00001
00002
00003
00004
00005
00006
00007
00008
00009
00010 #ifndef __RSBAC_ADF_MAIN_H
00011 #define __RSBAC_ADF_MAIN_H
00012
00013 #include <linux/sched.h>
00014 #include <rsbac/types.h>
00015
00016 #if defined(CONFIG_RSBAC_REG) || defined(CONFIG_RSBAC_REG_MAINT)
00017 #include <rsbac/reg.h>
00018 #endif
00019
00020 #ifdef CONFIG_RSBAC_SECDEL
00021 #include <linux/dcache.h>
00022 #endif
00023
00024
00025
00026
00027
00028 extern u_long rsbac_adf_request_count[T_NONE+1];
00029 extern u_long rsbac_adf_set_attr_count[T_NONE+1];
00030 #ifdef CONFIG_RSBAC_XSTATS
00031 extern u_long rsbac_adf_request_xcount[T_NONE+1][R_NONE];
00032 extern u_long rsbac_adf_set_attr_xcount[T_NONE+1][R_NONE];
00033 #endif
00034
00035
00036
00037 #ifdef CONFIG_RSBAC_MAC
00038 #define RSBAC_MAC_REQUEST_VECTOR (\
00039 ((rsbac_request_vector_t) 1 << R_ADD_TO_KERNEL) | \
00040 ((rsbac_request_vector_t) 1 << R_ALTER) | \
00041 ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00042 ((rsbac_request_vector_t) 1 << R_CHANGE_GROUP) | \
00043 ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00044 ((rsbac_request_vector_t) 1 << R_CHDIR) | \
00045 ((rsbac_request_vector_t) 1 << R_CLOSE) | \
00046 ((rsbac_request_vector_t) 1 << R_CREATE) | \
00047 ((rsbac_request_vector_t) 1 << R_DELETE) | \
00048 ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
00049 ((rsbac_request_vector_t) 1 << R_GET_PERMISSIONS_DATA) | \
00050 ((rsbac_request_vector_t) 1 << R_GET_STATUS_DATA) | \
00051 ((rsbac_request_vector_t) 1 << R_LINK_HARD) | \
00052 ((rsbac_request_vector_t) 1 << R_MODIFY_ACCESS_DATA) | \
00053 ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00054 ((rsbac_request_vector_t) 1 << R_MODIFY_PERMISSIONS_DATA) | \
00055 ((rsbac_request_vector_t) 1 << R_MODIFY_SYSTEM_DATA) | \
00056 ((rsbac_request_vector_t) 1 << R_MOUNT) | \
00057 ((rsbac_request_vector_t) 1 << R_READ) | \
00058 ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00059 ((rsbac_request_vector_t) 1 << R_READ_OPEN) | \
00060 ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00061 ((rsbac_request_vector_t) 1 << R_REMOVE_FROM_KERNEL) | \
00062 ((rsbac_request_vector_t) 1 << R_RENAME) | \
00063 ((rsbac_request_vector_t) 1 << R_SEARCH) | \
00064 ((rsbac_request_vector_t) 1 << R_SEND_SIGNAL) | \
00065 ((rsbac_request_vector_t) 1 << R_SHUTDOWN) | \
00066 ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00067 ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) | \
00068 ((rsbac_request_vector_t) 1 << R_TRACE) | \
00069 ((rsbac_request_vector_t) 1 << R_TRUNCATE) | \
00070 ((rsbac_request_vector_t) 1 << R_UMOUNT) | \
00071 ((rsbac_request_vector_t) 1 << R_WRITE) | \
00072 ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) | \
00073 ((rsbac_request_vector_t) 1 << R_MAP_EXEC) | \
00074 ((rsbac_request_vector_t) 1 << R_BIND) | \
00075 ((rsbac_request_vector_t) 1 << R_LISTEN) | \
00076 ((rsbac_request_vector_t) 1 << R_ACCEPT) | \
00077 ((rsbac_request_vector_t) 1 << R_CONNECT) | \
00078 ((rsbac_request_vector_t) 1 << R_SEND) | \
00079 ((rsbac_request_vector_t) 1 << R_RECEIVE) \
00080 )
00081 #define RSBAC_MAC_SET_ATTR_VECTOR (\
00082 ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00083 ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00084 ((rsbac_request_vector_t) 1 << R_CLONE) | \
00085 ((rsbac_request_vector_t) 1 << R_CREATE) | \
00086 ((rsbac_request_vector_t) 1 << R_DELETE) | \
00087 ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
00088 ((rsbac_request_vector_t) 1 << R_MOUNT) | \
00089 ((rsbac_request_vector_t) 1 << R_READ) | \
00090 ((rsbac_request_vector_t) 1 << R_READ_OPEN) | \
00091 ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00092 ((rsbac_request_vector_t) 1 << R_SEARCH) | \
00093 ((rsbac_request_vector_t) 1 << R_TRACE) | \
