00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
#include <linux/string.h>
00013
#include <rsbac/types.h>
00014
#include <rsbac/aci.h>
00015
#include <rsbac/adf_main.h>
00016
#include <rsbac/error.h>
00017
#include <rsbac/helpers.h>
00018
#include <rsbac/getname.h>
00019
00020
00021
00022
00023
00024
00025
00026
00027
00028
enum rsbac_adf_req_ret_t
00029 rsbac_adf_request_check (
enum rsbac_adf_request_t request,
00030
rsbac_pid_t caller_pid,
00031
enum rsbac_target_t target,
00032
union rsbac_target_id_t tid,
00033
enum rsbac_attribute_t attr,
00034
union rsbac_attribute_value_t attr_val,
00035
rsbac_uid_t owner)
00036 {
00037
switch (request)
00038 {
00039
case R_ADD_TO_KERNEL:
00040
switch(target)
00041 {
00042
case T_NONE:
00043
return(
DO_NOT_CARE);
00044
default:
return(
UNDEFINED);
00045 }
00046
00047
case R_ALTER:
00048
00049
if (target ==
T_IPC)
00050
return(
DO_NOT_CARE);
00051
else
00052
00053
return (
UNDEFINED);
00054
break;
00055
00056
case R_APPEND_OPEN:
00057
switch(target)
00058 {
00059
case T_FILE:
00060
case T_FIFO:
00061
case T_IPC:
00062
case T_DEV:
00063
return(
DO_NOT_CARE);
00064
00065
default:
return(
UNDEFINED);
00066 }
00067
00068
case R_CHANGE_GROUP:
00069
switch(target)
00070 {
00071
case T_FILE:
00072
case T_DIR:
00073
case T_FIFO:
00074
case T_SYMLINK:
00075
case T_IPC:
00076
case T_PROCESS:
00077
case T_NONE:
00078
return(
DO_NOT_CARE);
00079
00080
default:
return(
UNDEFINED);
00081 }
00082
00083
case R_CHANGE_OWNER:
00084
switch(target)
00085 {
00086
case T_FILE:
00087
case T_DIR:
00088
case T_FIFO:
00089
case T_SYMLINK:
00090
case T_IPC:
00091
return(
DO_NOT_CARE);
00092
case T_PROCESS:
00093
00094
if(attr == A_owner)
00095
return(
DO_NOT_CARE);
00096
00097
00098
default:
00099
return(
UNDEFINED);
00100 }
00101
00102
#ifdef CONFIG_RSBAC_DAC_OWNER
00103
case R_CHANGE_DAC_EFF_OWNER:
00104
case R_CHANGE_DAC_FS_OWNER:
00105
switch(target)
00106 {
00107
case T_PROCESS:
00108
00109
if(attr == A_owner)
00110
return(
DO_NOT_CARE);
00111
00112
00113
default:
00114
return(
UNDEFINED);
00115 }
00116
#endif
00117
00118
case R_CHDIR:
00119
switch(target)
00120 {
00121
case T_DIR:
00122
return(
DO_NOT_CARE);
00123
00124
default:
return(
UNDEFINED);
00125 }
00126
00127
case R_CLONE:
00128
if (target ==
T_PROCESS)
00129
return(
DO_NOT_CARE);
00130
else
00131
return(
UNDEFINED);
00132
00133
case R_CLOSE:
00134
switch(target)
00135 {
00136
case T_FILE:
00137
case T_DIR:
00138
case T_FIFO:
00139
case T_DEV:
00140
case T_IPC:
00141
#if defined(CONFIG_RSBAC_NET_OBJ)
00142
case T_NETOBJ:
00143
#endif
00144
return(
DO_NOT_CARE);
00145
default:
00146
return(
UNDEFINED);
00147 };
00148
00149
case R_CREATE:
00150
switch(target)
00151 {
00152
00153
case T_DIR:
00154
case T_IPC:
00155
#if defined(CONFIG_RSBAC_NET_OBJ)
00156
case T_NETTEMP:
00157
case T_NETOBJ:
00158
#endif
00159
return(
DO_NOT_CARE);
00160
00161
default:
return(
UNDEFINED);
00162 }
00163
00164
case R_DELETE:
00165
switch(target)
00166 {
00167
case T_FILE:
