#include <linux/string.h>
#include <rsbac/types.h>
#include <rsbac/aci.h>
#include <rsbac/adf_main.h>
#include <rsbac/error.h>
#include <rsbac/helpers.h>
#include <rsbac/getname.h>
Go to the source code of this file.
Functions | |
enum rsbac_adf_req_ret_t | rsbac_adf_request_check (enum rsbac_adf_request_t request, rsbac_pid_t caller_pid, enum rsbac_target_t target, union rsbac_target_id_t *tid_p, enum rsbac_attribute_t attr, union rsbac_attribute_value_t *attr_val_p, rsbac_uid_t owner) |
int | rsbac_adf_set_attr_check (enum rsbac_adf_request_t request, rsbac_pid_t caller_pid, enum rsbac_target_t target, union rsbac_target_id_t tid, enum rsbac_target_t new_target, union rsbac_target_id_t new_tid, enum rsbac_attribute_t attr, union rsbac_attribute_value_t attr_val, rsbac_uid_t owner) |
enum rsbac_adf_req_ret_t rsbac_adf_request_check | ( | enum rsbac_adf_request_t | request, | |
rsbac_pid_t | caller_pid, | |||
enum rsbac_target_t | target, | |||
union rsbac_target_id_t * | tid_p, | |||
enum rsbac_attribute_t | attr, | |||
union rsbac_attribute_value_t * | attr_val_p, | |||
rsbac_uid_t | owner | |||
) |
Definition at line 29 of file adf_check.c.
References DO_NOT_CARE, R_ACCEPT, R_ADD_TO_KERNEL, R_ALTER, R_APPEND_OPEN, R_AUTHENTICATE, R_BIND, R_CHANGE_DAC_EFF_GROUP, R_CHANGE_DAC_EFF_OWNER, R_CHANGE_DAC_FS_GROUP, R_CHANGE_DAC_FS_OWNER, R_CHANGE_GROUP, R_CHANGE_OWNER, R_CHDIR, R_CLONE, R_CLOSE, R_CONNECT, R_CREATE, R_DELETE, R_EXECUTE, R_GET_PERMISSIONS_DATA, R_GET_STATUS_DATA, R_IOCTL, R_LINK_HARD, R_LISTEN, R_LOCK, R_MAP_EXEC, R_MODIFY_ACCESS_DATA, R_MODIFY_ATTRIBUTE, R_MODIFY_PERMISSIONS_DATA, R_MODIFY_SYSTEM_DATA, R_MOUNT, R_NET_SHUTDOWN, R_READ, R_READ_ATTRIBUTE, R_READ_OPEN, R_READ_WRITE_OPEN, R_RECEIVE, R_REMOVE_FROM_KERNEL, R_RENAME, R_SEARCH, R_SEND, R_SEND_SIGNAL, R_SHUTDOWN, R_SWITCH_LOG, R_SWITCH_MODULE, R_TERMINATE, R_TRACE, R_TRUNCATE, R_UMOUNT, R_WRITE, R_WRITE_OPEN, T_DEV, T_DIR, T_FIFO, T_FILE, T_GROUP, T_IPC, T_NETDEV, T_NETOBJ, T_NETTEMP, T_NONE, T_PROCESS, T_SCD, T_SYMLINK, T_UNIXSOCK, T_USER, and UNDEFINED.
Referenced by rsbac_adf_request_int().
