blob: 4a4477f5afdcd3468074c72ea05aa5697dea4566 [file] [log] [blame]
Casey Schauflere114e472008-02-04 22:29:50 -08001/*
2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
7 *
8 * Author:
9 * Casey Schaufler <casey@schaufler-ca.com>
10 *
11 */
12
13#ifndef _SECURITY_SMACK_H
14#define _SECURITY_SMACK_H
15
16#include <linux/capability.h>
17#include <linux/spinlock.h>
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +020018#include <linux/security.h>
Casey Schauflere114e472008-02-04 22:29:50 -080019#include <net/netlabel.h>
20
21/*
22 * Why 23? CIPSO is constrained to 30, so a 32 byte buffer is
23 * bigger than can be used, and 24 is the next lower multiple
24 * of 8, and there are too many issues if there isn't space set
25 * aside for the terminating null byte.
26 */
27#define SMK_MAXLEN 23
28#define SMK_LABELLEN (SMK_MAXLEN+1)
29
Casey Schauflere114e472008-02-04 22:29:50 -080030struct superblock_smack {
31 char *smk_root;
32 char *smk_floor;
33 char *smk_hat;
34 char *smk_default;
35 int smk_initialized;
36 spinlock_t smk_sblock; /* for initialization */
37};
38
39struct socket_smack {
40 char *smk_out; /* outbound label */
41 char *smk_in; /* inbound label */
42 char smk_packet[SMK_LABELLEN]; /* TCP peer label */
43};
44
45/*
46 * Inode smack data
47 */
48struct inode_smack {
49 char *smk_inode; /* label of the fso */
50 struct mutex smk_lock; /* initialization lock */
51 int smk_flags; /* smack inode flags */
52};
53
54#define SMK_INODE_INSTANT 0x01 /* inode is instantiated */
55
56/*
57 * A label access rule.
58 */
59struct smack_rule {
60 char *smk_subject;
61 char *smk_object;
62 int smk_access;
63};
64
65/*
66 * An entry in the table of permitted label accesses.
67 */
68struct smk_list_entry {
69 struct smk_list_entry *smk_next;
70 struct smack_rule smk_rule;
71};
72
73/*
74 * An entry in the table mapping smack values to
75 * CIPSO level/category-set values.
76 */
77struct smack_cipso {
78 int smk_level;
79 char smk_catset[SMK_LABELLEN];
80};
81
82/*
83 * This is the repository for labels seen so that it is
84 * not necessary to keep allocating tiny chuncks of memory
85 * and so that they can be shared.
86 *
87 * Labels are never modified in place. Anytime a label
88 * is imported (e.g. xattrset on a file) the list is checked
89 * for it and it is added if it doesn't exist. The address
90 * is passed out in either case. Entries are added, but
91 * never deleted.
92 *
93 * Since labels are hanging around anyway it doesn't
94 * hurt to maintain a secid for those awkward situations
95 * where kernel components that ought to use LSM independent
96 * interfaces don't. The secid should go away when all of
97 * these components have been repaired.
98 *
99 * If there is a cipso value associated with the label it
100 * gets stored here, too. This will most likely be rare as
101 * the cipso direct mapping in used internally.
102 */
103struct smack_known {
104 struct smack_known *smk_next;
105 char smk_known[SMK_LABELLEN];
106 u32 smk_secid;
107 struct smack_cipso *smk_cipso;
108 spinlock_t smk_cipsolock; /* for changing cipso map */
109};
110
111/*
112 * Mount options
113 */
114#define SMK_FSDEFAULT "smackfsdef="
115#define SMK_FSFLOOR "smackfsfloor="
116#define SMK_FSHAT "smackfshat="
117#define SMK_FSROOT "smackfsroot="
118
119/*
120 * xattr names
121 */
122#define XATTR_SMACK_SUFFIX "SMACK64"
123#define XATTR_SMACK_IPIN "SMACK64IPIN"
124#define XATTR_SMACK_IPOUT "SMACK64IPOUT"
125#define XATTR_NAME_SMACK XATTR_SECURITY_PREFIX XATTR_SMACK_SUFFIX
126#define XATTR_NAME_SMACKIPIN XATTR_SECURITY_PREFIX XATTR_SMACK_IPIN
127#define XATTR_NAME_SMACKIPOUT XATTR_SECURITY_PREFIX XATTR_SMACK_IPOUT
128
129/*
130 * smackfs macic number
131 */
132#define SMACK_MAGIC 0x43415d53 /* "SMAC" */
133
134/*
135 * A limit on the number of entries in the lists
136 * makes some of the list administration easier.
137 */
138#define SMACK_LIST_MAX 10000
139
140/*
141 * CIPSO defaults.
142 */
143#define SMACK_CIPSO_DOI_DEFAULT 3 /* Historical */
144#define SMACK_CIPSO_DIRECT_DEFAULT 250 /* Arbitrary */
145#define SMACK_CIPSO_MAXCATVAL 63 /* Bigger gets harder */
146#define SMACK_CIPSO_MAXLEVEL 255 /* CIPSO 2.2 standard */
147#define SMACK_CIPSO_MAXCATNUM 239 /* CIPSO 2.2 standard */
148
149/*
150 * Just to make the common cases easier to deal with
151 */
152#define MAY_ANY (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
153#define MAY_ANYREAD (MAY_READ | MAY_EXEC)
154#define MAY_ANYWRITE (MAY_WRITE | MAY_APPEND)
155#define MAY_READWRITE (MAY_READ | MAY_WRITE)
156#define MAY_NOT 0
157
158/*
159 * These functions are in smack_lsm.c
160 */
161struct inode_smack *new_inode_smack(char *);
162
163/*
164 * These functions are in smack_access.c
165 */
166int smk_access(char *, char *, int);
167int smk_curacc(char *, u32);
168int smack_to_cipso(const char *, struct smack_cipso *);
169void smack_from_cipso(u32, char *, char *);
170char *smack_from_secid(const u32);
171char *smk_import(const char *, int);
172struct smack_known *smk_import_entry(const char *, int);
173u32 smack_to_secid(const char *);
174
175/*
176 * Shared data.
177 */
178extern int smack_cipso_direct;
179extern int smack_net_nltype;
180extern char *smack_net_ambient;
181
182extern struct smack_known *smack_known;
183extern struct smack_known smack_known_floor;
184extern struct smack_known smack_known_hat;
185extern struct smack_known smack_known_huh;
186extern struct smack_known smack_known_invalid;
187extern struct smack_known smack_known_star;
188extern struct smack_known smack_known_unset;
189
190extern struct smk_list_entry *smack_list;
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +0200191extern struct security_operations smack_ops;
Casey Schauflere114e472008-02-04 22:29:50 -0800192
193/*
194 * Stricly for CIPSO level manipulation.
195 * Set the category bit number in a smack label sized buffer.
196 */
197static inline void smack_catset_bit(int cat, char *catsetp)
198{
199 if (cat > SMK_LABELLEN * 8)
200 return;
201
202 catsetp[(cat - 1) / 8] |= 0x80 >> ((cat - 1) % 8);
203}
204
205/*
206 * Present a pointer to the smack label in an inode blob.
207 */
208static inline char *smk_of_inode(const struct inode *isp)
209{
210 struct inode_smack *sip = isp->i_security;
211 return sip->smk_inode;
212}
213
214#endif /* _SECURITY_SMACK_H */