blob: 42ef313f98560451b2b45d563d1f5e26e23ca795 [file] [log] [blame]
Casey Schauflere114e472008-02-04 22:29:50 -08001/*
2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
7 *
8 * Author:
9 * Casey Schaufler <casey@schaufler-ca.com>
10 *
11 */
12
13#ifndef _SECURITY_SMACK_H
14#define _SECURITY_SMACK_H
15
16#include <linux/capability.h>
17#include <linux/spinlock.h>
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +020018#include <linux/security.h>
Casey Schaufler6d3dc072008-12-31 12:54:12 -050019#include <linux/in.h>
Casey Schauflere114e472008-02-04 22:29:50 -080020#include <net/netlabel.h>
Etienne Basset7198e2e2009-03-24 20:53:24 +010021#include <linux/list.h>
22#include <linux/rculist.h>
Casey Schauflere114e472008-02-04 22:29:50 -080023
24/*
25 * Why 23? CIPSO is constrained to 30, so a 32 byte buffer is
26 * bigger than can be used, and 24 is the next lower multiple
27 * of 8, and there are too many issues if there isn't space set
28 * aside for the terminating null byte.
29 */
30#define SMK_MAXLEN 23
31#define SMK_LABELLEN (SMK_MAXLEN+1)
32
Casey Schauflere114e472008-02-04 22:29:50 -080033struct superblock_smack {
34 char *smk_root;
35 char *smk_floor;
36 char *smk_hat;
37 char *smk_default;
38 int smk_initialized;
39 spinlock_t smk_sblock; /* for initialization */
40};
41
42struct socket_smack {
43 char *smk_out; /* outbound label */
44 char *smk_in; /* inbound label */
45 char smk_packet[SMK_LABELLEN]; /* TCP peer label */
46};
47
48/*
49 * Inode smack data
50 */
51struct inode_smack {
52 char *smk_inode; /* label of the fso */
53 struct mutex smk_lock; /* initialization lock */
54 int smk_flags; /* smack inode flags */
55};
56
57#define SMK_INODE_INSTANT 0x01 /* inode is instantiated */
58
59/*
60 * A label access rule.
61 */
62struct smack_rule {
Etienne Basset7198e2e2009-03-24 20:53:24 +010063 struct list_head list;
64 char *smk_subject;
65 char *smk_object;
66 int smk_access;
Casey Schauflere114e472008-02-04 22:29:50 -080067};
68
69/*
70 * An entry in the table mapping smack values to
71 * CIPSO level/category-set values.
72 */
73struct smack_cipso {
74 int smk_level;
75 char smk_catset[SMK_LABELLEN];
76};
77
78/*
Casey Schaufler6d3dc072008-12-31 12:54:12 -050079 * An entry in the table identifying hosts.
80 */
81struct smk_netlbladdr {
Etienne Basset7198e2e2009-03-24 20:53:24 +010082 struct list_head list;
Casey Schaufler6d3dc072008-12-31 12:54:12 -050083 struct sockaddr_in smk_host; /* network address */
84 struct in_addr smk_mask; /* network mask */
85 char *smk_label; /* label */
86};
87
88/*
Casey Schauflere114e472008-02-04 22:29:50 -080089 * This is the repository for labels seen so that it is
90 * not necessary to keep allocating tiny chuncks of memory
91 * and so that they can be shared.
92 *
93 * Labels are never modified in place. Anytime a label
94 * is imported (e.g. xattrset on a file) the list is checked
95 * for it and it is added if it doesn't exist. The address
96 * is passed out in either case. Entries are added, but
97 * never deleted.
98 *
99 * Since labels are hanging around anyway it doesn't
100 * hurt to maintain a secid for those awkward situations
101 * where kernel components that ought to use LSM independent
102 * interfaces don't. The secid should go away when all of
103 * these components have been repaired.
104 *
105 * If there is a cipso value associated with the label it
106 * gets stored here, too. This will most likely be rare as
107 * the cipso direct mapping in used internally.
108 */
109struct smack_known {
Etienne Basset7198e2e2009-03-24 20:53:24 +0100110 struct list_head list;
Casey Schauflere114e472008-02-04 22:29:50 -0800111 char smk_known[SMK_LABELLEN];
112 u32 smk_secid;
113 struct smack_cipso *smk_cipso;
114 spinlock_t smk_cipsolock; /* for changing cipso map */
115};
116
117/*
118 * Mount options
119 */
120#define SMK_FSDEFAULT "smackfsdef="
121#define SMK_FSFLOOR "smackfsfloor="
122#define SMK_FSHAT "smackfshat="
123#define SMK_FSROOT "smackfsroot="
124
125/*
126 * xattr names
127 */
128#define XATTR_SMACK_SUFFIX "SMACK64"
129#define XATTR_SMACK_IPIN "SMACK64IPIN"
130#define XATTR_SMACK_IPOUT "SMACK64IPOUT"
131#define XATTR_NAME_SMACK XATTR_SECURITY_PREFIX XATTR_SMACK_SUFFIX
132#define XATTR_NAME_SMACKIPIN XATTR_SECURITY_PREFIX XATTR_SMACK_IPIN
133#define XATTR_NAME_SMACKIPOUT XATTR_SECURITY_PREFIX XATTR_SMACK_IPOUT
134
Etienne Basset43031542009-03-27 17:11:01 -0400135#define SMACK_CIPSO_OPTION "-CIPSO"
136
Casey Schauflere114e472008-02-04 22:29:50 -0800137/*
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500138 * How communications on this socket are treated.
