/linux-2.6.21.1-rsbac-1.3.4/include/rsbac/adf_main.h

Go to the documentation of this file.
00001 /************************************ */
00002 /* Rule Set Based Access Control      */
00003 /* Author and (c) 1999-2006:          */
00004 /*   Amon Ott <ao@rsbac.org>          */
00005 /* Data Structs etc. for Access       */
00006 /* Control Decision Facility          */
00007 /* Last modified: 11/Dec/2006         */
00008 /************************************ */
00009 
00010 #ifndef __RSBAC_ADF_MAIN_H
00011 #define __RSBAC_ADF_MAIN_H
00012 
00013 #include <linux/sched.h>
00014 #include <rsbac/types.h>
00015 
00016 #if defined(CONFIG_RSBAC_REG) || defined(CONFIG_RSBAC_REG_MAINT)
00017 #include <rsbac/reg.h>
00018 #endif
00019 
00020 #ifdef CONFIG_RSBAC_SECDEL
00021 #include <linux/dcache.h>
00022 #endif
00023 
00024 /***************************************************/
00025 /*              Global Variables                   */
00026 /***************************************************/
00027 
00028 extern u_long rsbac_adf_request_count[T_NONE+1];
00029 extern u_long rsbac_adf_set_attr_count[T_NONE+1];
00030 #ifdef CONFIG_RSBAC_XSTATS
00031 extern u_long rsbac_adf_request_xcount[T_NONE+1][R_NONE];
00032 extern u_long rsbac_adf_set_attr_xcount[T_NONE+1][R_NONE];
00033 #endif
00034 
00035 /* Bitmasks to ignore some requests on some modules */
00036 
00037 #ifdef CONFIG_RSBAC_MAC
00038 #define RSBAC_MAC_REQUEST_VECTOR (\
00039   ((rsbac_request_vector_t) 1 << R_ADD_TO_KERNEL) | \
00040   ((rsbac_request_vector_t) 1 << R_ALTER) | \
00041   ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00042   ((rsbac_request_vector_t) 1 << R_CHANGE_GROUP) | \
00043   ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00044   ((rsbac_request_vector_t) 1 << R_CHDIR) | \
00045   ((rsbac_request_vector_t) 1 << R_CLOSE) | \
00046   ((rsbac_request_vector_t) 1 << R_CREATE) | \
00047   ((rsbac_request_vector_t) 1 << R_DELETE) | \
00048   ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
00049   ((rsbac_request_vector_t) 1 << R_GET_PERMISSIONS_DATA) | \
00050   ((rsbac_request_vector_t) 1 << R_GET_STATUS_DATA) | \
00051   ((rsbac_request_vector_t) 1 << R_LINK_HARD) | \
00052   ((rsbac_request_vector_t) 1 << R_MODIFY_ACCESS_DATA) | \
00053   ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00054   ((rsbac_request_vector_t) 1 << R_MODIFY_PERMISSIONS_DATA) | \
00055   ((rsbac_request_vector_t) 1 << R_MODIFY_SYSTEM_DATA) | \
00056   ((rsbac_request_vector_t) 1 << R_MOUNT) | \
00057   ((rsbac_request_vector_t) 1 << R_READ) | \
00058   ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00059   ((rsbac_request_vector_t) 1 << R_READ_OPEN) | \
00060   ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00061   ((rsbac_request_vector_t) 1 << R_REMOVE_FROM_KERNEL) | \
00062   ((rsbac_request_vector_t) 1 << R_RENAME) | \
00063   ((rsbac_request_vector_t) 1 << R_SEARCH) | \
00064   ((rsbac_request_vector_t) 1 << R_SEND_SIGNAL) | \
00065   ((rsbac_request_vector_t) 1 << R_SHUTDOWN) | \
00066   ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00067   ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) | \
00068   ((rsbac_request_vector_t) 1 << R_TRACE) | \
00069   ((rsbac_request_vector_t) 1 << R_TRUNCATE) | \
00070   ((rsbac_request_vector_t) 1 << R_UMOUNT) | \
00071   ((rsbac_request_vector_t) 1 << R_WRITE) | \
00072   ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) | \
00073   ((rsbac_request_vector_t) 1 << R_MAP_EXEC) | \
00074   ((rsbac_request_vector_t) 1 << R_BIND) | \
00075   ((rsbac_request_vector_t) 1 << R_LISTEN) | \
00076   ((rsbac_request_vector_t) 1 << R_ACCEPT) | \
00077   ((rsbac_request_vector_t) 1 << R_CONNECT) | \
00078   ((rsbac_request_vector_t) 1 << R_SEND) | \
00079   ((rsbac_request_vector_t) 1 << R_RECEIVE) \
00080   )
00081 #define RSBAC_MAC_SET_ATTR_VECTOR (\
00082   ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00083   ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00084   ((rsbac_request_vector_t) 1 << R_CLONE) | \
00085   ((rsbac_request_vector_t) 1 << R_CREATE) | \
00086   ((rsbac_request_vector_t) 1 << R_DELETE) | \
00087   ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
00088   ((rsbac_request_vector_t) 1 << R_MOUNT) | \
00089   ((rsbac_request_vector_t) 1 << R_READ) | \
00090   ((rsbac_request_vector_t) 1 << R_READ_OPEN) | \
00091   ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00092   ((rsbac_request_vector_t) 1 << R_SEARCH) | \
00093   ((rsbac_request_vector_t) 1 << R_TRACE) | \
00094   ((rsbac_request_vector_t) 1 << R_WRITE) | \
00095   ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) | \
00096   ((rsbac_request_vector_t) 1 << R_BIND) | \
00097   ((rsbac_request_vector_t) 1 << R_LISTEN) | \
00098   ((rsbac_request_vector_t) 1 << R_ACCEPT) | \
00099   ((rsbac_request_vector_t) 1 << R_CONNECT) | \
00100   ((rsbac_request_vector_t) 1 << R_SEND) | \
00101   ((rsbac_request_vector_t) 1 << R_RECEIVE) \
00102   )
00103 #endif
00104 
00105 #ifdef CONFIG_RSBAC_PM
00106 #define RSBAC_PM_REQUEST_VECTOR (\
