1/*-
2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
3 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc.
4 * All rights reserved.
5 *
6 * This software was developed by Robert Watson for the TrustedBSD Project.
7 *
8 * This software was developed for the FreeBSD Project in part by NAI Labs,

--- 20 unchanged lines hidden (view full) ---

29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * SUCH DAMAGE.
36 *
37 * $FreeBSD: head/sys/security/mac/mac_framework.h 105693 2002-10-22 14:27:44Z rwatson $
38 */
39/*
40 * Userland/kernel interface for Mandatory Access Control.
41 *
42 * The POSIX.1e implementation page may be reached at:
43 * http://www.trustedbsd.org/
44 */
45#ifndef _SYS_MAC_H

--- 11 unchanged lines hidden (view full) ---

57 * with UFS2.
58 */
59#define FREEBSD_MAC_EXTATTR_NAME "freebsd.mac"
60#define FREEBSD_MAC_EXTATTR_NAMESPACE EXTATTR_NAMESPACE_SYSTEM
61
62/*
63 * MAC framework-related constants and limits.
64 */
65#define MAC_MAX_POLICY_NAME 32
66#define MAC_MAX_LABEL_ELEMENT_NAME 32
67#define MAC_MAX_LABEL_ELEMENT_DATA 4096
68#define MAC_MAX_LABEL_BUF_LEN 8192
69
70struct mac {
71 size_t m_buflen;
72 char *m_string;
73};
74
75typedef struct mac *mac_t;
76
77#ifndef _KERNEL
78
79/*
80 * Location of the userland MAC framework configuration file. mac.conf
81 * binds policy names to shared libraries that understand those policies,
82 * as well as setting defaults for MAC-aware applications.
83 */
84#define MAC_CONFFILE "/etc/mac.conf"
85
86/*
87 * Extended non-POSIX.1e interfaces that offer additional services
88 * available from the userland and kernel MAC frameworks.
89 */
90int mac_free(mac_t _label);
91int mac_from_text(mac_t *_label, const char *_text);
92int mac_get_fd(int _fd, mac_t _label);
93int mac_get_file(const char *_path, mac_t _label);
94int mac_get_link(const char *_path, mac_t _label);
95int mac_get_pid(pid_t _pid, mac_t _label);
96int mac_get_proc(mac_t _label);
97int mac_is_present(const char *_policyname);
98int mac_prepare(mac_t *_label, char *_elements);
99int mac_prepare_file_label(mac_t *_label);
100int mac_prepare_ifnet_label(mac_t *_label);
101int mac_prepare_process_label(mac_t *_label);
102int mac_set_fd(int _fildes, const mac_t _label);
103int mac_set_file(const char *_path, mac_t _label);
104int mac_set_link(const char *_path, mac_t _label);
105int mac_set_proc(const mac_t _label);
106int mac_syscall(const char *_policyname, int _call, void *_arg);
107int mac_to_text(mac_t mac, char **_text);
108
109#endif /* !_KERNEL */
110
111/*
112 * XXXMAC: For compatibility until the labels on disk are changed. We
113 * will enable the definitions in various policy include files once
114 * these can be disabled.
115 */
116
117#define MAC_BIBA_MAX_COMPARTMENTS 256
118
119struct mac_biba_element {
120 u_short mbe_type;
121 u_short mbe_grade;
122 u_char mbe_compartments[MAC_BIBA_MAX_COMPARTMENTS >> 3];
123};
124
125struct mac_biba {
126 int mb_flags;
127 struct mac_biba_element mb_single;
128 struct mac_biba_element mb_rangelow, mb_rangehigh;
129};
130
131#define MAC_MLS_MAX_COMPARTMENTS 256
132
133struct mac_mls_element {
134 u_short mme_type;
135 u_short mme_level;
136 u_char mme_compartments[MAC_MLS_MAX_COMPARTMENTS >> 3];
137};
138
139struct mac_mls {
140 int mm_flags;
141 struct mac_mls_element mm_single;
142 struct mac_mls_element mm_rangelow, mm_rangehigh;
143};
144
145#define MAC_TE_TYPE_MAXLEN 32
146struct mac_te {
147 char mt_type[MAC_TE_TYPE_MAXLEN];
148};
149
150struct mac_sebsd {
151 uint32_t ms_psid;
152};
153
154struct oldmac {
155 int m_macflags;
156 struct mac_biba m_biba;
157 struct mac_mls m_mls;
158 struct mac_te m_te;
159 struct mac_sebsd m_sebsd;
160};
161
162#ifdef _KERNEL
163
164/*
165 * Kernel functions to manage and evaluate labels.
166 */
167struct bpf_d;
168struct componentname;
169struct devfs_dirent;
170struct ifnet;
171struct ifreq;
172struct ipq;

--- 41 unchanged lines hidden (view full) ---

214
215/*
216 * Labeling event operations: file system objects, and things that
217 * look a lot like file system objects.
218 */
219void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de);
220void mac_create_devfs_directory(char *dirname, int dirnamelen,
221 struct devfs_dirent *de);
222void mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd,
223 struct devfs_dirent *de);
224void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp);
225void mac_create_vnode(struct ucred *cred, struct vnode *parent,
226 struct vnode *child);
227void mac_create_mount(struct ucred *cred, struct mount *mp);
228void mac_create_root_mount(struct ucred *cred, struct mount *mp);
229void mac_relabel_vnode(struct ucred *cred, struct vnode *vp,
230 struct label *newlabel);
231void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp);
232void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred);

--- 145 unchanged lines hidden ---