00094 ((rsbac_request_vector_t) 1 << R_WRITE) | \
00095 ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) | \
00096 ((rsbac_request_vector_t) 1 << R_BIND) | \
00097 ((rsbac_request_vector_t) 1 << R_LISTEN) | \
00098 ((rsbac_request_vector_t) 1 << R_ACCEPT) | \
00099 ((rsbac_request_vector_t) 1 << R_CONNECT) | \
00100 ((rsbac_request_vector_t) 1 << R_SEND) | \
00101 ((rsbac_request_vector_t) 1 << R_RECEIVE) \
00102 )
00103 #endif
00104
00105 #ifdef CONFIG_RSBAC_PM
00106 #define RSBAC_PM_REQUEST_VECTOR (\
00107 ((rsbac_request_vector_t) 1 << R_ADD_TO_KERNEL) | \
00108 ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00109 ((rsbac_request_vector_t) 1 << R_CHANGE_GROUP) | \
00110 ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00111 ((rsbac_request_vector_t) 1 << R_CLONE) | \
00112 ((rsbac_request_vector_t) 1 << R_CLOSE) | \
00113 ((rsbac_request_vector_t) 1 << R_CREATE) | \
00114 ((rsbac_request_vector_t) 1 << R_DELETE) | \
00115 ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
00116 ((rsbac_request_vector_t) 1 << R_LINK_HARD) | \
00117 ((rsbac_request_vector_t) 1 << R_MODIFY_ACCESS_DATA) | \
00118 ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00119 ((rsbac_request_vector_t) 1 << R_MODIFY_PERMISSIONS_DATA) | \
00120 ((rsbac_request_vector_t) 1 << R_MODIFY_SYSTEM_DATA) | \
00121 ((rsbac_request_vector_t) 1 << R_MOUNT) | \
00122 ((rsbac_request_vector_t) 1 << R_READ) | \
00123 ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00124 ((rsbac_request_vector_t) 1 << R_READ_OPEN) | \
00125 ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00126 ((rsbac_request_vector_t) 1 << R_REMOVE_FROM_KERNEL) | \
00127 ((rsbac_request_vector_t) 1 << R_RENAME) | \
00128 ((rsbac_request_vector_t) 1 << R_SEND_SIGNAL) | \
00129 ((rsbac_request_vector_t) 1 << R_SHUTDOWN) | \
00130 ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00131 ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) | \
00132 ((rsbac_request_vector_t) 1 << R_TERMINATE) | \
00133 ((rsbac_request_vector_t) 1 << R_TRACE) | \
00134 ((rsbac_request_vector_t) 1 << R_TRUNCATE) | \
00135 ((rsbac_request_vector_t) 1 << R_UMOUNT) | \
00136 ((rsbac_request_vector_t) 1 << R_WRITE) | \
00137 ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) | \
00138 ((rsbac_request_vector_t) 1 << R_MAP_EXEC) \
00139 )
00140 #define RSBAC_PM_SET_ATTR_VECTOR (\
00141 ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00142 ((rsbac_request_vector_t) 1 << R_CLONE) | \
00143 ((rsbac_request_vector_t) 1 << R_CREATE) | \
00144 ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
00145 ((rsbac_request_vector_t) 1 << R_READ) | \
00146 ((rsbac_request_vector_t) 1 << R_READ_OPEN) | \
00147 ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00148 ((rsbac_request_vector_t) 1 << R_WRITE) | \
00149 ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) \
00150 )
00151 #endif
00152
00153 #ifdef CONFIG_RSBAC_DAZ
00154 #define RSBAC_DAZ_REQUEST_VECTOR (\
00155 ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00156 ((rsbac_request_vector_t) 1 << R_CLOSE) | \
00157 ((rsbac_request_vector_t) 1 << R_DELETE) | \
00158 ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
00159 ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00160 ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00161 ((rsbac_request_vector_t) 1 << R_READ_OPEN) | \
00162 ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00163 ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) | \
00164 ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) \
00165 )
00166 #define RSBAC_DAZ_SET_ATTR_VECTOR (\
00167 ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00168 ((rsbac_request_vector_t) 1 << R_CLONE) | \
00169 ((rsbac_request_vector_t) 1 << R_CLOSE) | \