00107   ((rsbac_request_vector_t) 1 << R_ADD_TO_KERNEL) | \
00108   ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00109   ((rsbac_request_vector_t) 1 << R_CHANGE_GROUP) | \
00110   ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00111   ((rsbac_request_vector_t) 1 << R_CLONE) | \
00112   ((rsbac_request_vector_t) 1 << R_CLOSE) | \
00113   ((rsbac_request_vector_t) 1 << R_CREATE) | \
00114   ((rsbac_request_vector_t) 1 << R_DELETE) | \
00115   ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
00116   ((rsbac_request_vector_t) 1 << R_LINK_HARD) | \
00117   ((rsbac_request_vector_t) 1 << R_MODIFY_ACCESS_DATA) | \
00118   ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00119   ((rsbac_request_vector_t) 1 << R_MODIFY_PERMISSIONS_DATA) | \
00120   ((rsbac_request_vector_t) 1 << R_MODIFY_SYSTEM_DATA) | \
00121   ((rsbac_request_vector_t) 1 << R_MOUNT) | \
00122   ((rsbac_request_vector_t) 1 << R_READ) | \
00123   ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00124   ((rsbac_request_vector_t) 1 << R_READ_OPEN) | \
00125   ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00126   ((rsbac_request_vector_t) 1 << R_REMOVE_FROM_KERNEL) | \
00127   ((rsbac_request_vector_t) 1 << R_RENAME) | \
00128   ((rsbac_request_vector_t) 1 << R_SEND_SIGNAL) | \
00129   ((rsbac_request_vector_t) 1 << R_SHUTDOWN) | \
00130   ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00131   ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) | \
00132   ((rsbac_request_vector_t) 1 << R_TERMINATE) | \
00133   ((rsbac_request_vector_t) 1 << R_TRACE) | \
00134   ((rsbac_request_vector_t) 1 << R_TRUNCATE) | \
00135   ((rsbac_request_vector_t) 1 << R_UMOUNT) | \
00136   ((rsbac_request_vector_t) 1 << R_WRITE) | \
00137   ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) | \
00138   ((rsbac_request_vector_t) 1 << R_MAP_EXEC) \
00139   )
00140 #define RSBAC_PM_SET_ATTR_VECTOR (\
00141   ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00142   ((rsbac_request_vector_t) 1 << R_CLONE) | \
00143   ((rsbac_request_vector_t) 1 << R_CREATE) | \
00144   ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
00145   ((rsbac_request_vector_t) 1 << R_READ) | \
00146   ((rsbac_request_vector_t) 1 << R_READ_OPEN) | \
00147   ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00148   ((rsbac_request_vector_t) 1 << R_WRITE) | \
00149   ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) \
00150   )
00151 #endif
00152 
00153 #ifdef CONFIG_RSBAC_DAZ
00154 #define RSBAC_DAZ_REQUEST_VECTOR (\
00155   ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00156   ((rsbac_request_vector_t) 1 << R_CLOSE) | \
00157   ((rsbac_request_vector_t) 1 << R_DELETE) | \
00158   ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
00159   ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00160   ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00161   ((rsbac_request_vector_t) 1 << R_READ_OPEN) | \
00162   ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00163   ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) | \
00164   ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) \
00165   )
00166 #define RSBAC_DAZ_SET_ATTR_VECTOR (\
00167   ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00168   ((rsbac_request_vector_t) 1 << R_CLONE) | \
00169   ((rsbac_request_vector_t) 1 << R_CLOSE) | \
00170   ((rsbac_request_vector_t) 1 << R_DELETE) | \
00171   ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
00172   ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00173   ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00174   ((rsbac_request_vector_t) 1 << R_READ_OPEN) | \
00175   ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00176   ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) | \
00177   ((rsbac_request_vector_t) 1 << R_WRITE) | \
00178   ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) )
00179 #endif
00180 
00181 #ifdef CONFIG_RSBAC_FF
00182 #if defined(CONFIG_RSBAC_FF_UM_PROT)
00183 #define RSBAC_FF_REQUEST_VECTOR (\
00184   ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00185   ((rsbac_request_vector_t) 1 << R_CHANGE_GROUP) | \
00186   ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00187   ((rsbac_request_vector_t) 1 << R_CHDIR) | \
00188   ((rsbac_request_vector_t) 1 << R_CREATE) | \
00189   ((rsbac_request_vector_t) 1 << R_DELETE) | \
00190   ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
00191   ((rsbac_request_vector_t) 1 << R_GET_PERMISSIONS_DATA) | \
00192   ((rsbac_request_vector_t) 1 << R_GET_STATUS_DATA) | \
00193   ((rsbac_request_vector_t) 1 << R_LINK_HARD) | \
00194   ((rsbac_request_vector_t) 1 << R_MODIFY_ACCESS_DATA) | \
00195   ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00196   ((rsbac_request_vector_t) 1 << R_MODIFY_PERMISSIONS_DATA) | \
00197   ((rsbac_request_vector_t) 1 << R_MODIFY_SYSTEM_DATA) | \
00198   ((rsbac_request_vector_t) 1 << R_MOUNT) | \
00199   ((rsbac_request_vector_t) 1 << R_READ) | \
00200   ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00201   ((rsbac_request_vector_t) 1 << R_READ_OPEN) | \