00168
case T_DIR:
00169
case T_FIFO:
00170
case T_SYMLINK:
00171
case T_IPC:
00172
#if defined(CONFIG_RSBAC_NET_OBJ)
00173
case T_NETTEMP:
00174
case T_NETOBJ:
00175
#endif
00176
return(
DO_NOT_CARE);
00177
default:
return(
UNDEFINED);
00178 }
00179
00180
case R_EXECUTE:
00181
switch(target)
00182 {
00183
case T_FILE:
00184
return(
DO_NOT_CARE);
00185
00186
default:
00187
return(
UNDEFINED);
00188 }
00189
00190
case R_GET_PERMISSIONS_DATA:
00191
switch(target)
00192 {
00193
case T_FILE:
00194
case T_DIR:
00195
case T_FIFO:
00196
case T_SYMLINK:
00197
case T_IPC:
00198
case T_SCD:
00199
return(
DO_NOT_CARE);
00200
default:
00201
return(
UNDEFINED);
00202 };
00203
00204
case R_GET_STATUS_DATA:
00205
switch(target)
00206 {
00207
case T_FILE:
00208
case T_DIR:
00209
case T_FIFO:
00210
case T_SYMLINK:
00211
case T_DEV:
00212
case T_IPC:
00213
case T_SCD:
00214
case T_PROCESS:
00215
case T_NETDEV:
00216
return(
DO_NOT_CARE);
00217
default:
00218
return(
UNDEFINED);
00219 };
00220
00221
case R_LINK_HARD:
00222
switch(target)
00223 {
00224
case T_FILE:
00225
case T_FIFO:
00226
case T_SYMLINK:
00227
return(
DO_NOT_CARE);
00228
00229
default:
return(
UNDEFINED);
00230 }
00231
00232
case R_MODIFY_ACCESS_DATA:
00233
case R_RENAME:
00234
switch(target)
00235 {
00236
case T_FILE:
00237
case T_DIR:
00238
case T_FIFO:
00239
case T_SYMLINK:
00240
return(
DO_NOT_CARE);
00241
00242
default:
return(
UNDEFINED);
00243 }
00244
00245
case R_MODIFY_ATTRIBUTE:
00246
return(
DO_NOT_CARE);
00247
00248
case R_MODIFY_PERMISSIONS_DATA:
00249
switch(target)
00250 {
00251
case T_FILE:
00252
case T_DIR:
00253
case T_FIFO:
00254
case T_SYMLINK:
00255
case T_IPC:
00256
case T_SCD:
00257
#ifdef CONFIG_RSBAC_ALLOW_DAC_DISABLE
00258
case T_NONE:
00259
#endif
00260
return(
DO_NOT_CARE);
00261
00262
default:
return(
UNDEFINED);
00263 }
00264
00265
case R_MODIFY_SYSTEM_DATA:
00266
switch(target)
00267 {
00268
case T_SCD:
00269
case T_NETDEV:
00270
case T_PROCESS:
00271
return(
DO_NOT_CARE);
00272
00273
default:
return(
UNDEFINED);
00274 }
00275
00276
case R_MOUNT:
00277
switch(target)
00278 {
00279
case T_FILE:
00280
case T_DIR:
00281
case T_DEV:
00282
return(
DO_NOT_CARE);
00283
00284
default:
return(
UNDEFINED);
00285 }
00286
00287
case R_READ:
00288
switch(target)
00289 {
00290
case T_DIR:
00291
#ifdef CONFIG_RSBAC_RW
00292
case T_FILE:
00293
case T_FIFO:
00294
case T_DEV:
00295
#endif
00296
#if defined(CONFIG_RSBAC_MS_SOCK)
00297
case T_IPC:
00298
#endif
00299
#if defined(CONFIG_RSBAC_NET_OBJ)
00300
case T_NETTEMP:
00301
#endif
00302
#if defined(CONFIG_RSBAC_NET_OBJ_RW) || defined(CONFIG_RSBAC_MS_SOCK)
00303
case T_NETOBJ:
00304
#endif
00305
return(
DO_NOT_CARE);
00306
00307
default:
return(
UNDEFINED);
00308 }
00309
00310
case R_READ_ATTRIBUTE:
00311
return(
DO_NOT_CARE);
00312
00313
case R_READ_OPEN:
00314
switch(target)
00315 {
00316
case T_FILE:
00317
case T_FIFO:
00318
case T_IPC:
00319
case T_DEV:
00320
return(
DO_NOT_CARE);
00321
00322
default:
return(
UNDEFINED);
