smack.h 5.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212
  1. /*
  2. * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
  3. *
  4. * This program is free software; you can redistribute it and/or modify
  5. * it under the terms of the GNU General Public License as published by
  6. * the Free Software Foundation, version 2.
  7. *
  8. * Author:
  9. * Casey Schaufler <casey@schaufler-ca.com>
  10. *
  11. */
  12. #ifndef _SECURITY_SMACK_H
  13. #define _SECURITY_SMACK_H
  14. #include <linux/capability.h>
  15. #include <linux/spinlock.h>
  16. #include <net/netlabel.h>
  17. /*
  18. * Why 23? CIPSO is constrained to 30, so a 32 byte buffer is
  19. * bigger than can be used, and 24 is the next lower multiple
  20. * of 8, and there are too many issues if there isn't space set
  21. * aside for the terminating null byte.
  22. */
  23. #define SMK_MAXLEN 23
  24. #define SMK_LABELLEN (SMK_MAXLEN+1)
  25. struct superblock_smack {
  26. char *smk_root;
  27. char *smk_floor;
  28. char *smk_hat;
  29. char *smk_default;
  30. int smk_initialized;
  31. spinlock_t smk_sblock; /* for initialization */
  32. };
  33. struct socket_smack {
  34. char *smk_out; /* outbound label */
  35. char *smk_in; /* inbound label */
  36. char smk_packet[SMK_LABELLEN]; /* TCP peer label */
  37. };
  38. /*
  39. * Inode smack data
  40. */
  41. struct inode_smack {
  42. char *smk_inode; /* label of the fso */
  43. struct mutex smk_lock; /* initialization lock */
  44. int smk_flags; /* smack inode flags */
  45. };
  46. #define SMK_INODE_INSTANT 0x01 /* inode is instantiated */
  47. /*
  48. * A label access rule.
  49. */
  50. struct smack_rule {
  51. char *smk_subject;
  52. char *smk_object;
  53. int smk_access;
  54. };
  55. /*
  56. * An entry in the table of permitted label accesses.
  57. */
  58. struct smk_list_entry {
  59. struct smk_list_entry *smk_next;
  60. struct smack_rule smk_rule;
  61. };
  62. /*
  63. * An entry in the table mapping smack values to
  64. * CIPSO level/category-set values.
  65. */
  66. struct smack_cipso {
  67. int smk_level;
  68. char smk_catset[SMK_LABELLEN];
  69. };
  70. /*
  71. * This is the repository for labels seen so that it is
  72. * not necessary to keep allocating tiny chuncks of memory
  73. * and so that they can be shared.
  74. *
  75. * Labels are never modified in place. Anytime a label
  76. * is imported (e.g. xattrset on a file) the list is checked
  77. * for it and it is added if it doesn't exist. The address
  78. * is passed out in either case. Entries are added, but
  79. * never deleted.
  80. *
  81. * Since labels are hanging around anyway it doesn't
  82. * hurt to maintain a secid for those awkward situations
  83. * where kernel components that ought to use LSM independent
  84. * interfaces don't. The secid should go away when all of
  85. * these components have been repaired.
  86. *
  87. * If there is a cipso value associated with the label it
  88. * gets stored here, too. This will most likely be rare as
  89. * the cipso direct mapping in used internally.
