1/*-
2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
3 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc.
4 * All rights reserved.
5 *
6 * This software was developed by Robert Watson for the TrustedBSD Project.
7 *
8 * This software was developed for the FreeBSD Project in part by NAI Labs,
--- 20 unchanged lines hidden (view full) ---
29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * SUCH DAMAGE.
36 *
37 * $FreeBSD: head/sys/security/mac/mac_framework.h 105643 2002-10-21 18:42:01Z rwatson $
38 */
39/*
40 * Userland/kernel interface for Mandatory Access Control.
41 *
42 * The POSIX.1e implementation page may be reached at:
43 * http://www.trustedbsd.org/
44 */
45#ifndef _SYS_MAC_H
--- 11 unchanged lines hidden (view full) ---
57 * with UFS2.
58 */
59#define FREEBSD_MAC_EXTATTR_NAME "freebsd.mac"
60#define FREEBSD_MAC_EXTATTR_NAMESPACE EXTATTR_NAMESPACE_SYSTEM
61
62/*
63 * MAC framework-related constants and limits.
64 */
65#define MAC_MAX_POLICY_NAME 32
66
67/*
68 * XXXMAC: Per-policy structures will be moved from mac.h to per-policy
69 * include files once the revised user interface is available.
70 */
71
72/*
73 * Structures and constants associated with a Biba Integrity policy.
74 * mac_biba represents a Biba label, with mb_type determining its properties,
75 * and mb_grade represents the hierarchal grade if valid for the current
76 * mb_type. These structures will move to mac_biba.h once we have dymamic
77 * labels exposed to userland.
78 */
79#define MAC_BIBA_MAX_COMPARTMENTS 256
80struct mac_biba_element {
81 u_short mbe_type;
82 u_short mbe_grade;
83 u_char mbe_compartments[MAC_BIBA_MAX_COMPARTMENTS >> 3];
84};
85
86/*
87 * Biba labels consist of two components: a single label, and a label
88 * range. Depending on the context, one or both may be used; the mb_flags
89 * field permits the provider to indicate what fields are intended for
90 * use.
91 */
92struct mac_biba {
93 int mb_flags;
94 struct mac_biba_element mb_single;
95 struct mac_biba_element mb_rangelow, mb_rangehigh;
96};
97
98/*
99 * Structures and constants associated with a Multi-Level Security policy.
100 * mac_mls represents an MLS label, with mm_type determining its properties,
101 * and mm_level represents the hierarchal sensitivity level if valid for the
102 * current mm_type. These structures will move to mac_mls.h once we have
103 * dynamic labels exposed to userland.
104 */
105#define MAC_MLS_MAX_COMPARTMENTS 256
106struct mac_mls_element {
107 u_short mme_type;
108 u_short mme_level;
109 u_char mme_compartments[MAC_MLS_MAX_COMPARTMENTS >> 3];
110};
111
112/*
113 * MLS labels consist of two components: a single label, and a label
114 * range. Depending on the context, one or both may be used; the mb_flags
115 * field permits the provider to indicate what fields are intended for
116 * use.
117 */
118struct mac_mls {
119 int mm_flags;
120 struct mac_mls_element mm_single;
121 struct mac_mls_element mm_rangelow, mm_rangehigh;
122};
123
124/*
125 * Structures and constants associated with a Type Enforcement policy.
126 * mac_te represents a Type Enforcement label.
127 */
128#define MAC_TE_TYPE_MAXLEN 32
129struct mac_te {
130 char mt_type[MAC_TE_TYPE_MAXLEN+1]; /* TE type */
131};
132
133struct mac_sebsd {
134 uint32_t ms_psid; /* persistent sid storage */
135};
136
137/*
138 * Composite structures and constants which combine the various policy
139 * elements into common structures to be associated with subjects and
140 * objects.