00170 ((rsbac_request_vector_t) 1 << R_DELETE) | \
00171 ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
00172 ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00173 ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00174 ((rsbac_request_vector_t) 1 << R_READ_OPEN) | \
00175 ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00176 ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) | \
00177 ((rsbac_request_vector_t) 1 << R_WRITE) | \
00178 ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) )
00179 #endif
00180
00181 #ifdef CONFIG_RSBAC_FF
00182 #if defined(CONFIG_RSBAC_FF_UM_PROT)
00183 #define RSBAC_FF_REQUEST_VECTOR (\
00184 ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00185 ((rsbac_request_vector_t) 1 << R_CHANGE_GROUP) | \
00186 ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00187 ((rsbac_request_vector_t) 1 << R_CHDIR) | \
00188 ((rsbac_request_vector_t) 1 << R_CREATE) | \
00189 ((rsbac_request_vector_t) 1 << R_DELETE) | \
00190 ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
00191 ((rsbac_request_vector_t) 1 << R_GET_PERMISSIONS_DATA) | \
00192 ((rsbac_request_vector_t) 1 << R_GET_STATUS_DATA) | \
00193 ((rsbac_request_vector_t) 1 << R_LINK_HARD) | \
00194 ((rsbac_request_vector_t) 1 << R_MODIFY_ACCESS_DATA) | \
00195 ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00196 ((rsbac_request_vector_t) 1 << R_MODIFY_PERMISSIONS_DATA) | \
00197 ((rsbac_request_vector_t) 1 << R_MODIFY_SYSTEM_DATA) | \
00198 ((rsbac_request_vector_t) 1 << R_MOUNT) | \
00199 ((rsbac_request_vector_t) 1 << R_READ) | \
00200 ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00201 ((rsbac_request_vector_t) 1 << R_READ_OPEN) | \
00202 ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00203 ((rsbac_request_vector_t) 1 << R_RENAME) | \
00204 ((rsbac_request_vector_t) 1 << R_SEARCH) | \
00205 ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00206 ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) | \
00207 ((rsbac_request_vector_t) 1 << R_TRUNCATE) | \
00208 ((rsbac_request_vector_t) 1 << R_UMOUNT) | \
00209 ((rsbac_request_vector_t) 1 << R_WRITE) | \
00210 ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) | \
00211 ((rsbac_request_vector_t) 1 << R_MAP_EXEC) \
00212 )
00213 #else
00214 #define RSBAC_FF_REQUEST_VECTOR (\
00215 ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00216 ((rsbac_request_vector_t) 1 << R_CHANGE_GROUP) | \
00217 ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00218 ((rsbac_request_vector_t) 1 << R_CHANGE_DAC_EFF_GROUP) | \
00219 ((rsbac_request_vector_t) 1 << R_CHANGE_DAC_FS_GROUP) | \
00220 ((rsbac_request_vector_t) 1 << R_CHANGE_DAC_EFF_OWNER) | \
00221 ((rsbac_request_vector_t) 1 << R_CHANGE_DAC_FS_OWNER) | \
00222 ((rsbac_request_vector_t) 1 << R_CHDIR) | \
00223 ((rsbac_request_vector_t) 1 << R_CREATE) | \
00224 ((rsbac_request_vector_t) 1 << R_DELETE) | \
00225 ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
00226 ((rsbac_request_vector_t) 1 << R_GET_STATUS_DATA) | \
00227 ((rsbac_request_vector_t) 1 << R_LINK_HARD) | \
00228 ((rsbac_request_vector_t) 1 << R_MODIFY_ACCESS_DATA) | \
00229 ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00230 ((rsbac_request_vector_t) 1 << R_MODIFY_PERMISSIONS_DATA) | \
00231 ((rsbac_request_vector_t) 1 << R_MODIFY_SYSTEM_DATA) | \
00232 ((rsbac_request_vector_t) 1 << R_MOUNT) | \
00233 ((rsbac_request_vector_t) 1 << R_READ) | \
00234 ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00235 ((rsbac_request_vector_t) 1 << R_READ_OPEN) | \
00236 ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00237 ((rsbac_request_vector_t) 1 << R_RENAME) | \
00238 ((rsbac_request_vector_t) 1 << R_SEARCH) | \
