defined(CONFIG_RSBAC_RC) rsbac_ta_list_remove(ta_number, nettemp_handles.rc, &tid.nettemp); #endif #if defined(CONFIG_RSBAC_ACL_NET_OBJ_PROT) rsbac_acl_remove_acl(ta_number, T_NETTEMP_NT, tid); rsbac_acl_remove_acl(ta_number, T_NETTEMP, tid); #endif break; case T_NETOBJ: /* too noisy... kicked out. #ifdef CONFIG_RSBAC_DEBUG if (rsbac_debug_ds) rsbac_printk(KERN_DEBUG "rsbac_remove_target(): Removing netobj ACI\n"); #endif */ #if defined(CONFIG_RSBAC_MAC) rsbac_ta_list_remove(ta_number, lnetobj_handles.mac, &tid.netobj.sock_p); rsbac_ta_list_remove(ta_number, rnetobj_handles.mac, &tid.netobj.sock_p); #endif #if defined(CONFIG_RSBAC_PM) rsbac_ta_list_remove(ta_number, lnetobj_handles.pm, &tid.netobj.sock_p); rsbac_ta_list_remove(ta_number, rnetobj_handles.pm, &tid.netobj.sock_p); #endif #if defined(CONFIG_RSBAC_RC) rsbac_ta_list_remove(ta_number, lnetobj_handles.rc, &tid.netobj.sock_p); rsbac_ta_list_remove(ta_number, rnetobj_handles.rc, &tid.netobj.sock_p); #endif break; #endif /* NET_OBJ */ default: return(-RSBAC_EINVALIDTARGET); } #ifdef CONFIG_RSBAC_XSTATS remove_count[target]++; #endif return(error); } /* end of rsbac_remove_target() */

int rsbac_ta_set_attr (  rsbac_list_ta_number_t  ta_number, enum rsbac_switch_target_t  module, enum rsbac_target_t  target, union rsbac_target_id_t  tid, enum rsbac_attribute_t  attr, union rsbac_attribute_value_t  value )

Definition at line 14348 of file aci_data_structures.c. References rsbac_target_id_t::dev, RSBAC_EINVALIDTARGET, RSBAC_ENOTINITIALIZED, rsbac_initialized, rsbac_printk(), set_attr_dev(), set_attr_fd(), set_attr_ipc(), set_attr_process(), set_attr_user(), T_DEV, T_DIR, T_FIFO, T_FILE, T_GROUP, T_IPC, T_NETDEV, T_NETOBJ, T_NETTEMP, T_PROCESS, T_SYMLINK, and T_USER. Referenced by rsbac_pm(), sys_rsbac_set_attr(), and sys_rsbac_set_attr_n(). { int err = 0; /* #ifdef CONFIG_RSBAC_DEBUG char tmp[RSBAC_MAXNAMELEN]; #endif */ if (!rsbac_initialized) { rsbac_printk(KERN_WARNING "rsbac_set_attr(): RSBAC not initialized\n"); return(-RSBAC_ENOTINITIALIZED); } if (in_interrupt()) { rsbac_printk(KERN_WARNING "rsbac_set_attr(): called from interrupt!\n"); } switch (target) { case T_FILE: case T_DIR: case T_FIFO: case T_SYMLINK: err = set_attr_fd(ta_number, module, target, &tid, attr, &value); break; case T_DEV: err = set_attr_dev(ta_number, module, target, tid.dev, attr, &value); break; case T_IPC: err = set_attr_ipc(ta_number, module, target, &tid, attr, &value); break; case T_USER: err = set_attr_user(ta_number, module, target, &tid, attr, &value); break; case T_PROCESS: err = set_attr_process(ta_number, module, target, &tid, attr, &value); break; #ifdef CONFIG_RSBAC_UM case T_GROUP: err = set_attr_group(ta_number, module, target, &tid, attr, &value); break; #endif /* CONFIG_RSBAC_UM */ #ifdef CONFIG_RSBAC_NET_DEV case T_NETDEV: err = set_attr_netdev(ta_number, module, target, &tid, attr, &value); break; #endif #ifdef CONFIG_RSBAC_NET_OBJ case T_NETTEMP: err = set_attr_nettemp(ta_number, module, target, &tid, attr, &value); break; case T_NETOBJ: err = set_attr_netobj(ta_number, module, target, &tid, attr, &value); break; #endif /* NET_OBJ */ /* switch(target): no valid target */ default: return(-RSBAC_EINVALIDTARGET); } #ifdef CONFIG_RSBAC_XSTATS if(!err) set_attr_count[target]++; #endif return(err); } /* end of rsbac_set_attr() */

int rsbac_umount (  struct super_block *  sb_p, struct dentry *  d_covers )

