blob: 55152d498b5342aba65d04c0a6be1b79f784a9f5 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * A policy database (policydb) specifies the
3 * configuration data for the security policy.
4 *
5 * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
6 */
7
8/*
9 * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
10 *
11 * Support for enhanced MLS infrastructure.
12 *
13 * Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com>
14 *
Eric Paris489a5fd2008-04-22 17:46:17 -040015 * Added conditional policy language extensions
Linus Torvalds1da177e2005-04-16 15:20:36 -070016 *
17 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
18 * Copyright (C) 2003 - 2004 Tresys Technology, LLC
19 * This program is free software; you can redistribute it and/or modify
Eric Paris489a5fd2008-04-22 17:46:17 -040020 * it under the terms of the GNU General Public License as published by
Linus Torvalds1da177e2005-04-16 15:20:36 -070021 * the Free Software Foundation, version 2.
22 */
23
24#ifndef _SS_POLICYDB_H_
25#define _SS_POLICYDB_H_
26
27#include "symtab.h"
28#include "avtab.h"
29#include "sidtab.h"
30#include "context.h"
31#include "constraint.h"
32
33/*
34 * A datum type is defined for each kind of symbol
35 * in the configuration data: individual permissions,
36 * common prefixes for access vectors, classes,
37 * users, roles, types, sensitivities, categories, etc.
38 */
39
40/* Permission attributes */
41struct perm_datum {
42 u32 value; /* permission bit + 1 */
43};
44
45/* Attributes of a common prefix for access vectors */
46struct common_datum {
47 u32 value; /* internal common value */
48 struct symtab permissions; /* common permissions */
49};
50
51/* Class attributes */
52struct class_datum {
53 u32 value; /* class value */
54 char *comkey; /* common name */
55 struct common_datum *comdatum; /* common datum */
56 struct symtab permissions; /* class-specific permission symbol table */
57 struct constraint_node *constraints; /* constraints on class permissions */
58 struct constraint_node *validatetrans; /* special transition rules */
59};
60
61/* Role attributes */
62struct role_datum {
63 u32 value; /* internal role value */
KaiGai Koheid9250de2008-08-28 16:35:57 +090064 u32 bounds; /* boundary of role */
Linus Torvalds1da177e2005-04-16 15:20:36 -070065 struct ebitmap dominates; /* set of roles dominated by this role */
66 struct ebitmap types; /* set of authorized types for role */
67};
68
69struct role_trans {
70 u32 role; /* current role */
71 u32 type; /* program executable type */
72 u32 new_role; /* new role */
73 struct role_trans *next;
74};
75
76struct role_allow {
77 u32 role; /* current role */
78 u32 new_role; /* new role */
79 struct role_allow *next;
80};
81
82/* Type attributes */
83struct type_datum {
84 u32 value; /* internal type value */
KaiGai Koheid9250de2008-08-28 16:35:57 +090085 u32 bounds; /* boundary of type */
Linus Torvalds1da177e2005-04-16 15:20:36 -070086 unsigned char primary; /* primary name? */
KaiGai Koheid9250de2008-08-28 16:35:57 +090087 unsigned char attribute;/* attribute ?*/
Linus Torvalds1da177e2005-04-16 15:20:36 -070088};
89
90/* User attributes */
91struct user_datum {
92 u32 value; /* internal user value */
KaiGai Koheid9250de2008-08-28 16:35:57 +090093 u32 bounds; /* bounds of user */
Linus Torvalds1da177e2005-04-16 15:20:36 -070094 struct ebitmap roles; /* set of authorized roles for user */
95 struct mls_range range; /* MLS range (min - max) for user */
96 struct mls_level dfltlevel; /* default login MLS level for user */
97};
98
99
100/* Sensitivity attributes */
101struct level_datum {
102 struct mls_level *level; /* sensitivity and associated categories */
103 unsigned char isalias; /* is this sensitivity an alias for another? */
104};
105
106/* Category attributes */
107struct cat_datum {
108 u32 value; /* internal category bit + 1 */
109 unsigned char isalias; /* is this category an alias for another? */
110};
111
112struct range_trans {
Darrel Goeddelf3f87712006-09-25 23:31:59 -0700113 u32 source_type;
114 u32 target_type;
115 u32 target_class;
116 struct mls_range target_range;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700117 struct range_trans *next;
118};
119
120/* Boolean data type */
121struct cond_bool_datum {
122 __u32 value; /* internal type value */
123 int state;
124};
125
126struct cond_node;
127
128/*
129 * The configuration data includes security contexts for
130 * initial SIDs, unlabeled file systems, TCP and UDP port numbers,
131 * network interfaces, and nodes. This structure stores the
132 * relevant data for one such entry. Entries of the same kind
133 * (e.g. all initial SIDs) are linked together into a list.