00036 { 00037 switch (request) { 00038 case R_SEARCH: 00039 switch (target) { 00040 case T_DIR: 00041 case T_FILE: 00042 case T_SYMLINK: 00043 case T_FIFO: 00044 case T_UNIXSOCK: 00045 case T_DEV: 00046 case T_NETOBJ: 00047 #if defined(CONFIG_RSBAC_UM) 00048 case T_USER: 00049 case T_GROUP: 00050 #endif 00051 return (DO_NOT_CARE); 00052 /* all other cases are undefined */ 00053 default: 00054 return (UNDEFINED); 00055 } 00056 00057 case R_CLOSE: /* only notifying for clean-up of opened-tables */ 00058 switch (target) { 00059 case T_FILE: 00060 case T_DIR: 00061 case T_FIFO: 00062 case T_UNIXSOCK: 00063 case T_DEV: 00064 case T_IPC: 00065 case T_NETOBJ: 00066 return (DO_NOT_CARE); 00067 default: 00068 return (UNDEFINED); 00069 } 00070 00071 case R_GET_STATUS_DATA: 00072 switch (target) { 00073 case T_PROCESS: 00074 case T_FILE: 00075 case T_DIR: 00076 case T_FIFO: 00077 case T_SYMLINK: 00078 case T_UNIXSOCK: 00079 case T_DEV: 00080 case T_IPC: 00081 case T_SCD: 00082 case T_NETDEV: 00083 case T_NETOBJ: 00084 #if defined(CONFIG_RSBAC_UM) 00085 case T_USER: 00086 case T_GROUP: 00087 #endif 00088 return (DO_NOT_CARE); 00089 default: 00090 return (UNDEFINED); 00091 } 00092 00093 case R_READ: 00094 switch (target) { 00095 case T_DIR: 00096 #ifdef CONFIG_RSBAC_RW 00097 case T_FILE: 00098 case T_FIFO: 00099 case T_UNIXSOCK: 00100 case T_DEV: 00101 case T_IPC: 00102 #endif 00103 #if defined(CONFIG_RSBAC_NET_OBJ) 00104 case T_NETTEMP: 00105 #endif 00106 #if defined(CONFIG_RSBAC_NET_OBJ_RW) 00107 case T_NETOBJ: 00108 #endif 00109 #if defined(CONFIG_RSBAC_UM) 00110 case T_USER: 00111 case T_GROUP: 00112 #endif 00113 return (DO_NOT_CARE); 00114 /* all other cases are undefined */ 00115 default: 00116 return (UNDEFINED); 00117 } 00118 00119 case R_GET_PERMISSIONS_DATA: 00120 switch (target) { 00121 case T_FILE: 00122 case T_DIR: 00123 case T_FIFO: 00124 case T_SYMLINK: 00125 case T_UNIXSOCK: 00126 case T_IPC: 00127 case T_SCD: 00128 case T_DEV: 00129 case T_NETOBJ: 00130 #if defined(CONFIG_RSBAC_UM) 00131 case T_USER: 00132 case T_GROUP: 00133 #endif 00134 return (DO_NOT_CARE); 00135 default: 00136 return (UNDEFINED); 00137 }; 00138 00139 case R_MAP_EXEC: 00140 switch (target) { 00141 case T_FILE: 00142 case T_NONE: 00143 return (DO_NOT_CARE); 00144 /* all other cases are undefined */ 00145 default: 00146 return (UNDEFINED); 00147 } 00148 00149 case R_SEND: 00150 switch (target) { 00151 case T_DEV: 00152 case T_UNIXSOCK: 00153 case T_IPC: 00154 #if defined(CONFIG_RSBAC_NET_OBJ) 00155 case T_NETOBJ: 00156 #endif 00157 return (DO_NOT_CARE); 00158 /* all other cases are undefined */ 00159 default: 00160 return (UNDEFINED); 00161 } 00162 00163 case R_LISTEN: 00164 case R_ACCEPT: 00165 case R_CONNECT: 00166 case R_RECEIVE: 00167 case R_NET_SHUTDOWN: 00168 switch (target) { 00169 case T_UNIXSOCK: 00170 case T_IPC: 00171 #if defined(CONFIG_RSBAC_NET_OBJ) 00172 case T_NETOBJ: 00173 #endif 00174 return (DO_NOT_CARE); 00175 /* all other cases are undefined */ 00176 default: 00177 return (UNDEFINED); 00178 } 00179 00180 case R_EXECUTE: 00181 switch (target) { 00182 case T_FILE: 00183 return (DO_NOT_CARE); 00184 /* all other cases are undefined */ 00185 default: 00186 return (UNDEFINED); 00187 } 00188 00189 case R_READ_OPEN: 00190 switch (target) { 00191 case T_FILE: 00192 case T_FIFO: 00193 case T_IPC: 00194 case T_DEV: 00195 case T_UNIXSOCK: 00196 return (DO_NOT_CARE); 00197 /* all other cases are undefined */ 00198 default: 00199 return (UNDEFINED); 00200 } 00201 00202 case R_WRITE: 00203 switch (target) { 00204 case T_DIR: 00205 case T_UNIXSOCK: 00206 case T_SCD: 00207 case T_IPC: 00208 #ifdef CONFIG_RSBAC_RW 00209 case T_FILE: 00210 case T_FIFO: 00211 case T_DEV: 00212 #endif 00213 #if defined(CONFIG_RSBAC_NET_OBJ) 00214 case T_NETTEMP: 00215 #endif 00216 #if defined(CONFIG_RSBAC_NET_OBJ_RW) 00217 case T_NETOBJ: 00218 #endif 00219 #if defined(CONFIG_RSBAC_UM) 00220 case T_USER: 00221 case T_GROUP: 00222 #endif 00223 return (DO_NOT_CARE); 00224 /* all other cases are undefined */ 00225 default: 00226 return (UNDEFINED); 00227 } 00228 00229 case R_APPEND_OPEN: 00230 switch (target) { 00231 case T_FILE: 00232 case T_FIFO: 00233 case T_DEV: 00234 case T_UNIXSOCK: 00235 return (DO_NOT_CARE); 00236 /* all other cases are undefined */ 00237 default: 00238 return (UNDEFINED); 00239 } 00240 00241 case R_READ_WRITE_OPEN: 00242 switch (target) { 00243 case T_FILE: 00244 case T_FIFO: 00245 case T_IPC: 00246 case T_DEV: 00247 case T_UNIXSOCK: 00248 return (DO_NOT_CARE); 00249 /* all other cases are undefined */ 00250 default: 00251 return (UNDEFINED); 00252 } 00253 00254 case R_WRITE_OPEN: 00255 switch (target) { 00256 case T_FILE: 00257 case T_FIFO: 00258 case T_DEV: 00259 case T_UNIXSOCK: 00260 return (DO_NOT_CARE); 00261 /* all other cases are undefined */ 00262 default: 00263 return (UNDEFINED); 00264 } 00265 00266 case R_IOCTL: 00267 switch (target) { 00268 case T_UNIXSOCK: 00269 case T_IPC: 00270 case T_DEV: 00271 #if defined(CONFIG_RSBAC_NET_OBJ) 00272 case T_NETOBJ: 00273 #endif 00274 return (DO_NOT_CARE); 00275 /* all other cases are undefined */ 00276 default: 00277 return (UNDEFINED); 00278 } 00279 00280 case R_ADD_TO_KERNEL: 00281 switch (target) { 00282 case T_FILE: 00283 case T_DEV: 00284 case T_NONE: 00285 return (DO_NOT_CARE); 00286 default: 00287 return (UNDEFINED); 00288 } 00289 00290 case R_ALTER: 00291 /* only for IPC */ 00292 if (target == T_IPC) 00293 return (DO_NOT_CARE); 00294 else 00295 /* all other targets are undefined */ 00296 return (UNDEFINED); 00297 break; 00298 00299 case R_CHANGE_GROUP: 00300 switch (target) { 00301 case T_FILE: 00302 case T_DIR: 00303 case T_FIFO: 00304 case T_SYMLINK: 00305 case T_UNIXSOCK: 00306 case T_IPC: 00307 case T_PROCESS: 00308 case T_NONE: 00309 #if defined(CONFIG_RSBAC_UM) 00310 case T_USER: 00311 #endif 00312 return (DO_NOT_CARE); 