00323 }
00324
00325
case R_READ_WRITE_OPEN:
00326
switch(target)
00327 {
00328
case T_FILE:
00329
case T_FIFO:
00330
case T_IPC:
00331
case T_DEV:
00332
return(
DO_NOT_CARE);
00333
00334
default:
return(
UNDEFINED);
00335 }
00336
00337
case R_REMOVE_FROM_KERNEL:
00338
switch(target)
00339 {
00340
case T_NONE:
00341
return(
DO_NOT_CARE);
00342
00343
default:
return(
UNDEFINED);
00344 }
00345
00346
00347
00348
case R_SEARCH:
00349
switch(target)
00350 {
00351
case T_DIR:
00352
case T_SYMLINK:
00353
return(
DO_NOT_CARE);
00354
00355
default:
return(
UNDEFINED);
00356 }
00357
00358
case R_SEND_SIGNAL:
00359
switch(target)
00360 {
00361
case T_PROCESS:
00362
return(
DO_NOT_CARE);
00363
00364
default:
00365
return(
UNDEFINED);
00366 }
00367
00368
case R_SHUTDOWN:
00369
switch(target)
00370 {
00371
case T_NONE:
00372
return(
DO_NOT_CARE);
00373
00374
default:
return(
UNDEFINED);
00375 }
00376
00377
00378
case R_SWITCH_LOG:
00379
switch(target)
00380 {
00381
case T_NONE:
00382
return(
DO_NOT_CARE);
00383
00384
default:
return(
UNDEFINED);
00385 }
00386
00387
case R_SWITCH_MODULE:
00388
switch(target)
00389 {
00390
case T_NONE:
00391
00392
if(attr == A_switch_target)
00393
return(
DO_NOT_CARE);
00394
00395
00396
default:
return(
UNDEFINED);
00397 }
00398
00399
00400
case R_TERMINATE:
00401
if (target ==
T_PROCESS)
00402
return(
DO_NOT_CARE);
00403
else
00404
return(
UNDEFINED);
00405
00406
case R_TRACE:
00407
switch(target)
00408 {
00409
case T_PROCESS:
00410
return(
DO_NOT_CARE);
00411
00412
default:
00413
return(
UNDEFINED);
00414 }
00415
00416
case R_TRUNCATE:
00417
switch(target)
00418 {
00419
case T_FILE:
00420
return(
DO_NOT_CARE);
00421
00422
default:
return(
UNDEFINED);
00423 }
00424
00425
case R_UMOUNT:
00426
switch(target)
00427 {
00428
case T_FILE:
00429
case T_DIR:
00430
case T_DEV:
00431
return(
DO_NOT_CARE);
00432
00433
default:
return(
UNDEFINED);
00434 }
00435
00436
00437
case R_WRITE:
00438
switch(target)
00439 {
00440
case T_DIR:
00441
case T_SCD:
00442
#ifdef CONFIG_RSBAC_RW
00443
case T_FILE:
00444
case T_FIFO:
00445
case T_DEV:
00446
#endif
00447
#if defined(CONFIG_RSBAC_NET_OBJ)
00448
case T_NETTEMP:
00449
#endif
00450
#if defined(CONFIG_RSBAC_NET_OBJ_RW)
00451
case T_NETOBJ:
00452
#endif
00453
return(
DO_NOT_CARE);
00454
00455
default:
return(
UNDEFINED);
00456 }
00457
00458
case R_WRITE_OPEN:
00459
switch(target)
00460 {
00461
case T_FILE:
00462
case T_FIFO:
00463
case T_DEV:
00464
case T_IPC:
00465
return(
DO_NOT_CARE);
00466
00467
default:
return(
UNDEFINED);
00468 }
00469
00470
case R_MAP_EXEC:
00471
switch(target)
00472 {
00473
case T_FILE:
00474
case T_NONE:
00475
return(
DO_NOT_CARE);
00476
00477
default:
00478
return(
UNDEFINED);
00479 }
00480
00481
00482
#if defined(CONFIG_RSBAC_NET)
00483
case R_BIND:
00484
switch(target)
00485 {
00486
#if defined(CONFIG_RSBAC_NET_DEV)
00487
case T_NETDEV:
00488
return(
DO_NOT_CARE);
00489
#endif
00490
#if defined(CONFIG_RSBAC_NET_OBJ)
00491
case T_NETOBJ:
00492
return(
DO_NOT_CARE);