  90. */
  91. struct smack_known {
  92. struct smack_known *smk_next;
  93. char smk_known[SMK_LABELLEN];
  94. u32 smk_secid;
  95. struct smack_cipso *smk_cipso;
  96. spinlock_t smk_cipsolock; /* for changing cipso map */
  97. };
  98. /*
  99. * Mount options
  100. */
  101. #define SMK_FSDEFAULT "smackfsdef="
  102. #define SMK_FSFLOOR "smackfsfloor="
  103. #define SMK_FSHAT "smackfshat="
  104. #define SMK_FSROOT "smackfsroot="
  105. /*
  106. * xattr names
  107. */
  108. #define XATTR_SMACK_SUFFIX "SMACK64"
  109. #define XATTR_SMACK_IPIN "SMACK64IPIN"
  110. #define XATTR_SMACK_IPOUT "SMACK64IPOUT"
  111. #define XATTR_NAME_SMACK XATTR_SECURITY_PREFIX XATTR_SMACK_SUFFIX
  112. #define XATTR_NAME_SMACKIPIN XATTR_SECURITY_PREFIX XATTR_SMACK_IPIN
  113. #define XATTR_NAME_SMACKIPOUT XATTR_SECURITY_PREFIX XATTR_SMACK_IPOUT
  114. /*
  115. * smackfs macic number
  116. */
  117. #define SMACK_MAGIC 0x43415d53 /* "SMAC" */
  118. /*
  119. * A limit on the number of entries in the lists
  120. * makes some of the list administration easier.
  121. */
  122. #define SMACK_LIST_MAX 10000
  123. /*
  124. * CIPSO defaults.
  125. */
  126. #define SMACK_CIPSO_DOI_DEFAULT 3 /* Historical */
  127. #define SMACK_CIPSO_DIRECT_DEFAULT 250 /* Arbitrary */
  128. #define SMACK_CIPSO_MAXCATVAL 63 /* Bigger gets harder */
  129. #define SMACK_CIPSO_MAXLEVEL 255 /* CIPSO 2.2 standard */
  130. #define SMACK_CIPSO_MAXCATNUM 239 /* CIPSO 2.2 standard */
  131. /*
  132. * Just to make the common cases easier to deal with
  133. */
  134. #define MAY_ANY (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
  135. #define MAY_ANYREAD (MAY_READ | MAY_EXEC)
  136. #define MAY_ANYWRITE (MAY_WRITE | MAY_APPEND)
  137. #define MAY_READWRITE (MAY_READ | MAY_WRITE)
  138. #define MAY_NOT 0
  139. /*
  140. * These functions are in smack_lsm.c
  141. */
  142. struct inode_smack *new_inode_smack(char *);
  143. /*
  144. * These functions are in smack_access.c
  145. */
  146. int smk_access(char *, char *, int);
  147. int smk_curacc(char *, u32);
  148. int smack_to_cipso(const char *, struct smack_cipso *);
  149. void smack_from_cipso(u32, char *, char *);
  150. char *smack_from_secid(const u32);
  151. char *smk_import(const char *, int);
  152. struct smack_known *smk_import_entry(const char *, int);
  153. u32 smack_to_secid(const char *);
  154. /*
  155. * Shared data.
  156. */
  157. extern int smack_cipso_direct;
  158. extern int smack_net_nltype;
  159. extern char *smack_net_ambient;
  160. extern struct smack_known *smack_known;
  161. extern struct smack_known smack_known_floor;
  162. extern struct smack_known smack_known_hat;
  163. extern struct smack_known smack_known_huh;
  164. extern struct smack_known smack_known_invalid;
  165. extern struct smack_known smack_known_star;
  166. extern struct smack_known smack_known_unset;
  167. extern struct smk_list_entry *smack_list;
  168. /*
  169. * Stricly for CIPSO level manipulation.
  170. * Set the category bit number in a smack label sized buffer.
  171. */
  172. static inline void smack_catset_bit(int cat, char *catsetp)
  173. {
  174. if (cat > SMK_LABELLEN * 8)
  175. return;
  176. catsetp[(cat - 1) / 8] |= 0x80 >> ((cat - 1) % 8);
  177. }
  178. /*
  179. * Present a pointer to the smack label in an inode blob.
  180. */
  181. static inline char *smk_of_inode(const struct inode *isp)
  182. {
  183. struct inode_smack *sip = isp->i_security;
  184. return sip->smk_inode;
  185. }
  186. #endif /* _SECURITY_SMACK_H */