00202   ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00203   ((rsbac_request_vector_t) 1 << R_RENAME) | \
00204   ((rsbac_request_vector_t) 1 << R_SEARCH) | \
00205   ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00206   ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) | \
00207   ((rsbac_request_vector_t) 1 << R_TRUNCATE) | \
00208   ((rsbac_request_vector_t) 1 << R_UMOUNT) | \
00209   ((rsbac_request_vector_t) 1 << R_WRITE) | \
00210   ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) | \
00211   ((rsbac_request_vector_t) 1 << R_MAP_EXEC) \
00212   )
00213 #else
00214 #define RSBAC_FF_REQUEST_VECTOR (\
00215   ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00216   ((rsbac_request_vector_t) 1 << R_CHANGE_GROUP) | \
00217   ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00218   ((rsbac_request_vector_t) 1 << R_CHANGE_DAC_EFF_GROUP) | \
00219   ((rsbac_request_vector_t) 1 << R_CHANGE_DAC_FS_GROUP) | \
00220   ((rsbac_request_vector_t) 1 << R_CHANGE_DAC_EFF_OWNER) | \
00221   ((rsbac_request_vector_t) 1 << R_CHANGE_DAC_FS_OWNER) | \
00222   ((rsbac_request_vector_t) 1 << R_CHDIR) | \
00223   ((rsbac_request_vector_t) 1 << R_CREATE) | \
00224   ((rsbac_request_vector_t) 1 << R_DELETE) | \
00225   ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
00226   ((rsbac_request_vector_t) 1 << R_GET_STATUS_DATA) | \
00227   ((rsbac_request_vector_t) 1 << R_LINK_HARD) | \
00228   ((rsbac_request_vector_t) 1 << R_MODIFY_ACCESS_DATA) | \
00229   ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00230   ((rsbac_request_vector_t) 1 << R_MODIFY_PERMISSIONS_DATA) | \
00231   ((rsbac_request_vector_t) 1 << R_MODIFY_SYSTEM_DATA) | \
00232   ((rsbac_request_vector_t) 1 << R_MOUNT) | \
00233   ((rsbac_request_vector_t) 1 << R_READ) | \
00234   ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00235   ((rsbac_request_vector_t) 1 << R_READ_OPEN) | \
00236   ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00237   ((rsbac_request_vector_t) 1 << R_RENAME) | \
00238   ((rsbac_request_vector_t) 1 << R_SEARCH) | \
00239   ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00240   ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) | \
00241   ((rsbac_request_vector_t) 1 << R_TRUNCATE) | \
00242   ((rsbac_request_vector_t) 1 << R_UMOUNT) | \
00243   ((rsbac_request_vector_t) 1 << R_WRITE) | \
00244   ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) | \
00245   ((rsbac_request_vector_t) 1 << R_MAP_EXEC) \
00246   )
00247 #endif
00248 #endif
00249 
00250 #ifdef CONFIG_RSBAC_AUTH
00251 #if defined(CONFIG_RSBAC_AUTH_UM_PROT)
00252 #define RSBAC_AUTH_REQUEST_VECTOR_UM (\
00253   ((rsbac_request_vector_t) 1 << R_CREATE) | \
00254   ((rsbac_request_vector_t) 1 << R_DELETE) | \
00255   ((rsbac_request_vector_t) 1 << R_GET_PERMISSIONS_DATA) | \
00256   ((rsbac_request_vector_t) 1 << R_RENAME) | \
00257   ((rsbac_request_vector_t) 1 << R_WRITE) )
00258 #else
00259 #define RSBAC_AUTH_REQUEST_VECTOR_UM 0
00260 #endif
00261 #if defined(CONFIG_RSBAC_AUTH_UM_PROT) || defined(CONFIG_RSBAC_AUTH_GROUP)
00262 #define RSBAC_AUTH_REQUEST_VECTOR_CG ((rsbac_request_vector_t) 1 << R_CHANGE_GROUP)
00263 #else
00264 #define RSBAC_AUTH_REQUEST_VECTOR_CG 0
00265 #endif
00266 #if defined(CONFIG_RSBAC_AUTH_GROUP) && defined (CONFIG_RSBAC_AUTH_DAC_GROUP)
00267 #define RSBAC_AUTH_REQUEST_VECTOR_DG ( \
00268   ((rsbac_request_vector_t) 1 << R_CHANGE_DAC_EFF_GROUP) | \
00269   ((rsbac_request_vector_t) 1 << R_CHANGE_DAC_FS_GROUP) )
00270 #else
00271 #define RSBAC_AUTH_REQUEST_VECTOR_DG 0
00272 #endif
00273 #if defined (CONFIG_RSBAC_AUTH_DAC_OWNER)
00274 #define RSBAC_AUTH_REQUEST_VECTOR_DO ( \
00275   ((rsbac_request_vector_t) 1 << R_CHANGE_DAC_EFF_OWNER) | \
00276   ((rsbac_request_vector_t) 1 << R_CHANGE_DAC_FS_OWNER) )
00277 #else
00278 #define RSBAC_AUTH_REQUEST_VECTOR_DO 0
00279 #endif
00280 #if defined (CONFIG_RSBAC_AUTH_AUTH_PROT)
00281 #define RSBAC_AUTH_REQUEST_VECTOR_AA ( \
00282   ((rsbac_request_vector_t) 1 << R_GET_STATUS_DATA) | \
00283   ((rsbac_request_vector_t) 1 << R_MODIFY_PERMISSIONS_DATA) | \
00284   ((rsbac_request_vector_t) 1 << R_MODIFY_SYSTEM_DATA) | \
00285   ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00286   ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) )
00287 #else
00288 #define RSBAC_AUTH_REQUEST_VECTOR_AA 0
00289 #endif
00290 
00291 #define RSBAC_AUTH_REQUEST_VECTOR (\
00292   RSBAC_AUTH_REQUEST_VECTOR_UM | \
00293   ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00294   RSBAC_AUTH_REQUEST_VECTOR_CG | \
00295   RSBAC_AUTH_REQUEST_VECTOR_DG | \
00296   RSBAC_AUTH_REQUEST_VECTOR_DO | \
00297   RSBAC_AUTH_REQUEST_VECTOR_AA | \
00298   ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) \
00299   )
00300 
00301 #if defined (CONFIG_RSBAC_AUTH_AUTH_PROT)
00302 #define RSBAC_AUTH_SET_ATTR_VECTOR_AA ( \
00303   ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00304   ((rsbac_request_vector_t) 1 << R_CHANGE_GROUP) | \
00305   ((rsbac_request_vector_t) 1 << R_DELETE) | \
00306   ((rsbac_request_vector_t) 1 << R_LINK_HARD) | \