00493
#endif
00494
00495
default:
return(
UNDEFINED);
00496 }
00497
#endif
00498
00499
#if defined(CONFIG_RSBAC_NET_OBJ)
00500
case R_LISTEN:
00501
case R_ACCEPT:
00502
case R_CONNECT:
00503
case R_SEND:
00504
case R_RECEIVE:
00505
case R_NET_SHUTDOWN:
00506
switch(target)
00507 {
00508
case T_NETOBJ:
00509
return(
DO_NOT_CARE);
00510
00511
default:
return(
UNDEFINED);
00512 }
00513
#endif
00514
00515
00516
default:
return UNDEFINED;
00517 }
00518
00519
return(
UNDEFINED);
00520 };
00521
00522
00523
00524
00525
00526
00527
00528
00529
00530
00531
00532
00533
00534 int rsbac_adf_set_attr_check(
00535
enum rsbac_adf_request_t request,
00536
rsbac_pid_t caller_pid,
00537
enum rsbac_target_t target,
00538
union rsbac_target_id_t tid,
00539
enum rsbac_target_t new_target,
00540
union rsbac_target_id_t new_tid,
00541
enum rsbac_attribute_t attr,
00542
union rsbac_attribute_value_t attr_val,
00543
rsbac_uid_t owner)
00544 {
00545
switch (request)
00546 {
00547
case R_APPEND_OPEN:
00548
switch(target)
00549 {
00550
case T_FILE:
00551
case T_FIFO:
00552
case T_IPC:
00553
case T_DEV:
00554
return(0);
00555
00556
default:
return(-
RSBAC_EINVALIDTARGET);
00557 }
00558
00559
case R_CHANGE_OWNER:
00560
switch(target)
00561 {
00562
00563
00564
case T_PROCESS:
00565
00566
if(attr != A_owner)
00567
return(-
RSBAC_EINVALIDATTR);
00568
00569
case T_FILE:
00570
case T_DIR:
00571
case T_FIFO:
00572
case T_SYMLINK:
00573
case T_IPC:
00574
case T_NONE:
00575
return(0);
00576
00577
default:
00578
return(-
RSBAC_EINVALIDTARGET);
00579 }
00580
00581
#ifdef CONFIG_RSBAC_DAC_OWNER
00582
case R_CHANGE_DAC_EFF_OWNER:
00583
case R_CHANGE_DAC_FS_OWNER:
00584
switch(target)
00585 {
00586
00587
00588
case T_PROCESS:
00589
00590
if(attr != A_owner)
00591
return(-
RSBAC_EINVALIDATTR);
00592
return(0);
00593
00594
default:
00595
return(-
RSBAC_EINVALIDTARGET);
00596 }
00597
#endif
00598
00599
case R_CHDIR:
00600
switch(target)
00601 {
00602
case T_DIR:
00603
return(0);
00604
default:
00605
return(-
RSBAC_EINVALIDTARGET);
00606 };
00607
00608
case R_CLONE:
00609
if (target ==
T_PROCESS)
00610
return(0);
00611
else
00612
return(-
RSBAC_EINVALIDTARGET);
00613
00614
case R_CLOSE:
00615
switch(target)
00616 {
00617
case T_FILE:
00618
case T_DIR:
00619
case T_FIFO:
00620
case T_DEV:
00621
case T_IPC:
00622
#if defined(CONFIG_RSBAC_NET_OBJ)
00623
case T_NETOBJ:
00624
#endif
00625
return(0);
00626
default:
00627
return(-
RSBAC_EINVALIDTARGET);
00628 };
00629
00630
case R_CREATE:
00631
switch(target)
00632 {
00633
00634
case T_DIR:
00635
case T_IPC:
00636
#if defined(CONFIG_RSBAC_NET_OBJ)
00637
case T_NETOBJ:
00638
#endif
00639
return(0);
00640
00641
default:
00642
return(-
RSBAC_EINVALIDTARGET);
00643 }
00644
00645
00646
case R_DELETE:
00647
switch(target)
00648 {
00649
case T_FILE:
00650
case T_DIR:
00651
case T_FIFO:
00652
case T_SYMLINK:
00653
case T_IPC:
00654
return(0);
00655
00656
default:
00657
return(-
RSBAC_EINVALIDTARGET);
00658 }
00659
00660
case R_EXECUTE:
00661