00313 /* all other cases are undefined */ 00314 default: 00315 return (UNDEFINED); 00316 } 00317 00318 #ifdef CONFIG_RSBAC_DAC_GROUP 00319 case R_CHANGE_DAC_EFF_GROUP: 00320 case R_CHANGE_DAC_FS_GROUP: 00321 switch (target) { 00322 case T_PROCESS: 00323 /* there must be a new group specified */ 00324 if (attr == A_group) 00325 return (DO_NOT_CARE); 00326 /* fall through */ 00327 /* all other cases are undefined */ 00328 default: 00329 return (UNDEFINED); 00330 } 00331 #endif 00332 00333 case R_CHANGE_OWNER: 00334 switch (target) { 00335 case T_FILE: 00336 case T_DIR: 00337 case T_FIFO: 00338 case T_SYMLINK: 00339 case T_UNIXSOCK: 00340 case T_IPC: 00341 return (DO_NOT_CARE); 00342 case T_PROCESS: 00343 /* there must be a new owner specified */ 00344 if (attr == A_owner) 00345 return DO_NOT_CARE; 00346 else 00347 return UNDEFINED; 00348 /* all other cases are undefined */ 00349 #ifdef CONFIG_RSBAC_USER_CHOWN 00350 case T_USER: 00351 /* there must be a new owner specified */ 00352 if (attr == A_process) 00353 return DO_NOT_CARE; 00354 else 00355 return UNDEFINED; 00356 /* all other cases are undefined */ 00357 #endif 00358 default: 00359 return UNDEFINED; 00360 } 00361 00362 #ifdef CONFIG_RSBAC_DAC_OWNER 00363 case R_CHANGE_DAC_EFF_OWNER: 00364 case R_CHANGE_DAC_FS_OWNER: 00365 switch (target) { 00366 case T_PROCESS: 00367 /* there must be a new owner specified */ 00368 if (attr == A_owner) 00369 return (DO_NOT_CARE); 00370 /* fall through */ 00371 /* all other cases are undefined */ 00372 default: 00373 return (UNDEFINED); 00374 } 00375 #endif 00376 00377 case R_CHDIR: 00378 switch (target) { 00379 case T_DIR: 00380 return (DO_NOT_CARE); 00381 /* all other cases are undefined */ 00382 default: 00383 return (UNDEFINED); 00384 } 00385 00386 case R_CLONE: 00387 if (target == T_PROCESS) 00388 return (DO_NOT_CARE); 00389 else 00390 return (UNDEFINED); 00391 00392 case R_CREATE: 00393 switch (target) { 00394 /* Creating dir or (pseudo) file IN target dir! */ 00395 case T_DIR: 00396 case T_IPC: 00397 #if defined(CONFIG_RSBAC_NET_OBJ) 00398 case T_NETTEMP: 00399 case T_NETOBJ: 00400 #endif 00401 #if defined(CONFIG_RSBAC_UM) 00402 case T_USER: 00403 case T_GROUP: 00404 #endif 00405 return (DO_NOT_CARE); 00406 /* all other cases are undefined */ 00407 default: 00408 return (UNDEFINED); 00409 } 00410 00411 case R_DELETE: 00412 switch (target) { 00413 case T_FILE: 00414 case T_DIR: 00415 case T_FIFO: 00416 case T_SYMLINK: 00417 case T_UNIXSOCK: 00418 case T_IPC: 00419 #if defined(CONFIG_RSBAC_UM) 00420 case T_USER: 00421 case T_GROUP: 00422 #endif 00423 #if defined(CONFIG_RSBAC_NET_OBJ) 00424 case T_NETTEMP: 00425 case T_NETOBJ: 00426 #endif 00427 return (DO_NOT_CARE); 00428 default: 00429 return (UNDEFINED); 00430 } 00431 00432 case R_LINK_HARD: 00433 switch (target) { 00434 case T_FILE: 00435 case T_FIFO: 00436 case T_SYMLINK: 00437 return (DO_NOT_CARE); 00438 /* all other cases are