00307   ((rsbac_request_vector_t) 1 << R_MODIFY_ACCESS_DATA) | \
00308   ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00309   ((rsbac_request_vector_t) 1 << R_RENAME) | \
00310   ((rsbac_request_vector_t) 1 << R_TRUNCATE) | \
00311   ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) )
00312 #else
00313 #define RSBAC_AUTH_SET_ATTR_VECTOR_AA 0
00314 #endif
00315 #define RSBAC_AUTH_SET_ATTR_VECTOR (\
00316   RSBAC_AUTH_SET_ATTR_VECTOR_AA | \
00317   ((rsbac_request_vector_t) 1 << R_CLONE) | \
00318   ((rsbac_request_vector_t) 1 << R_EXECUTE) \
00319   )
00320 #endif
00321 
00322 #ifdef CONFIG_RSBAC_CAP
00323 #ifdef CONFIG_RSBAC_CAP_PROC_HIDE
00324 #define RSBAC_CAP_REQUEST_VECTOR ( \
00325   ((rsbac_request_vector_t) 1 << R_CHANGE_GROUP) | \
00326   ((rsbac_request_vector_t) 1 << R_GET_STATUS_DATA) | \
00327   ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00328   ((rsbac_request_vector_t) 1 << R_MODIFY_SYSTEM_DATA) | \
00329   ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00330   ((rsbac_request_vector_t) 1 << R_SEND_SIGNAL) | \
00331   ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00332   ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) | \
00333   ((rsbac_request_vector_t) 1 << R_TRACE) )
00334 #else
00335 #define RSBAC_CAP_REQUEST_VECTOR (\
00336   ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00337   ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00338   ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00339   ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) )
00340 #endif
00341 #if defined (CONFIG_RSBAC_CAP_PROC_HIDE) || defined(CONFIG_RSBAC_CAP_LOG_MISSING)
00342 #define RSBAC_CAP_SET_ATTR_VECTOR (\
00343   ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00344   ((rsbac_request_vector_t) 1 << R_CLONE) | \
00345   ((rsbac_request_vector_t) 1 << R_EXECUTE) )
00346 #else
00347 #define RSBAC_CAP_SET_ATTR_VECTOR (\
00348   ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00349   ((rsbac_request_vector_t) 1 << R_EXECUTE) )
00350 #endif
00351 #endif
00352 
00353 #ifdef CONFIG_RSBAC_JAIL
00354 #define RSBAC_JAIL_REQUEST_VECTOR ( \
00355   ((rsbac_request_vector_t) 1 << R_ADD_TO_KERNEL) | \
00356   ((rsbac_request_vector_t) 1 << R_ALTER) | \
00357   ((rsbac_request_vector_t) 1 << R_APPEND_OPEN) | \
00358   ((rsbac_request_vector_t) 1 << R_CREATE) | \
00359   ((rsbac_request_vector_t) 1 << R_DELETE) | \
00360   ((rsbac_request_vector_t) 1 << R_GET_PERMISSIONS_DATA) | \
00361   ((rsbac_request_vector_t) 1 << R_GET_STATUS_DATA) | \
00362   ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00363   ((rsbac_request_vector_t) 1 << R_MODIFY_PERMISSIONS_DATA) | \
00364   ((rsbac_request_vector_t) 1 << R_MODIFY_SYSTEM_DATA) | \
00365   ((rsbac_request_vector_t) 1 << R_MOUNT) | \
00366   ((rsbac_request_vector_t) 1 << R_READ) | \
00367   ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00368   ((rsbac_request_vector_t) 1 << R_READ_OPEN) | \
00369   ((rsbac_request_vector_t) 1 << R_READ_WRITE_OPEN) | \
00370   ((rsbac_request_vector_t) 1 << R_REMOVE_FROM_KERNEL) | \
00371   ((rsbac_request_vector_t) 1 << R_SEND_SIGNAL) | \
00372   ((rsbac_request_vector_t) 1 << R_SHUTDOWN) | \
00373   ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00374   ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) | \
00375   ((rsbac_request_vector_t) 1 << R_TRACE) | \
00376   ((rsbac_request_vector_t) 1 << R_UMOUNT) | \
00377   ((rsbac_request_vector_t) 1 << R_WRITE) | \
00378   ((rsbac_request_vector_t) 1 << R_WRITE_OPEN) | \
00379   ((rsbac_request_vector_t) 1 << R_BIND) | \
00380   ((rsbac_request_vector_t) 1 << R_LISTEN) | \
00381   ((rsbac_request_vector_t) 1 << R_ACCEPT) | \
00382   ((rsbac_request_vector_t) 1 << R_CONNECT) | \
00383   ((rsbac_request_vector_t) 1 << R_SEND) | \
00384   ((rsbac_request_vector_t) 1 << R_RECEIVE) | \
00385   ((rsbac_request_vector_t) 1 << R_NET_SHUTDOWN) )
00386 #define RSBAC_JAIL_SET_ATTR_VECTOR ( \
00387   ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00388   ((rsbac_request_vector_t) 1 << R_CLONE) | \
00389   ((rsbac_request_vector_t) 1 << R_CREATE) | \
00390   ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
00391   ((rsbac_request_vector_t) 1 << R_BIND) )
00392 #endif
00393 
00394 #ifdef CONFIG_RSBAC_PAX
00395 #define RSBAC_PAX_REQUEST_VECTOR ( \
00396   ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00397   ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00398   ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00399   ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) )
00400 #endif
00401 
00402 #ifdef CONFIG_RSBAC_RES
00403 #define RSBAC_RES_REQUEST_VECTOR ( \
00404   ((rsbac_request_vector_t) 1 << R_MODIFY_ATTRIBUTE) | \
00405   ((rsbac_request_vector_t) 1 << R_READ_ATTRIBUTE) | \
00406   ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) | \
00407   ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) )
00408 #define RSBAC_RES_SET_ATTR_VECTOR ( \
00409   ((rsbac_request_vector_t) 1 << R_CHANGE_OWNER) | \
00410   ((rsbac_request_vector_t) 1 << R_EXECUTE) )