00239 ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00240 ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) | \
00241 ((rsbac_request_vector_t) 1 << R_TRUNCATE) | \
00242 ((rsbac_request_vector_t) 1 << R_UMOUNT) | \
00243 ((rsbac_request_vector_t) 1 << R_WRITE) | \
00244 ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) | \
00245 ((rsbac_request_vector_t) 1 << R_MAP_EXEC) \
00246 )
00247 #endif
00248 #endif
00249
00250 #ifdef CONFIG_RSBAC_AUTH
00251 #if defined(CONFIG_RSBAC_AUTH_UM_PROT)
00252 #define RSBAC_AUTH_REQUEST_VECTOR_UM (\
00253 ((rsbac_request_vector_t) 1 << R_CREATE) | \
00254 ((rsbac_request_vector_t) 1 << R_DELETE) | \
00255 ((rsbac_request_vector_t) 1 << R_GET_PERMISSIONS_DATA) | \
00256 ((rsbac_request_vector_t) 1 << R_RENAME) | \
00257 ((rsbac_request_vector_t) 1 << R_WRITE) )
00258 #else
00259 #define RSBAC_AUTH_REQUEST_VECTOR_UM 0
00260 #endif
00261 #if defined(CONFIG_RSBAC_AUTH_UM_PROT) || defined(CONFIG_RSBAC_AUTH_GROUP)
00262 #define RSBAC_AUTH_REQUEST_VECTOR_CG ((rsbac_request_vector_t) 1 << R_CHANGE_GROUP)
00263 #else
00264 #define RSBAC_AUTH_REQUEST_VECTOR_CG 0
00265 #endif
00266 #if defined(CONFIG_RSBAC_AUTH_GROUP) && defined (CONFIG_RSBAC_AUTH_DAC_GROUP)
00267 #define RSBAC_AUTH_REQUEST_VECTOR_DG ( \
00268 ((rsbac_request_vector_t) 1 << R_CHANGE_DAC_EFF_GROUP) | \
00269 ((rsbac_request_vector_t) 1 << R_CHANGE_DAC_FS_GROUP) )
00270 #else
00271 #define RSBAC_AUTH_REQUEST_VECTOR_DG 0
00272 #endif
00273 #if defined (CONFIG_RSBAC_AUTH_DAC_OWNER)
00274 #define RSBAC_AUTH_REQUEST_VECTOR_DO ( \
00275 ((rsbac_request_vector_t) 1 << R_CHANGE_DAC_EFF_OWNER) | \
00276 ((rsbac_request_vector_t) 1 << R_CHANGE_DAC_FS_OWNER) )
00277 #else
00278 #define RSBAC_AUTH_REQUEST_VECTOR_DO 0
00279 #endif
00280 #if defined (CONFIG_RSBAC_AUTH_AUTH_PROT)
00281 #define RSBAC_AUTH_REQUEST_VECTOR_AA ( \
00282 ((rsbac_request_vector_t) 1 << R_GET_STATUS_DATA) | \
00283 ((rsbac_request_vector_t) 1 << R_MODIFY_PERMISSIONS_DATA) | \
00284 ((rsbac_request_vector_t) 1 << R_MODIFY_SYSTEM_DATA) | \
00285 ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00286 ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) )
00287 #else
00288 #define RSBAC_AUTH_REQUEST_VECTOR_AA 0
00289 #endif
00290
00291 #define RSBAC_AUTH_REQUEST_VECTOR (\
00292 RSBAC_AUTH_REQUEST_VECTOR_UM | \
00293 ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00294 RSBAC_AUTH_REQUEST_VECTOR_CG | \
00295 RSBAC_AUTH_REQUEST_VECTOR_DG | \
00296 RSBAC_AUTH_REQUEST_VECTOR_DO | \
00297 RSBAC_AUTH_REQUEST_VECTOR_AA | \
00298 ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) \
00299 )
00300
00301 #if defined (CONFIG_RSBAC_AUTH_AUTH_PROT)
00302 #define RSBAC_AUTH_SET_ATTR_VECTOR_AA ( \
00303 ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00304 ((rsbac_request_vector_t) 1 << R_CHANGE_GROUP) | \
00305 ((rsbac_request_vector_t) 1 << R_DELETE) | \
00306 ((rsbac_request_vector_t) 1 << R_LINK_HARD) | \
00307 ((rsbac_request_vector_t) 1 << R_MODIFY_ACCESS_DATA) | \
00308 ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00309 ((rsbac_request_vector_t) 1 << R_RENAME) | \
00310 ((rsbac_request_vector_t) 1 << R_TRUNCATE) | \
00311 ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) )
00312 #else
00313 #define RSBAC_AUTH_SET_ATTR_VECTOR_AA 0
00314 #endif
00315 #define RSBAC_AUTH_SET_ATTR_VECTOR (\
00316 RSBAC_AUTH_SET_ATTR_VECTOR_AA | \
00317 ((rsbac_request_vector_t) 1 << R_CLONE) | \
00318 ((rsbac_request_vector_t) 1 << R_EXECUTE) \
00319 )
00320 #endif
00321
00322 #ifdef CONFIG_RSBAC_CAP
00323 #ifdef CONFIG_RSBAC_CAP_PROC_HIDE
00324 #define RSBAC_CAP_REQUEST_VECTOR ( \
00325 ((rsbac_request_vector_t) 1 << R_CHANGE_GROUP) | \
00326 ((rsbac_request_vector_t) 1 << R_GET_STATUS_DATA) | \