undefined */ 00439 default: 00440 return (UNDEFINED); 00441 } 00442 00443 case R_MODIFY_ACCESS_DATA: 00444 switch (target) { 00445 case T_FILE: 00446 case T_DIR: 00447 case T_FIFO: 00448 case T_SYMLINK: 00449 case T_UNIXSOCK: 00450 return (DO_NOT_CARE); 00451 /* all other cases are undefined */ 00452 default: 00453 return (UNDEFINED); 00454 } 00455 00456 case R_AUTHENTICATE: 00457 switch (target) { 00458 case T_USER: 00459 return (DO_NOT_CARE); 00460 /* all other cases are undefined */ 00461 default: 00462 return (UNDEFINED); 00463 } 00464 00465 case R_MODIFY_ATTRIBUTE: 00466 return (DO_NOT_CARE); 00467 00468 case R_MODIFY_PERMISSIONS_DATA: 00469 switch (target) { 00470 case T_FILE: 00471 case T_DIR: 00472 case T_FIFO: 00473 case T_SYMLINK: 00474 case T_UNIXSOCK: 00475 case T_IPC: 00476 case T_SCD: 00477 case T_DEV: 00478 case T_NETOBJ: 00479 #if defined(CONFIG_RSBAC_UM) 00480 case T_USER: 00481 case T_GROUP: 00482 #endif 00483 #ifdef CONFIG_RSBAC_ALLOW_DAC_DISABLE 00484 case T_NONE: 00485 #endif 00486 return (DO_NOT_CARE); 00487 /* all other cases are undefined */ 00488 default: 00489 return (UNDEFINED); 00490 } 00491 00492 case R_MODIFY_SYSTEM_DATA: 00493 switch (target) { 00494 case T_UNIXSOCK: 00495 case T_IPC: 00496 case T_SCD: 00497 case T_DEV: 00498 case T_NETDEV: 00499 case T_PROCESS: 00500 #if defined(CONFIG_RSBAC_NET_OBJ) 00501 case T_NETOBJ: 00502 #endif 00503 return (DO_NOT_CARE); 00504 /* all other cases are undefined */ 00505 default: 00506 return (UNDEFINED); 00507 } 00508 00509 case R_MOUNT: 00510 switch (target) { 00511 case T_FILE: 00512 case T_DIR: 00513 case T_DEV: 00514 return (DO_NOT_CARE); 00515 /* all other cases are undefined */ 00516 default: 00517 return (UNDEFINED); 00518 } 00519 00520 case R_READ_ATTRIBUTE: 00521 return (DO_NOT_CARE); 00522 00523 case R_REMOVE_FROM_KERNEL: 00524 switch (target) { 00525 case T_FILE: 00526 case T_DEV: 00527 case T_NONE: 00528 return (DO_NOT_CARE); 00529 /* all other cases are undefined */ 00530 default: 00531 return (UNDEFINED); 00532 } 00533 00534 case R_RENAME: 00535 switch (target) { 00536 case T_FILE: 00537 case T_DIR: 00538 case T_FIFO: 00539 case T_SYMLINK: 00540 case T_UNIXSOCK: 00541 #if defined(CONFIG_RSBAC_UM) 00542 case T_USER: 00543 case T_GROUP: 00544 #endif 00545 return (DO_NOT_CARE); 00546 /* all other cases are undefined */ 00547 default: 00548 return (UNDEFINED); 00549 } 00550 00551 case R_SEND_SIGNAL: 00552 switch (target) { 00553 case T_PROCESS: 00554 return (DO_NOT_CARE); 00555 /* all other cases are undefined */ 00556 default: 00557 return (UNDEFINED); 00558 } 00559 00560 case R_SHUTDOWN: 00561 switch (target) { 00562 case T_NONE: 00563 return (DO_NOT_CARE); 00564 /* all other cases are undefined */ 00565 default: 00566 return (UNDEFINED); 00567 } 00568 00569 00570 case R_SWITCH_LOG: 00571 switch (target) { 00572 case T_NONE: 00573 return (DO_NOT_CARE); 00574 /* all other cases are undefined */ 00575 