Definition at line 8559 of file aci_data_structures.c. References device_list_head, lookup_device(), NULL, remove_device_item(), rsbac_debug_no_write, RSBAC_EINVALIDPOINTER, RSBAC_ENOTINITIALIZED, rsbac_initialized, rsbac_list_umount(), rsbac_printk(), rsbac_umount_acl(), rsbac_umount_auth(), rsbac_umount_mac(), rsbac_umount_reg(), rsbac_write(), rsbac_write_sem, sysfs_covered_p, SYSFS_MAGIC, sysfs_sb_p, and TRUE. Referenced by rsbac_aef_sb_umount(). { u_long flags; struct rsbac_device_list_item_t * device_p; kdev_t kdev; if(!sb_p) { rsbac_printk(KERN_WARNING "rsbac_umount(): called with NULL pointer\n"); return -RSBAC_EINVALIDPOINTER; } if (!rsbac_initialized) { rsbac_printk(KERN_WARNING "rsbac_umount(): RSBAC not initialized\n"); #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0) if( (sb_p->s_magic == SYSFS_MAGIC) && !RSBAC_MAJOR(sb_p->s_dev) && sysfs_sb_p && sysfs_covered_p ) { rsbac_printk(KERN_WARNING "rsbac_umount(): sysfs umount detected, removing auto-mount values\n"); sysfs_sb_p = NULL; sysfs_covered_p = NULL; } #endif #ifdef CONFIG_DEVFS_MOUNT if( (sb_p->s_magic == DEVFS_SUPER_MAGIC) && !RSBAC_MAJOR(sb_p->s_dev) && devfs_sb_p && devfs_covered_p ) { rsbac_printk(KERN_WARNING "rsbac_umount(): devfs umount detected, removing auto-mount values\n"); devfs_sb_p = NULL; devfs_covered_p = NULL; } #endif return(-RSBAC_ENOTINITIALIZED); } #ifdef CONFIG_RSBAC_DEBUG if (rsbac_debug_ds) { rsbac_printk(KERN_DEBUG "rsbac_umount(): umounting device %02u:%02u\n", MAJOR(sb_p->s_dev), MINOR(sb_p->s_dev)); } #endif kdev = sb_p->s_dev; /* sync attribute lists */ #if defined(CONFIG_RSBAC_AUTO_WRITE) if(!rsbac_debug_no_write) { down(&rsbac_write_sem); /* recheck no_write with lock - might have been set in between */ if(!rsbac_debug_no_write) { rsbac_write(TRUE); } up(&rsbac_write_sem); } #endif /* CONFIG_RSBAC_AUTO_WRITE */ /* call other umount functions */ /****** MAC *******/ #if defined(CONFIG_RSBAC_MAC) rsbac_umount_mac(kdev); #endif /****** AUTH *******/ #if defined(CONFIG_RSBAC_AUTH) rsbac_umount_auth(kdev); #endif /****** ACL *******/ #if defined(CONFIG_RSBAC_ACL) rsbac_umount_acl(kdev); #endif /****** REG *******/ #if defined(CONFIG_RSBAC_REG) rsbac_umount_reg(kdev); #endif /* REG */ /* wait for write access to device_list_head */ rsbac_write_lock(&device_list_head.lock, &flags); /* OK, nobody else is working on it... */ device_p = lookup_device(kdev); if(device_p) { if(device_p->mount_count == 1) { /* Generic lists */ rsbac_list_umount(kdev); remove_device_item(kdev); } else { if(device_p->mount_count > 1) { device_p->mount_count--; if(device_p->d_covers == d_covers) { rsbac_printk(KERN_WARNING "rsbac_umount: removed primary mount for device %02u:%02u, inheritance broken!\n", RSBAC_MAJOR(kdev), RSBAC_MINOR(kdev)); device_p->d_covers = NULL; } } else { rsbac_printk(KERN_WARNING "rsbac_umount: device %02u:%02u has mount_count < 1!\n", RSBAC_MAJOR(kdev), RSBAC_MINOR(kdev)); } } } /* allow access */ rsbac_write_unlock(&device_list_head.lock, &flags); return(0); }

---