00411 #endif
00412 
00413 /***************************************************/
00414 /*              General Prototypes                 */
00415 /***************************************************/
00416 
00417 /* We call this function in kernel/sched.c         */
00418 extern struct task_struct * find_process_by_pid(pid_t);
00419 
00420 #ifdef CONFIG_RSBAC_DEBUG
00421 extern  enum rsbac_adf_req_ret_t
00422    rsbac_adf_request_check (enum  rsbac_adf_request_t     request,
00423                                   rsbac_pid_t             caller_pid,
00424                             enum  rsbac_target_t          target,
00425                             union rsbac_target_id_t     * tid_p,
00426                             enum  rsbac_attribute_t       attr,
00427                             union rsbac_attribute_value_t * attr_val_p,
00428                                   rsbac_uid_t             owner);
00429 
00430 extern int rsbac_adf_set_attr_check( enum  rsbac_adf_request_t,
00431                                            rsbac_pid_t,
00432                                      enum  rsbac_target_t,
00433                                      union rsbac_target_id_t,
00434                                      enum  rsbac_target_t,
00435                                      union rsbac_target_id_t,
00436                                      enum  rsbac_attribute_t,
00437                                      union rsbac_attribute_value_t,
00438                                            rsbac_uid_t); /* process owner */
00439 #endif
00440 
00441 extern enum rsbac_adf_req_ret_t
00442     adf_and_plus(enum rsbac_adf_req_ret_t res1,
00443                  enum rsbac_adf_req_ret_t res2);
00444 
00445 /***************************************************/
00446 /*              Module Prototypes                  */
00447 /***************************************************/
00448 
00449 #if !defined(CONFIG_RSBAC_MAINT)
00450 
00451 /******* MAC ********/
00452 
00453 #ifdef CONFIG_RSBAC_MAC
00454 #ifdef CONFIG_RSBAC_SWITCH_MAC
00455 extern  rsbac_boolean_t rsbac_switch_mac;
00456 #endif
00457 
00458 extern  enum rsbac_adf_req_ret_t  rsbac_adf_request_mac(
00459                                      enum  rsbac_adf_request_t,
00460                                            rsbac_pid_t,
00461                                      enum  rsbac_target_t,
00462                                      union rsbac_target_id_t,
00463                                      enum  rsbac_attribute_t,
00464                                      union rsbac_attribute_value_t,
00465                                            rsbac_uid_t); /* process owner */
00466 
00467 extern  int  rsbac_adf_set_attr_mac( enum  rsbac_adf_request_t,
00468                                            rsbac_pid_t,
00469                                      enum  rsbac_target_t,
00470                                      union rsbac_target_id_t,
00471                                      enum  rsbac_target_t,
00472                                      union rsbac_target_id_t,
00473                                      enum  rsbac_attribute_t,
00474                                      union rsbac_attribute_value_t,
00475                                            rsbac_uid_t); /* process owner */
00476 
00477 #endif  /* MAC */
00478 
00479 
00480 /******* PM ********/
00481 
00482 #ifdef CONFIG_RSBAC_PM
00483 #ifdef CONFIG_RSBAC_SWITCH_PM
00484 extern  rsbac_boolean_t rsbac_switch_pm;
00485 #endif
00486 
00487 extern  enum rsbac_adf_req_ret_t  rsbac_adf_request_pm(
00488                                      enum  rsbac_adf_request_t,
00489                                            rsbac_pid_t,
00490                                      enum  rsbac_target_t,
00491                                      union rsbac_target_id_t,
00492                                      enum  rsbac_attribute_t,
00493                                      union rsbac_attribute_value_t,
00494                                            rsbac_uid_t); /* process owner */
00495 
00496 extern  int  rsbac_adf_set_attr_pm ( enum  rsbac_adf_request_t,
00497                                            rsbac_pid_t,
00498                                      enum  rsbac_target_t,
00499                                      union rsbac_target_id_t,
00500                                      enum  rsbac_target_t,
00501                                      union rsbac_target_id_t,
00502                                      enum  rsbac_attribute_t,
00503                                      union rsbac_attribute_value_t,
00504                                            rsbac_uid_t); /* process owner */
00505 
00506 #ifdef CONFIG_RSBAC_SECDEL
00507 extern rsbac_boolean_t rsbac_need_overwrite_pm(struct dentry * dentry_p);
00508 #endif
00509 
00510 #endif  /* PM */
00511 
00512 /******* DAZ ********/
00513 
00514 #ifdef CONFIG_RSBAC_DAZ
00515 #ifdef CONFIG_RSBAC_SWITCH_DAZ
00516 extern  rsbac_boolean_t rsbac_switch_daz;
00517 #endif
00518 