default: 00576 return (UNDEFINED); 00577 } 00578 00579 case R_SWITCH_MODULE: 00580 switch (target) { 00581 case T_NONE: 00582 /* there must be a switch target specified */ 00583 if (attr == A_switch_target) 00584 return (DO_NOT_CARE); 00585 /* fall through */ 00586 /* all other cases are undefined */ 00587 default: 00588 return (UNDEFINED); 00589 } 00590 00591 /* notify only, handled by adf-dispatcher */ 00592 case R_TERMINATE: 00593 if (target == T_PROCESS) 00594 return (DO_NOT_CARE); 00595 else 00596 return (UNDEFINED); 00597 00598 case R_TRACE: 00599 switch (target) { 00600 case T_PROCESS: 00601 return (DO_NOT_CARE); 00602 /* all other cases are undefined */ 00603 default: 00604 return (UNDEFINED); 00605 } 00606 00607 case R_TRUNCATE: 00608 switch (target) { 00609 case T_FILE: 00610 return (DO_NOT_CARE); 00611 /* all other cases are undefined */ 00612 default: 00613 return (UNDEFINED); 00614 } 00615 00616 case R_UMOUNT: 00617 switch (target) { 00618 case T_FILE: 00619 case T_DIR: 00620 case T_DEV: 00621 return (DO_NOT_CARE); 00622 /* all other cases are undefined */ 00623 default: 00624 return (UNDEFINED); 00625 } 00626 00627 00628 #if defined(CONFIG_RSBAC_NET) 00629 case R_BIND: 00630 switch (target) { 00631 #if defined(CONFIG_RSBAC_NET_DEV) 00632 case T_NETDEV: 00633 return (DO_NOT_CARE); 00634 #endif 00635 #if defined(CONFIG_RSBAC_NET_OBJ) 00636 case T_NETOBJ: 00637 return (DO_NOT_CARE); 00638 #endif 00639 /* all other cases are undefined */ 00640 default: 00641 return (UNDEFINED); 00642 } 00643 #endif 00644 00645 case R_LOCK: 00646 switch (target) { 00647 case T_FILE: 00648 case T_DIR: 00649 case T_FIFO: 00650 case T_SYMLINK: 00651 case T_UNIXSOCK: 00652 return (DO_NOT_CARE); 00653 /* all other cases are undefined */ 00654 default: 00655 return (UNDEFINED); 00656 } 00657 00658 /*********************/ 00659 default: 00660 return UNDEFINED; 00661 } 00662 00663 return UNDEFINED; 00664 } /* end of rsbac_adf_request_check() */
int rsbac_adf_set_attr_check | ( | enum rsbac_adf_request_t | request, | |
rsbac_pid_t | caller_pid, | |||
enum rsbac_target_t | target, | |||
union rsbac_target_id_t | tid, | |||
enum rsbac_target_t | new_target, | |||
union rsbac_target_id_t | new_tid, | |||
enum rsbac_attribute_t | attr, | |||
union rsbac_attribute_value_t | attr_val, | |||
rsbac_uid_t | owner | |||
) |
Definition at line 678 of file adf_check.c.
References R_ACCEPT, R_APPEND_OPEN, R_BIND, R_CHANGE_DAC_EFF_OWNER, R_CHANGE_DAC_FS_OWNER, R_CHANGE_OWNER, R_CHDIR, R_CLONE, R_CLOSE, R_CONNECT, R_CREATE, R_DELETE, R_EXECUTE, R_LISTEN, R_MAP_EXEC, R_MOUNT, R_NET_SHUTDOWN, R_READ, R_READ_OPEN, R_READ_WRITE_OPEN, R_RECEIVE, R_RENAME, R_SEARCH, R_SEND, R_SHUTDOWN, R_TRACE, R_TRUNCATE, R_WRITE, R_WRITE_OPEN, RSBAC_EINVALIDATTR, RSBAC_EINVALIDTARGET, T_DEV, T_DIR, T_FIFO, T_FILE, T_GROUP, T_IPC, T_NETOBJ, T_NONE, T_PROCESS, T_SYMLINK, T_UNIXSOCK, and T_USER.
Referenced by rsbac_adf_set_attr().