00327 ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00328 ((rsbac_request_vector_t) 1 << R_MODIFY_SYSTEM_DATA) | \
00329 ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00330 ((rsbac_request_vector_t) 1 << R_SEND_SIGNAL) | \
00331 ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00332 ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) | \
00333 ((rsbac_request_vector_t) 1 << R_TRACE) )
00334 #else
00335 #define RSBAC_CAP_REQUEST_VECTOR (\
00336 ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00337 ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00338 ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00339 ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) )
00340 #endif
00341 #if defined (CONFIG_RSBAC_CAP_PROC_HIDE) || defined(CONFIG_RSBAC_CAP_LOG_MISSING)
00342 #define RSBAC_CAP_SET_ATTR_VECTOR (\
00343 ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00344 ((rsbac_request_vector_t) 1 << R_CLONE) | \
00345 ((rsbac_request_vector_t) 1 << R_EXECUTE) )
00346 #else
00347 #define RSBAC_CAP_SET_ATTR_VECTOR (\
00348 ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00349 ((rsbac_request_vector_t) 1 << R_EXECUTE) )
00350 #endif
00351 #endif
00352
00353 #ifdef CONFIG_RSBAC_JAIL
00354 #define RSBAC_JAIL_REQUEST_VECTOR ( \
00355 ((rsbac_request_vector_t) 1 << R_ADD_TO_KERNEL) | \
00356 ((rsbac_request_vector_t) 1 << R_ALTER) | \
00357 ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00358 ((rsbac_request_vector_t) 1 << R_CREATE) | \
00359 ((rsbac_request_vector_t) 1 << R_DELETE) | \
00360 ((rsbac_request_vector_t) 1 << R_GET_PERMISSIONS_DATA) | \
00361 ((rsbac_request_vector_t) 1 << R_GET_STATUS_DATA) | \
00362 ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00363 ((rsbac_request_vector_t) 1 << R_MODIFY_PERMISSIONS_DATA) | \
00364 ((rsbac_request_vector_t) 1 << R_MODIFY_SYSTEM_DATA) | \
00365 ((rsbac_request_vector_t) 1 << R_MOUNT) | \
00366 ((rsbac_request_vector_t) 1 << R_READ) | \
00367 ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00368 ((rsbac_request_vector_t) 1 << R_READ_OPEN) | \
00369 ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00370 ((rsbac_request_vector_t) 1 << R_REMOVE_FROM_KERNEL) | \
00371 ((rsbac_request_vector_t) 1 << R_SEND_SIGNAL) | \
00372 ((rsbac_request_vector_t) 1 << R_SHUTDOWN) | \
00373 ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00374 ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) | \
00375 ((rsbac_request_vector_t) 1 << R_TRACE) | \
00376 ((rsbac_request_vector_t) 1 << R_UMOUNT) | \
00377 ((rsbac_request_vector_t) 1 << R_WRITE) | \
00378 ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) | \
00379 ((rsbac_request_vector_t) 1 << R_BIND) | \
00380 ((rsbac_request_vector_t) 1 << R_LISTEN) | \
00381 ((rsbac_request_vector_t) 1 << R_ACCEPT) | \
00382 ((rsbac_request_vector_t) 1 << R_CONNECT) | \
00383 ((rsbac_request_vector_t) 1 << R_SEND) | \
00384 ((rsbac_request_vector_t) 1 << R_RECEIVE) | \
00385 ((rsbac_request_vector_t) 1 << R_NET_SHUTDOWN) )
00386 #define RSBAC_JAIL_SET_ATTR_VECTOR ( \
00387 ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00388 ((rsbac_request_vector_t) 1 << R_CLONE) | \
00389 ((rsbac_request_vector_t) 1 << R_CREATE) | \
00390 ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
00391 ((rsbac_request_vector_t) 1 << R_BIND) )
00392 #endif
00393
00394 #ifdef CONFIG_RSBAC_PAX
00395 #define RSBAC_PAX_REQUEST_VECTOR ( \
00396 ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00397 ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00398 ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00399 ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) )
00400 #endif
00401
00402 #ifdef CONFIG_RSBAC_RES
00403 #define RSBAC_RES_REQUEST_VECTOR ( \