00519 extern  enum rsbac_adf_req_ret_t  rsbac_adf_request_daz(
00520                                      enum  rsbac_adf_request_t,
00521                                            rsbac_pid_t,
00522                                      enum  rsbac_target_t,
00523                                      union rsbac_target_id_t,
00524                                      enum  rsbac_attribute_t,
00525                                      union rsbac_attribute_value_t,
00526                                            rsbac_uid_t); /* process owner */
00527 
00528 extern  int  rsbac_adf_set_attr_daz (enum  rsbac_adf_request_t,
00529                                            rsbac_pid_t,
00530                                      enum  rsbac_target_t,
00531                                      union rsbac_target_id_t,
00532                                      enum  rsbac_target_t,
00533                                      union rsbac_target_id_t,
00534                                      enum  rsbac_attribute_t,
00535                                      union rsbac_attribute_value_t,
00536                                            rsbac_uid_t); /* process owner */
00537 
00538 #endif  /* DAZ */
00539  
00540 /******* FF ********/
00541 
00542 #ifdef CONFIG_RSBAC_FF
00543 #ifdef CONFIG_RSBAC_SWITCH_FF
00544 extern  rsbac_boolean_t rsbac_switch_ff;
00545 #endif
00546 
00547 extern  enum rsbac_adf_req_ret_t  rsbac_adf_request_ff(
00548                                      enum  rsbac_adf_request_t,
00549                                            rsbac_pid_t,
00550                                      enum  rsbac_target_t,
00551                                      union rsbac_target_id_t,
00552                                      enum  rsbac_attribute_t,
00553                                      union rsbac_attribute_value_t,
00554                                            rsbac_uid_t); /* process owner */
00555 
00556 extern  int  rsbac_adf_set_attr_ff ( enum  rsbac_adf_request_t,
00557                                            rsbac_pid_t,
00558                                      enum  rsbac_target_t,
00559                                      union rsbac_target_id_t,
00560                                      enum  rsbac_target_t,
00561                                      union rsbac_target_id_t,
00562                                      enum  rsbac_attribute_t,
00563                                      union rsbac_attribute_value_t,
00564                                            rsbac_uid_t); /* process owner */
00565 
00566 #ifdef CONFIG_RSBAC_SECDEL
00567 extern rsbac_boolean_t rsbac_need_overwrite_ff(struct dentry * dentry_p);
00568 #endif
00569 
00570 #endif  /* FF */
00571  
00572 /******* RC ********/
00573 
00574 #ifdef CONFIG_RSBAC_RC
00575 #ifdef CONFIG_RSBAC_SWITCH_RC
00576 extern  rsbac_boolean_t rsbac_switch_rc;
00577 #endif
00578 
00579 extern  enum rsbac_adf_req_ret_t  rsbac_adf_request_rc(
00580                                      enum  rsbac_adf_request_t,
00581                                            rsbac_pid_t,
00582                                      enum  rsbac_target_t,
00583                                      union rsbac_target_id_t,
00584                                      enum  rsbac_attribute_t,
00585                                      union rsbac_attribute_value_t,
00586                                            rsbac_uid_t); /* process owner */
00587 
00588 extern  int  rsbac_adf_set_attr_rc ( enum  rsbac_adf_request_t,
00589                                            rsbac_pid_t,
00590                                      enum  rsbac_target_t,
00591                                      union rsbac_target_id_t,
00592                                      enum  rsbac_target_t,
00593                                      union rsbac_target_id_t,
00594                                      enum  rsbac_attribute_t,
00595                                      union rsbac_attribute_value_t,
00596                                            rsbac_uid_t); /* process owner */
00597 
00598 /* Secure delete/truncate for this module */
00599 #ifdef CONFIG_RSBAC_SECDEL
00600 extern rsbac_boolean_t rsbac_need_overwrite_rc(struct dentry * dentry_p);
00601 #endif
00602 #endif  /* RC */
00603 
00604 /****** AUTH *******/
00605 
00606 #ifdef CONFIG_RSBAC_AUTH
00607 #ifdef CONFIG_RSBAC_SWITCH_AUTH
00608 extern  rsbac_boolean_t rsbac_switch_auth;
00609 #endif
00610 
00611 extern  enum rsbac_adf_req_ret_t  rsbac_adf_request_auth(
00612                                      enum  rsbac_adf_request_t,
00613                                            rsbac_pid_t,
00614                                      enum  rsbac_target_t,
00615                                      union rsbac_target_id_t,
00616                                      enum  rsbac_attribute_t,
00617                                      union rsbac_attribute_value_t,
00618                                            rsbac_uid_t); /* process owner */
00619 
00620 extern  int  rsbac_adf_set_attr_auth(enum  rsbac_adf_request_t,