switch(target)
00662 {
00663
case T_FILE:
00664
return(0);
00665
00666
default:
00667
return(-
RSBAC_EINVALIDTARGET);
00668 }
00669
00670
case R_MOUNT:
00671
switch(target)
00672 {
00673
case T_DIR:
00674
return(0);
00675
00676
default:
00677
return(-
RSBAC_EINVALIDTARGET);
00678 }
00679
00680
case R_READ:
00681
switch(target)
00682 {
00683
case T_DIR:
00684
#ifdef CONFIG_RSBAC_RW
00685
case T_FILE:
00686
case T_FIFO:
00687
case T_DEV:
00688
#endif
00689
#if defined(CONFIG_RSBAC_NET_OBJ_RW) || defined(CONFIG_RSBAC_MS_SOCK)
00690
case T_NETOBJ:
00691
#endif
00692
return(0);
00693
00694
default:
00695
return(-
RSBAC_EINVALIDTARGET);
00696 }
00697
00698
case R_READ_OPEN:
00699
switch(target)
00700 {
00701
case T_FILE:
00702
case T_DIR:
00703
case T_FIFO:
00704
case T_IPC:
00705
case T_DEV:
00706
return(0);
00707
00708
default:
00709
return(-
RSBAC_EINVALIDTARGET);
00710 }
00711
00712
case R_READ_WRITE_OPEN:
00713
switch(target)
00714 {
00715
case T_FILE:
00716
case T_FIFO:
00717
case T_IPC:
00718
case T_DEV:
00719
return(0);
00720
00721
default:
00722
return(-
RSBAC_EINVALIDTARGET);
00723 }
00724
00725
case R_SEARCH:
00726
switch(target)
00727 {
00728
case T_DIR:
00729
return(0);
00730
00731
default:
00732
return(-
RSBAC_EINVALIDTARGET);
00733 }
00734
00735
#if defined(CONFIG_RSBAC_NET_OBJ)
00736
case R_SHUTDOWN:
00737
switch(target)
00738 {
00739
case T_NETOBJ:
00740
return 0;
00741
00742
default:
00743
return(-
RSBAC_EINVALIDTARGET);
00744 }
00745
#endif
00746
00747
case R_TRACE:
00748
switch(target)
00749 {
00750
case T_PROCESS:
00751
return(0);
00752
00753
default:
00754
return(-
RSBAC_EINVALIDTARGET);
00755 }
00756
00757
case R_TRUNCATE:
00758
switch(target)
00759 {
00760
case T_FILE:
00761
return(0);
00762
00763
default:
00764
return(-
RSBAC_EINVALIDTARGET);
00765 }
00766
00767
#ifdef CONFIG_RSBAC_RW
00768
case R_WRITE:
00769
switch(target)
00770 {
00771
case T_FILE:
00772
case T_FIFO:
00773
case T_DEV:
00774
#if defined(CONFIG_RSBAC_NET_OBJ_RW)
00775
case T_NETOBJ:
00776
#endif
00777
return(0);
00778
00779
default:
00780
return(-
RSBAC_EINVALIDTARGET);
00781 }
00782
#endif
00783
00784
case R_WRITE_OPEN:
00785
switch(target)
00786 {
00787
case T_FILE:
00788
case T_FIFO:
00789
case T_DEV:
00790
case T_IPC:
00791
return(0);
00792
00793
default:
00794
return(-
RSBAC_EINVALIDTARGET);
00795 }
00796
00797
case R_MAP_EXEC:
00798
switch(target)
00799 {
00800
case T_FILE:
00801
case T_NONE:
00802
return(0);
00803
00804
default:
00805
return(-
RSBAC_EINVALIDTARGET);
00806 }
00807
00808
00809
#if defined(CONFIG_RSBAC_NET_OBJ)
00810
case R_BIND:
00811
case R_LISTEN:
00812
case R_ACCEPT:
00813
case R_CONNECT:
00814
case R_SEND:
00815
case R_RECEIVE:
00816
case R_NET_SHUTDOWN:
00817
switch(target)
00818 {
00819
case T_NETOBJ:
00820
return 0;
00821
00822
default:
00823
return(-
RSBAC_EINVALIDTARGET);
00824 }
00825
#endif
00826
00827
00828
default:
00829
return(-
RSBAC_EINVALIDTARGET);
00830 }
00831
00832
return(-
RSBAC_EINVALIDTARGET);
00833 };
00834
00835