00404 ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00405 ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00406 ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00407 ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) )
00408 #define RSBAC_RES_SET_ATTR_VECTOR ( \
00409 ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00410 ((rsbac_request_vector_t) 1 << R_EXECUTE) )
00411 #endif
00412
00413
00414
00415
00416
00417
00418 extern struct task_struct * find_process_by_pid(pid_t);
00419
00420 #ifdef CONFIG_RSBAC_DEBUG
00421 extern enum rsbac_adf_req_ret_t
00422 rsbac_adf_request_check (enum rsbac_adf_request_t request,
00423 rsbac_pid_t caller_pid,
00424 enum rsbac_target_t target,
00425 union rsbac_target_id_t * tid_p,
00426 enum rsbac_attribute_t attr,
00427 union rsbac_attribute_value_t * attr_val_p,
00428 rsbac_uid_t owner);
00429
00430 extern int rsbac_adf_set_attr_check( enum rsbac_adf_request_t,
00431 rsbac_pid_t,
00432 enum rsbac_target_t,
00433 union rsbac_target_id_t,
00434 enum rsbac_target_t,
00435 union rsbac_target_id_t,
00436 enum rsbac_attribute_t,
00437 union rsbac_attribute_value_t,
00438 rsbac_uid_t);
00439 #endif
00440
00441 extern enum rsbac_adf_req_ret_t
00442 adf_and_plus(enum rsbac_adf_req_ret_t res1,
00443 enum rsbac_adf_req_ret_t res2);
00444
00445
00446
00447
00448
00449 #if !defined(CONFIG_RSBAC_MAINT)
00450
00451
00452
00453 #ifdef CONFIG_RSBAC_MAC
00454 #ifdef CONFIG_RSBAC_SWITCH_MAC
00455 extern rsbac_boolean_t rsbac_switch_mac;
00456 #endif
00457
00458 extern enum rsbac_adf_req_ret_t rsbac_adf_request_mac(
00459 enum rsbac_adf_request_t,
00460 rsbac_pid_t,
00461 enum rsbac_target_t,
00462 union rsbac_target_id_t,
00463 enum rsbac_attribute_t,
00464 union rsbac_attribute_value_t,
00465 rsbac_uid_t);
00466
00467 extern int rsbac_adf_set_attr_mac( enum rsbac_adf_request_t,
00468 rsbac_pid_t,
00469 enum rsbac_target_t,
00470 union rsbac_target_id_t,
00471 enum rsbac_target_t,
00472 union rsbac_target_id_t,
00473 enum rsbac_attribute_t,
00474 union rsbac_attribute_value_t,
00475 rsbac_uid_t);
00476
00477 #endif
00478
00479
00480
00481
00482 #ifdef CONFIG_RSBAC_PM
00483 #ifdef CONFIG_RSBAC_SWITCH_PM
00484 extern rsbac_boolean_t rsbac_switch_pm;
00485 #endif
00486
00487 extern enum rsbac_adf_req_ret_t rsbac_adf_request_pm(
00488 enum rsbac_adf_request_t,
00489 rsbac_pid_t,
00490 enum rsbac_target_t,
00491 union rsbac_target_id_t,
00492 enum rsbac_attribute_t,
00493 union rsbac_attribute_value_t,
00494 rsbac_uid_t);
00495
00496 extern int rsbac_adf_set_attr_pm ( enum rsbac_adf_request_t,
00497 rsbac_pid_t,
00498 enum rsbac_target_t,
00499 union rsbac_target_id_t,
00500 enum rsbac_target_t,
00501 union rsbac_target_id_t,
00502 enum rsbac_attribute_t,
00503 union rsbac_attribute_value_t,
00504 rsbac_uid_t);
00505
00506 #ifdef CONFIG_RSBAC_SECDEL
00507 extern rsbac_boolean_t rsbac_need_overwrite_pm(struct dentry * dentry_p);
00508 #endif
00509
00510 #endif
00511
00512
00513
00514 #ifdef CONFIG_RSBAC_DAZ
00515 #ifdef CONFIG_RSBAC_SWITCH_DAZ
00516 extern rsbac_boolean_t rsbac_switch_daz;
00517 #endif
00518
00519 extern enum rsbac_adf_req_ret_t rsbac_adf_request_daz(
00520 enum rsbac_adf_request_t,
00521 rsbac_pid_t,
00522 enum rsbac_target_t,
00523 union rsbac_target_id_t,
00524 enum rsbac_attribute_t,
00525 union rsbac_attribute_value_t,
00526 rsbac_uid_t);
00527
00528 extern int rsbac_adf_set_attr_daz (enum rsbac_adf_request_t,
00529 rsbac_pid_t,
00530 enum rsbac_target_t,
00531 union rsbac_target_id_t,
00532 enum rsbac_target_t,
00533 union rsbac_target_id_t,
00534 enum rsbac_attribute_t,
00535 union rsbac_attribute_value_t,
00536 rsbac_uid_t);
00537
00538 #endif
00539
00540
00541
00542 #ifdef CONFIG_RSBAC_FF
00543 #ifdef CONFIG_RSBAC_SWITCH_FF
00544 extern rsbac_boolean_t rsbac_switch_ff;