00687 { 00688 switch (request) { 00689 case R_CLOSE: /* only notifying for clean-up of opened-tables */ 00690 switch (target) { 00691 case T_FILE: 00692 case T_DIR: 00693 case T_FIFO: 00694 case T_UNIXSOCK: 00695 case T_DEV: 00696 case T_IPC: 00697 case T_NETOBJ: 00698 return 0; 00699 default: 00700 return (-RSBAC_EINVALIDTARGET); 00701 }; 00702 00703 case R_APPEND_OPEN: 00704 switch (target) { 00705 case T_FILE: 00706 case T_FIFO: 00707 case T_UNIXSOCK: 00708 case T_DEV: 00709 return 0; 00710 /* all other cases are undefined */ 00711 default: 00712 return (-RSBAC_EINVALIDTARGET); 00713 } 00714 00715 case R_CHANGE_OWNER: 00716 switch (target) { 00717 /* Changing process owner affects access decisions, */ 00718 /* so attributes have to be adjusted. */ 00719 case T_PROCESS: 00720 /* there must be a new owner specified */ 00721 if (attr != A_owner) 00722 return (-RSBAC_EINVALIDATTR); 00723 /* fall through */ 00724 case T_FILE: 00725 case T_DIR: 00726 case T_FIFO: 00727 case T_SYMLINK: 00728 case T_UNIXSOCK: 00729 case T_IPC: 00730 case T_NONE: 00731 return 0; 00732 /* all other cases are undefined */ 00733 default: 00734 return (-RSBAC_EINVALIDTARGET); 00735 } 00736 00737 #ifdef CONFIG_RSBAC_DAC_OWNER 00738 case R_CHANGE_DAC_EFF_OWNER: 00739 case R_CHANGE_DAC_FS_OWNER: 00740 switch (target) { 00741 /* Changing process owner affects access decisions, */ 00742 /* so attributes have to be adjusted. */ 00743 case T_PROCESS: 00744 /* there must be a new owner specified */ 00745 if (attr != A_owner) 00746 return (-RSBAC_EINVALIDATTR); 00747 return 0; 00748 /* all other cases are undefined */ 00749 default: 00750 return (-RSBAC_EINVALIDTARGET); 00751 } 00752 #endif 00753 00754 case R_CHDIR: 00755 switch (target) { 00756 case T_DIR: 00757 return 0; 00758 default: 00759 return (-RSBAC_EINVALIDTARGET); 00760 }; 00761 00762 case R_CLONE: 00763 if (target == T_PROCESS) 00764 return 0; 00765 else 00766 return (-RSBAC_EINVALIDTARGET); 00767 00768 case R_CREATE: 00769 switch (target) { 00770 /* Creating dir or (pseudo) file IN target dir! */ 00771 case T_DIR: 00772 case T_IPC: 00773 #if defined(CONFIG_RSBAC_NET_OBJ) 00774 case T_NETOBJ: 00775 #endif 00776 #if defined(CONFIG_RSBAC_UM) 00777 case T_USER: 00778 case T_GROUP: 00779 #endif 00780 return 0; 00781 /* all other cases are undefined */ 00782 default: 00783 return (-RSBAC_EINVALIDTARGET); 00784 } 00785 00786 /* removal of targets is done in main adf dispatcher! */ 00787 case R_DELETE: 00788 switch (target) { 00789 case T_FILE: 00790 case T_DIR: 00791 case T_FIFO: 00792 case T_SYMLINK: 00793 case T_UNIXSOCK: 00794 case T_IPC: 00795 #if defined(CONFIG_RSBAC_UM) 00796 case T_USER: 00797 case T_GROUP: 00798 #endif 00799 return 0; 00800 /* all other cases are undefined */ 00801 default: 00802 return (-RSBAC_EINVALIDTARGET); 00803 } 00804 00805 case R_EXECUTE: 00806 switch (target) { 00807 case T_FILE: 00808 return 0; 00809 /* all other cases are undefined */ 00810 default: 00811 return (-RSBAC_EINVALIDTARGET); 00812 } 00813 00814 case R_BIND: 00815 case R_LISTEN: 00816 case R_ACCEPT: 00817 case R_CONNECT: 00818 case R_SEND: 00819 case R_RECEIVE: 00820 case R_NET_SHUTDOWN: 00821 switch (target) { 00822 case T_UNIXSOCK: 00823 case T_IPC: 00824 #if defined(CONFIG_RSBAC_NET_OBJ) 00825 case T_NETOBJ: 00826 #endif 00827 return 0; 00828 /* all other cases are undefined */ 00829 default: 00830 return (-RSBAC_EINVALIDTARGET); 00831 } 00832 00833 case R_MOUNT: 00834 switch (target) { 00835 case T_DIR: 00836 return 0; 00837 /* all other cases are undefined */ 00838 default: 00839 return (-RSBAC_EINVALIDTARGET); 00840 } 00841 00842 case R_READ: 00843 switch (target) { 00844 case T_DIR: 00845 #ifdef CONFIG_RSBAC_RW 00846 case T_FILE: 00847 case T_FIFO: 00848 case T_UNIXSOCK: 00849 case T_DEV: 00850 case T_IPC: 00851 #endif 00852 #if defined(CONFIG_RSBAC_NET_OBJ_RW) || defined(CONFIG_RSBAC_MS_SOCK) 00853 case T_NETOBJ: 00854 #endif 00855 return 0; 00856 /* all other cases are undefined */ 00857 default: 00858 return (-RSBAC_EINVALIDTARGET); 00859 } 00860 00861 case R_READ_OPEN: 00862 switch (target) { 00863 case T_FILE: 00864 case T_DIR: 00865 case T_FIFO: 00866 case T_IPC: 00867 case T_DEV: 00868 case T_UNIXSOCK: 00869 return 0; 00870 /* all other cases are undefined */ 00871 default: 00872 return (-RSBAC_EINVALIDTARGET); 00873 } 00874 00875 case R_READ_WRITE_OPEN: 00876 switch (target) { 00877 case T_FILE: 00878 case T_FIFO: 00879 case T_IPC: 00880 case T_DEV: 00881 case T_UNIXSOCK: 00882 return 0; 00883 /* all other cases are undefined */ 00884 default: 00885 return (-RSBAC_EINVALIDTARGET); 00886 } 00887 00888 case R_RENAME: 00889 switch (target) { 00890 case T_FILE: 00891 case T_DIR: 00892 case T_FIFO: 00893 case T_SYMLINK: 00894 case T_UNIXSOCK: 00895 return 0; 00896 /* all other cases are undefined */ 00897 default: 00898 return (-RSBAC_EINVALIDTARGET); 00899 } 00900 00901 case R_SEARCH: 00902 switch (target) { 00903 case T_DIR: 00904 case T_FILE: 00905 case T_SYMLINK: 00906 case T_FIFO: 00907 case T_UNIXSOCK: 00908 case T_DEV: 00909 case T_NETOBJ: 00910 return 0; 00911 /* all other cases are undefined */ 00912 default: 00913 return (-RSBAC_EINVALIDTARGET); 00914 } 00915 00916 #if defined(CONFIG_RSBAC_NET_OBJ) 00917 case R_SHUTDOWN: 00918 switch (target) { 00919 case T_NETOBJ: 00920 return 0; 00921 /* all other cases are undefined */ 00922 default: 00923 return (-RSBAC_EINVALIDTARGET); 00924 } 00925 #endif 00926 00927 case R_TRACE: 00928 switch (target) { 00929 case T_PROCESS: 00930 return 0; 00931 /* all other cases are undefined */ 00932 default: 00933 return (-RSBAC_EINVALIDTARGET); 00934 } 00935 00936 case R_TRUNCATE: 00937 switch (target) { 00938 case T_FILE: 00939 return 0; 00940 /* all other cases are undefined */ 00941 default: 00942 return (-RSBAC_EINVALIDTARGET); 00943 } 00944 00945 #ifdef CONFIG_RSBAC_RW 00946 case R_WRITE: 00947 switch (target) { 00948 case T_FILE: 00949 case T_FIFO: 00950 case T_DEV: 00951 case T_UNIXSOCK: 00952 case T_IPC: 00953 #if defined(CONFIG_RSBAC_NET_OBJ_RW) 00954 case T_NETOBJ: 00955 #endif 00956 return 0; 00957 /* all other cases are undefined */ 00958 default: 00959 return (-RSBAC_EINVALIDTARGET); 00960 } 00961 #endif 00962 00963 case R_WRITE_OPEN: 00964 switch (target) { 00965 case T_FILE: 00966 case T_FIFO: 00967 case T_DEV: 00968 case T_UNIXSOCK: 00969 return 0; 00970 /* all other cases are undefined */ 00971 default: 00972 return (-RSBAC_EINVALIDTARGET); 00973 } 00974 00975 case R_MAP_EXEC: 00976 switch (target) { 00977 case T_FILE: 00978 case T_NONE: 00979 return 0; 00980 /* all other cases are undefined */ 00981 default: 00982 return (-RSBAC_EINVALIDTARGET); 00983 } 00984 00985 00986 default: 00987 return (-RSBAC_EINVALIDTARGET); 00988 } 00989 00990 return (-RSBAC_EINVALIDTARGET); 00991 }