139 * Usually it's determined by the underlying netlabel code
140 * but there are certain cases, including single label hosts
141 * and potentially single label interfaces for which the
142 * treatment can not be known in advance.
143 *
144 * The possibility of additional labeling schemes being
145 * introduced in the future exists as well.
146 */
147#define SMACK_UNLABELED_SOCKET 0
148#define SMACK_CIPSO_SOCKET 1
149
150/*
151 * smackfs magic number
Casey Schauflere114e472008-02-04 22:29:50 -0800152 * smackfs macic number
153 */
154#define SMACK_MAGIC 0x43415d53 /* "SMAC" */
155
156/*
157 * A limit on the number of entries in the lists
158 * makes some of the list administration easier.
159 */
160#define SMACK_LIST_MAX 10000
161
162/*
163 * CIPSO defaults.
164 */
165#define SMACK_CIPSO_DOI_DEFAULT 3 /* Historical */
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500166#define SMACK_CIPSO_DOI_INVALID -1 /* Not a DOI */
Casey Schauflere114e472008-02-04 22:29:50 -0800167#define SMACK_CIPSO_DIRECT_DEFAULT 250 /* Arbitrary */
168#define SMACK_CIPSO_MAXCATVAL 63 /* Bigger gets harder */
169#define SMACK_CIPSO_MAXLEVEL 255 /* CIPSO 2.2 standard */
170#define SMACK_CIPSO_MAXCATNUM 239 /* CIPSO 2.2 standard */
171
172/*
173 * Just to make the common cases easier to deal with
174 */
175#define MAY_ANY (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
176#define MAY_ANYREAD (MAY_READ | MAY_EXEC)
177#define MAY_ANYWRITE (MAY_WRITE | MAY_APPEND)
178#define MAY_READWRITE (MAY_READ | MAY_WRITE)
179#define MAY_NOT 0
180
181/*
182 * These functions are in smack_lsm.c
183 */
184struct inode_smack *new_inode_smack(char *);
185
186/*
187 * These functions are in smack_access.c
188 */
189int smk_access(char *, char *, int);
190int smk_curacc(char *, u32);
191int smack_to_cipso(const char *, struct smack_cipso *);
192void smack_from_cipso(u32, char *, char *);
193char *smack_from_secid(const u32);
194char *smk_import(const char *, int);
195struct smack_known *smk_import_entry(const char *, int);
196u32 smack_to_secid(const char *);
197
198/*
199 * Shared data.
200 */
201extern int smack_cipso_direct;
Casey Schauflere114e472008-02-04 22:29:50 -0800202extern char *smack_net_ambient;
Casey Schaufler15446232008-07-30 15:37:11 -0700203extern char *smack_onlycap;
Etienne Basset43031542009-03-27 17:11:01 -0400204extern const char *smack_cipso_option;
Casey Schauflere114e472008-02-04 22:29:50 -0800205
Casey Schauflere114e472008-02-04 22:29:50 -0800206extern struct smack_known smack_known_floor;
207extern struct smack_known smack_known_hat;
208extern struct smack_known smack_known_huh;
209extern struct smack_known smack_known_invalid;
210extern struct smack_known smack_known_star;
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500211extern struct smack_known smack_known_web;
Casey Schauflere114e472008-02-04 22:29:50 -0800212
Etienne Basset7198e2e2009-03-24 20:53:24 +0100213extern struct list_head smack_known_list;
214extern struct list_head smack_rule_list;
215extern struct list_head smk_netlbladdr_list;
216
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +0200217extern struct security_operations smack_ops;
Casey Schauflere114e472008-02-04 22:29:50 -0800218
219/*
220 * Stricly for CIPSO level manipulation.
221 * Set the category bit number in a smack label sized buffer.
222 */
223static inline void smack_catset_bit(int cat, char *catsetp)
224{
225 if (cat > SMK_LABELLEN * 8)
226 return;
227
228 catsetp[(cat - 1) / 8] |= 0x80 >> ((cat - 1) % 8);
229}
230
231/*
232 * Present a pointer to the smack label in an inode blob.
233 */
234static inline char *smk_of_inode(const struct inode *isp)
235{
236 struct inode_smack *sip = isp->i_security;
237 return sip->smk_inode;
238}
239
240#endif /* _SECURITY_SMACK_H */