00545 #endif
00546
00547 extern enum rsbac_adf_req_ret_t rsbac_adf_request_ff(
00548 enum rsbac_adf_request_t,
00549 rsbac_pid_t,
00550 enum rsbac_target_t,
00551 union rsbac_target_id_t,
00552 enum rsbac_attribute_t,
00553 union rsbac_attribute_value_t,
00554 rsbac_uid_t);
00555
00556 extern int rsbac_adf_set_attr_ff ( enum rsbac_adf_request_t,
00557 rsbac_pid_t,
00558 enum rsbac_target_t,
00559 union rsbac_target_id_t,
00560 enum rsbac_target_t,
00561 union rsbac_target_id_t,
00562 enum rsbac_attribute_t,
00563 union rsbac_attribute_value_t,
00564 rsbac_uid_t);
00565
00566 #ifdef CONFIG_RSBAC_SECDEL
00567 extern rsbac_boolean_t rsbac_need_overwrite_ff(struct dentry * dentry_p);
00568 #endif
00569
00570 #endif
00571
00572
00573
00574 #ifdef CONFIG_RSBAC_RC
00575 #ifdef CONFIG_RSBAC_SWITCH_RC
00576 extern rsbac_boolean_t rsbac_switch_rc;
00577 #endif
00578
00579 extern enum rsbac_adf_req_ret_t rsbac_adf_request_rc(
00580 enum rsbac_adf_request_t,
00581 rsbac_pid_t,
00582 enum rsbac_target_t,
00583 union rsbac_target_id_t,
00584 enum rsbac_attribute_t,
00585 union rsbac_attribute_value_t,
00586 rsbac_uid_t);
00587
00588 extern int rsbac_adf_set_attr_rc ( enum rsbac_adf_request_t,
00589 rsbac_pid_t,
00590 enum rsbac_target_t,
00591 union rsbac_target_id_t,
00592 enum rsbac_target_t,
00593 union rsbac_target_id_t,
00594 enum rsbac_attribute_t,
00595 union rsbac_attribute_value_t,
00596 rsbac_uid_t);
00597
00598
00599 #ifdef CONFIG_RSBAC_SECDEL
00600 extern rsbac_boolean_t rsbac_need_overwrite_rc(struct dentry * dentry_p);
00601 #endif
00602 #endif
00603
00604
00605
00606 #ifdef CONFIG_RSBAC_AUTH
00607 #ifdef CONFIG_RSBAC_SWITCH_AUTH
00608 extern rsbac_boolean_t rsbac_switch_auth;
00609 #endif
00610
00611 extern enum rsbac_adf_req_ret_t rsbac_adf_request_auth(
00612 enum rsbac_adf_request_t,
00613 rsbac_pid_t,
00614 enum rsbac_target_t,
00615 union rsbac_target_id_t,
00616 enum rsbac_attribute_t,
00617 union rsbac_attribute_value_t,
00618 rsbac_uid_t);
00619
00620 extern int rsbac_adf_set_attr_auth(enum rsbac_adf_request_t,
00621 rsbac_pid_t,
00622 enum rsbac_target_t,
00623 union rsbac_target_id_t,
00624 enum rsbac_target_t,
00625 union rsbac_target_id_t,
00626 enum rsbac_attribute_t,
00627 union rsbac_attribute_value_t,
00628 rsbac_uid_t);
00629
00630 #endif
00631
00632
00633
00634 #ifdef CONFIG_RSBAC_ACL
00635 #ifdef CONFIG_RSBAC_SWITCH_ACL
00636 extern rsbac_boolean_t rsbac_switch_acl;
00637 #endif
00638
00639 extern enum rsbac_adf_req_ret_t rsbac_adf_request_acl(
00640 enum rsbac_adf_request_t,
00641 rsbac_pid_t,
00642 enum rsbac_target_t,
00643 union rsbac_target_id_t,
00644 enum rsbac_attribute_t,
00645 union rsbac_attribute_value_t,
00646 rsbac_uid_t);
00647
00648 extern int rsbac_adf_set_attr_acl (enum rsbac_adf_request_t,
00649 rsbac_pid_t,
00650 enum rsbac_target_t,
00651 union rsbac_target_id_t,
00652 enum rsbac_target_t,
00653 union rsbac_target_id_t,
00654 enum rsbac_attribute_t,
00655 union rsbac_attribute_value_t,
00656 rsbac_uid_t);
00657
00658 #endif
00659
00660
00661
00662 #ifdef CONFIG_RSBAC_CAP
00663 #ifdef CONFIG_RSBAC_SWITCH_CAP
00664 extern rsbac_boolean_t rsbac_switch_cap;
00665 #endif
00666
00667 extern enum rsbac_adf_req_ret_t rsbac_adf_request_cap(
00668 enum rsbac_adf_request_t,
00669 rsbac_pid_t,
00670 enum rsbac_target_t,
00671 union rsbac_target_id_t,
00672 enum rsbac_attribute_t,
00673 union rsbac_attribute_value_t,
00674 rsbac_uid_t);
00675
00676 extern int rsbac_adf_set_attr_cap (enum rsbac_adf_request_t,
00677 rsbac_pid_t,
00678 enum rsbac_target_t,
00679 union rsbac_target_id_t,
00680 enum rsbac_target_t,
00681 union rsbac_target_id_t,
00682 enum rsbac_attribute_t,
00683 union rsbac_attribute_value_t,
00684 rsbac_uid_t);
00685