134 */
135struct ocontext {
136 union {
137 char *name; /* name of initial SID, fs, netif, fstype, path */
138 struct {
139 u8 protocol;
140 u16 low_port;
141 u16 high_port;
142 } port; /* TCP or UDP port information */
143 struct {
144 u32 addr;
145 u32 mask;
146 } node; /* node information */
147 struct {
148 u32 addr[4];
149 u32 mask[4];
150 } node6; /* IPv6 node information */
151 } u;
152 union {
153 u32 sclass; /* security class for genfs */
154 u32 behavior; /* labeling behavior for fs_use */
155 } v;
156 struct context context[2]; /* security context(s) */
157 u32 sid[2]; /* SID(s) */
158 struct ocontext *next;
159};
160
161struct genfs {
162 char *fstype;
163 struct ocontext *head;
164 struct genfs *next;
165};
166
167/* symbol table array indices */
168#define SYM_COMMONS 0
169#define SYM_CLASSES 1
170#define SYM_ROLES 2
171#define SYM_TYPES 3
172#define SYM_USERS 4
173#define SYM_BOOLS 5
174#define SYM_LEVELS 6
175#define SYM_CATS 7
176#define SYM_NUM 8
177
178/* object context array indices */
179#define OCON_ISID 0 /* initial SIDs */
180#define OCON_FS 1 /* unlabeled file systems */
181#define OCON_PORT 2 /* TCP and UDP port numbers */
182#define OCON_NETIF 3 /* network interfaces */
183#define OCON_NODE 4 /* nodes */
184#define OCON_FSUSE 5 /* fs_use */
185#define OCON_NODE6 6 /* IPv6 nodes */
186#define OCON_NUM 7
187
188/* The policy database */
189struct policydb {
190 /* symbol tables */
191 struct symtab symtab[SYM_NUM];
192#define p_commons symtab[SYM_COMMONS]
193#define p_classes symtab[SYM_CLASSES]
194#define p_roles symtab[SYM_ROLES]
195#define p_types symtab[SYM_TYPES]
196#define p_users symtab[SYM_USERS]
197#define p_bools symtab[SYM_BOOLS]
198#define p_levels symtab[SYM_LEVELS]
199#define p_cats symtab[SYM_CATS]
200
201 /* symbol names indexed by (value - 1) */
202 char **sym_val_to_name[SYM_NUM];
203#define p_common_val_to_name sym_val_to_name[SYM_COMMONS]
204#define p_class_val_to_name sym_val_to_name[SYM_CLASSES]
205#define p_role_val_to_name sym_val_to_name[SYM_ROLES]
206#define p_type_val_to_name sym_val_to_name[SYM_TYPES]
207#define p_user_val_to_name sym_val_to_name[SYM_USERS]
208#define p_bool_val_to_name sym_val_to_name[SYM_BOOLS]
209#define p_sens_val_to_name sym_val_to_name[SYM_LEVELS]
210#define p_cat_val_to_name sym_val_to_name[SYM_CATS]
211
212 /* class, role, and user attributes indexed by (value - 1) */
213 struct class_datum **class_val_to_struct;
214 struct role_datum **role_val_to_struct;
215 struct user_datum **user_val_to_struct;
KaiGai Koheid9250de2008-08-28 16:35:57 +0900216 struct type_datum **type_val_to_struct;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700217
218 /* type enforcement access vectors and transitions */
219 struct avtab te_avtab;
220
221 /* role transitions */
222 struct role_trans *role_tr;
223
224 /* bools indexed by (value - 1) */
225 struct cond_bool_datum **bool_val_to_struct;