00621                                            rsbac_pid_t,
00622                                      enum  rsbac_target_t,
00623                                      union rsbac_target_id_t,
00624                                      enum  rsbac_target_t,
00625                                      union rsbac_target_id_t,
00626                                      enum  rsbac_attribute_t,
00627                                      union rsbac_attribute_value_t,
00628                                            rsbac_uid_t); /* process owner */
00629 
00630 #endif /* AUTH */
00631 
00632 /****** ACL *******/
00633 
00634 #ifdef CONFIG_RSBAC_ACL
00635 #ifdef CONFIG_RSBAC_SWITCH_ACL
00636 extern  rsbac_boolean_t rsbac_switch_acl;
00637 #endif
00638 
00639 extern  enum rsbac_adf_req_ret_t  rsbac_adf_request_acl(
00640                                      enum  rsbac_adf_request_t,
00641                                            rsbac_pid_t,
00642                                      enum  rsbac_target_t,
00643                                      union rsbac_target_id_t,
00644                                      enum  rsbac_attribute_t,
00645                                      union rsbac_attribute_value_t,
00646                                            rsbac_uid_t); /* process owner */
00647 
00648 extern  int  rsbac_adf_set_attr_acl (enum  rsbac_adf_request_t,
00649                                            rsbac_pid_t,
00650                                      enum  rsbac_target_t,
00651                                      union rsbac_target_id_t,
00652                                      enum  rsbac_target_t,
00653                                      union rsbac_target_id_t,
00654                                      enum  rsbac_attribute_t,
00655                                      union rsbac_attribute_value_t,
00656                                            rsbac_uid_t); /* process owner */
00657 
00658 #endif /* ACL */
00659 
00660 /****** CAP *******/
00661 
00662 #ifdef CONFIG_RSBAC_CAP
00663 #ifdef CONFIG_RSBAC_SWITCH_CAP
00664 extern  rsbac_boolean_t rsbac_switch_cap;
00665 #endif
00666 
00667 extern  enum rsbac_adf_req_ret_t  rsbac_adf_request_cap(
00668                                      enum  rsbac_adf_request_t,
00669                                            rsbac_pid_t,
00670                                      enum  rsbac_target_t,
00671                                      union rsbac_target_id_t,
00672                                      enum  rsbac_attribute_t,
00673                                      union rsbac_attribute_value_t,
00674                                            rsbac_uid_t); /* process owner */
00675 
00676 extern  int  rsbac_adf_set_attr_cap (enum  rsbac_adf_request_t,
00677                                            rsbac_pid_t,
00678                                      enum  rsbac_target_t,
00679                                      union rsbac_target_id_t,
00680                                      enum  rsbac_target_t,
00681                                      union rsbac_target_id_t,
00682                                      enum  rsbac_attribute_t,
00683                                      union rsbac_attribute_value_t,
00684                                            rsbac_uid_t); /* process owner */
00685 
00686 #endif /* CAP */
00687 
00688 /****** JAIL *******/
00689 
00690 #ifdef CONFIG_RSBAC_JAIL
00691 #ifdef CONFIG_RSBAC_SWITCH_JAIL
00692 extern  rsbac_boolean_t rsbac_switch_jail;
00693 #endif
00694 
00695 extern  enum rsbac_adf_req_ret_t  rsbac_adf_request_jail(
00696                                      enum  rsbac_adf_request_t,
00697                                            rsbac_pid_t,
00698                                      enum  rsbac_target_t,
00699                                      union rsbac_target_id_t,
00700                                      enum  rsbac_attribute_t,
00701                                      union rsbac_attribute_value_t,
00702                                            rsbac_uid_t); /* process owner */
00703 
00704 extern  int  rsbac_adf_set_attr_jail(enum  rsbac_adf_request_t,
00705                                            rsbac_pid_t,
00706                                      enum  rsbac_target_t,
00707                                      union rsbac_target_id_t,
00708                                      enum  rsbac_target_t,
00709                                      union rsbac_target_id_t,
00710                                      enum  rsbac_attribute_t,
00711                                      union rsbac_attribute_value_t,
00712                                            rsbac_uid_t); /* process owner */
00713 
00714 #endif /* JAIL */
00715 
00716 /******* PAX ********/
00717 
00718 #ifdef CONFIG_RSBAC_PAX
00719 #ifdef CONFIG_RSBAC_SWITCH_PAX
00720 extern  rsbac_boolean_t rsbac_switch_pax;
00721 #endif
00722 
00723 extern  enum rsbac_adf_req_ret_t  rsbac_adf_request_pax(
00724                                      enum  rsbac_adf_request_t,