00686 #endif
00687
00688
00689
00690 #ifdef CONFIG_RSBAC_JAIL
00691 #ifdef CONFIG_RSBAC_SWITCH_JAIL
00692 extern rsbac_boolean_t rsbac_switch_jail;
00693 #endif
00694
00695 extern enum rsbac_adf_req_ret_t rsbac_adf_request_jail(
00696 enum rsbac_adf_request_t,
00697 rsbac_pid_t,
00698 enum rsbac_target_t,
00699 union rsbac_target_id_t,
00700 enum rsbac_attribute_t,
00701 union rsbac_attribute_value_t,
00702 rsbac_uid_t);
00703
00704 extern int rsbac_adf_set_attr_jail(enum rsbac_adf_request_t,
00705 rsbac_pid_t,
00706 enum rsbac_target_t,
00707 union rsbac_target_id_t,
00708 enum rsbac_target_t,
00709 union rsbac_target_id_t,
00710 enum rsbac_attribute_t,
00711 union rsbac_attribute_value_t,
00712 rsbac_uid_t);
00713
00714 #endif
00715
00716
00717
00718 #ifdef CONFIG_RSBAC_PAX
00719 #ifdef CONFIG_RSBAC_SWITCH_PAX
00720 extern rsbac_boolean_t rsbac_switch_pax;
00721 #endif
00722
00723 extern enum rsbac_adf_req_ret_t rsbac_adf_request_pax(
00724 enum rsbac_adf_request_t,
00725 rsbac_pid_t,
00726 enum rsbac_target_t,
00727 union rsbac_target_id_t,
00728 enum rsbac_attribute_t,
00729 union rsbac_attribute_value_t,
00730 rsbac_uid_t);
00731
00732 extern int rsbac_adf_set_attr_pax( enum rsbac_adf_request_t,
00733 rsbac_pid_t,
00734 enum rsbac_target_t,
00735 union rsbac_target_id_t,
00736 enum rsbac_target_t,
00737 union rsbac_target_id_t,
00738 enum rsbac_attribute_t,
00739 union rsbac_attribute_value_t,
00740 rsbac_uid_t);
00741
00742 #endif
00743
00744
00745
00746
00747 #ifdef CONFIG_RSBAC_RES
00748 #ifdef CONFIG_RSBAC_SWITCH_RES
00749 extern rsbac_boolean_t rsbac_switch_res;
00750 #endif
00751
00752 extern enum rsbac_adf_req_ret_t rsbac_adf_request_res(
00753 enum rsbac_adf_request_t,
00754 rsbac_pid_t,
00755 enum rsbac_target_t,
00756 union rsbac_target_id_t,
00757 enum rsbac_attribute_t,
00758 union rsbac_attribute_value_t,
00759 rsbac_uid_t);
00760
00761 extern int rsbac_adf_set_attr_res (enum rsbac_adf_request_t,
00762 rsbac_pid_t,
00763 enum rsbac_target_t,
00764 union rsbac_target_id_t,
00765 enum rsbac_target_t,
00766 union rsbac_target_id_t,
00767 enum rsbac_attribute_t,
00768 union rsbac_attribute_value_t,
00769 rsbac_uid_t);
00770
00771 #ifdef CONFIG_RSBAC_SECDEL
00772 extern inline rsbac_boolean_t rsbac_need_overwrite_res(struct dentry * dentry_p)
00773 {
00774 return FALSE;
00775 }
00776 #endif
00777 #endif
00778
00779
00780
00781 #if defined(CONFIG_RSBAC_REG)
00782 extern enum rsbac_adf_req_ret_t rsbac_adf_request_reg(
00783 enum rsbac_adf_request_t,
00784 rsbac_pid_t,
00785 enum rsbac_target_t,
00786 union rsbac_target_id_t,
00787 enum rsbac_attribute_t,
00788 union rsbac_attribute_value_t,
00789 rsbac_uid_t);
00790
00791 extern int rsbac_adf_set_attr_reg (enum rsbac_adf_request_t,
00792 rsbac_pid_t,
00793 enum rsbac_target_t,
00794 union rsbac_target_id_t,
00795 enum rsbac_target_t,
00796 union rsbac_target_id_t,
00797 enum rsbac_attribute_t,
00798 union rsbac_attribute_value_t,
00799 rsbac_uid_t);
00800
00801 #ifdef CONFIG_RSBAC_SECDEL
00802 extern inline rsbac_boolean_t rsbac_need_overwrite_reg(struct dentry * dentry_p)
00803 {
00804 return FALSE;
00805 }
00806 #endif
00807 #endif
00808
00809 #endif
00810
00811 #if defined(CONFIG_RSBAC_REG) || defined(CONFIG_RSBAC_REG_MAINT)
00812
00813 #ifdef CONFIG_RSBAC_INIT_DELAY
00814 void rsbac_reg_init(void);
00815 #else
00816 void rsbac_reg_init(void) __init;
00817 #endif
00818
00819
00820 extern int rsbac_mount_reg(kdev_t kdev);
00821 extern int rsbac_umount_reg(kdev_t kdev);
00822
00823
00824
00825
00826 #if defined(CONFIG_RSBAC_AUTO_WRITE)
00827 extern int rsbac_write_reg(rsbac_boolean_t);
00828 #endif
00829
00830
00831 extern int rsbac_check_reg(int correct, int check_inode);
00832
00833 #endif
00834
00835 #endif