226 /* type enforcement conditional access vectors and transitions */
227 struct avtab te_cond_avtab;
228 /* linked list indexing te_cond_avtab by conditional */
Eric Paris489a5fd2008-04-22 17:46:17 -0400229 struct cond_node *cond_list;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700230
231 /* role allows */
232 struct role_allow *role_allow;
233
234 /* security contexts of initial SIDs, unlabeled file systems,
235 TCP or UDP port numbers, network interfaces and nodes */
236 struct ocontext *ocontexts[OCON_NUM];
237
Eric Paris489a5fd2008-04-22 17:46:17 -0400238 /* security contexts for files in filesystems that cannot support
Linus Torvalds1da177e2005-04-16 15:20:36 -0700239 a persistent label mapping or use another
240 fixed labeling behavior. */
Eric Paris489a5fd2008-04-22 17:46:17 -0400241 struct genfs *genfs;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700242
243 /* range transitions */
244 struct range_trans *range_tr;
245
Stephen Smalley782ebb92005-09-03 15:55:16 -0700246 /* type -> attribute reverse mapping */
247 struct ebitmap *type_attr_map;
248
Paul Moore3bb56b22008-01-29 08:38:19 -0500249 struct ebitmap policycaps;
250
Eric Paris64dbf072008-03-31 12:17:33 +1100251 struct ebitmap permissive_map;
252
Linus Torvalds1da177e2005-04-16 15:20:36 -0700253 unsigned int policyvers;
Eric Paris3f120702007-09-21 14:37:10 -0400254
255 unsigned int reject_unknown : 1;
256 unsigned int allow_unknown : 1;
257 u32 *undefined_perms;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700258};
259
260extern void policydb_destroy(struct policydb *p);
261extern int policydb_load_isids(struct policydb *p, struct sidtab *s);
262extern int policydb_context_isvalid(struct policydb *p, struct context *c);
Stephen Smalley45e54212007-11-07 10:08:00 -0500263extern int policydb_class_isvalid(struct policydb *p, unsigned int class);
264extern int policydb_type_isvalid(struct policydb *p, unsigned int type);
265extern int policydb_role_isvalid(struct policydb *p, unsigned int role);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700266extern int policydb_read(struct policydb *p, void *fp);
267
268#define PERM_SYMTAB_SIZE 32
269
270#define POLICYDB_CONFIG_MLS 1
271
Eric Paris3f120702007-09-21 14:37:10 -0400272/* the config flags related to unknown classes/perms are bits 2 and 3 */
273#define REJECT_UNKNOWN 0x00000002
274#define ALLOW_UNKNOWN 0x00000004
275
Linus Torvalds1da177e2005-04-16 15:20:36 -0700276#define OBJECT_R "object_r"
277#define OBJECT_R_VAL 1
278
279#define POLICYDB_MAGIC SELINUX_MAGIC
280#define POLICYDB_STRING "SE Linux"
281
282struct policy_file {
283 char *data;
284 size_t len;
285};
286
287static inline int next_entry(void *buf, struct policy_file *fp, size_t bytes)
288{
289 if (bytes > fp->len)
290 return -EINVAL;
291
292 memcpy(buf, fp->data, bytes);
293 fp->data += bytes;
294 fp->len -= bytes;
295 return 0;
296}
297
298#endif /* _SS_POLICYDB_H_ */
299