00725                                            rsbac_pid_t,
00726                                      enum  rsbac_target_t,
00727                                      union rsbac_target_id_t,
00728                                      enum  rsbac_attribute_t,
00729                                      union rsbac_attribute_value_t,
00730                                            rsbac_uid_t); /* process owner */
00731 
00732 extern  int  rsbac_adf_set_attr_pax( enum  rsbac_adf_request_t,
00733                                            rsbac_pid_t,
00734                                      enum  rsbac_target_t,
00735                                      union rsbac_target_id_t,
00736                                      enum  rsbac_target_t,
00737                                      union rsbac_target_id_t,
00738                                      enum  rsbac_attribute_t,
00739                                      union rsbac_attribute_value_t,
00740                                            rsbac_uid_t); /* process owner */
00741 
00742 #endif  /* PAX */
00743 
00744 
00745 /****** RES *******/
00746 
00747 #ifdef CONFIG_RSBAC_RES
00748 #ifdef CONFIG_RSBAC_SWITCH_RES
00749 extern  rsbac_boolean_t rsbac_switch_res;
00750 #endif
00751 
00752 extern  enum rsbac_adf_req_ret_t  rsbac_adf_request_res(
00753                                      enum  rsbac_adf_request_t,
00754                                            rsbac_pid_t,
00755                                      enum  rsbac_target_t,
00756                                      union rsbac_target_id_t,
00757                                      enum  rsbac_attribute_t,
00758                                      union rsbac_attribute_value_t,
00759                                            rsbac_uid_t); /* process owner */
00760 
00761 extern  int  rsbac_adf_set_attr_res (enum  rsbac_adf_request_t,
00762                                            rsbac_pid_t,
00763                                      enum  rsbac_target_t,
00764                                      union rsbac_target_id_t,
00765                                      enum  rsbac_target_t,
00766                                      union rsbac_target_id_t,
00767                                      enum  rsbac_attribute_t,
00768                                      union rsbac_attribute_value_t,
00769                                            rsbac_uid_t); /* process owner */
00770 
00771 #ifdef CONFIG_RSBAC_SECDEL
00772 extern inline rsbac_boolean_t rsbac_need_overwrite_res(struct dentry * dentry_p)
00773   {
00774     return FALSE;
00775   }
00776 #endif
00777 #endif /* RES */
00778 
00779 /****** REG *******/
00780 
00781 #if defined(CONFIG_RSBAC_REG)
00782 extern  enum rsbac_adf_req_ret_t  rsbac_adf_request_reg(
00783                                      enum  rsbac_adf_request_t,
00784                                            rsbac_pid_t,
00785                                      enum  rsbac_target_t,
00786                                      union rsbac_target_id_t,
00787                                      enum  rsbac_attribute_t,
00788                                      union rsbac_attribute_value_t,
00789                                            rsbac_uid_t); /* process owner */
00790 
00791 extern  int  rsbac_adf_set_attr_reg (enum  rsbac_adf_request_t,
00792                                            rsbac_pid_t,
00793                                      enum  rsbac_target_t,
00794                                      union rsbac_target_id_t,
00795                                      enum  rsbac_target_t,
00796                                      union rsbac_target_id_t,
00797                                      enum  rsbac_attribute_t,
00798                                      union rsbac_attribute_value_t,
00799                                            rsbac_uid_t); /* process owner */
00800 
00801 #ifdef CONFIG_RSBAC_SECDEL
00802 extern inline rsbac_boolean_t rsbac_need_overwrite_reg(struct dentry * dentry_p)
00803   {
00804     return FALSE;
00805   }
00806 #endif
00807 #endif /* REG */
00808 
00809 #endif /* !MAINT */
00810 
00811 #if defined(CONFIG_RSBAC_REG) || defined(CONFIG_RSBAC_REG_MAINT)
00812 /* Init */
00813 #ifdef CONFIG_RSBAC_INIT_DELAY
00814 void rsbac_reg_init(void);
00815 #else
00816 void rsbac_reg_init(void) __init;
00817 #endif
00818 
00819 /* mounting and umounting */
00820 extern int rsbac_mount_reg(kdev_t kdev);
00821 extern int rsbac_umount_reg(kdev_t kdev);
00822 
00823 /* RSBAC attribute saving to disk can be triggered from outside
00824  * param: call lock_kernel() before writing?
00825  */
00826 #if defined(CONFIG_RSBAC_AUTO_WRITE)
00827 extern int rsbac_write_reg(rsbac_boolean_t);
00828 #endif /* CONFIG_RSBAC_AUTO_WRITE */
00829 
00830 /* Status checking */
00831 extern int rsbac_check_reg(int correct, int check_inode);
00832 
00833 #endif /* REG */
00834 
00835 #endif /* End of adf_main.h */

Generated on Wed May 16 11:53:27 2007 for RSBAC by  doxygen 1.5.1