141 */
142struct mac {
143 int m_macflags;
144 struct mac_biba m_biba;
145 struct mac_mls m_mls;
146 struct mac_te m_te;
147 struct mac_sebsd m_sebsd;
148};
149typedef struct mac *mac_t;
150
151#define MAC_FLAG_INITIALIZED 0x00000001 /* Is initialized. */
152
153#ifndef _KERNEL
154
155/*
156 * POSIX.1e functions visible in the application namespace.
157 */
158int mac_dominate(const mac_t _labela, const mac_t _labelb);
159int mac_equal(const mac_t labela, const mac_t _labelb);
160int mac_free(void *_buf_p);
161mac_t mac_from_text(const char *_text_p);
162mac_t mac_get_fd(int _fildes);
163mac_t mac_get_file(const char *_path_p);
164mac_t mac_get_proc(void);
165mac_t mac_glb(const mac_t _labela, const mac_t _labelb);
166mac_t mac_lub(const mac_t _labela, const mac_t _labelb);
167int mac_set_fd(int _fildes, const mac_t _label);
168int mac_set_file(const char *_path_p, mac_t _label);
169int mac_set_proc(const mac_t _label);
170ssize_t mac_size(mac_t _label);
171char * mac_to_text(const mac_t _label, size_t *_len_p);
172int mac_valid(const mac_t _label);
173
174/*
175 * Extensions to POSIX.1e visible in the application namespace.
176 */
177int mac_is_present_np(const char *_policyname);
178int mac_syscall(const char *_policyname, int call, void *arg);
179
180/*
181 * System calls wrapped by some POSIX.1e functions.
182 */
183int __mac_get_fd(int _fd, struct mac *_mac_p);
184int __mac_get_file(const char *_path_p, struct mac *_mac_p);
185int __mac_get_proc(struct mac *_mac_p);
186int __mac_set_fd(int fd, struct mac *_mac_p);
187int __mac_set_file(const char *_path_p, struct mac *_mac_p);
188int __mac_set_proc(struct mac *_mac_p);
189
190#else /* _KERNEL */
191
192/*
193 * Kernel functions to manage and evaluate labels.
194 */
195struct bpf_d;
196struct componentname;
197struct devfs_dirent;
198struct ifnet;
199struct ifreq;
200struct ipq;
--- 41 unchanged lines hidden (view full) ---
242
243/*
244 * Labeling event operations: file system objects, and things that
245 * look a lot like file system objects.
246 */
247void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de);
248void mac_create_devfs_directory(char *dirname, int dirnamelen,
249 struct devfs_dirent *de);
250void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp);
251void mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd,
252 struct devfs_dirent *de);
253void mac_create_vnode(struct ucred *cred, struct vnode *parent,
254 struct vnode *child);
255void mac_create_mount(struct ucred *cred, struct mount *mp);
256void mac_create_root_mount(struct ucred *cred, struct mount *mp);
257void mac_relabel_vnode(struct ucred *cred, struct vnode *vp,
258 struct label *newlabel);
259void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp);
260void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred);
--- 145 unchanged lines hidden ---
2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
3 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc.
4 * All rights reserved.
5 *
6 * This software was developed by Robert Watson for the TrustedBSD Project.
7 *
8 * This software was developed for the FreeBSD Project in part by NAI Labs,
--- 20 unchanged lines hidden (view full) ---
29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * SUCH DAMAGE.
36 *
37 * $FreeBSD: head/sys/security/mac/mac_framework.h 105643 2002-10-21 18:42:01Z rwatson $
38 */
39/*
40 * Userland/kernel interface for Mandatory Access Control.
41 *
42 * The POSIX.1e implementation page may be reached at:
43 * http://www.trustedbsd.org/
44 */
45#ifndef _SYS_MAC_H
--- 11 unchanged lines hidden (view full) ---
57 * with UFS2.
58 */
59#define FREEBSD_MAC_EXTATTR_NAME "freebsd.mac"
60#define FREEBSD_MAC_EXTATTR_NAMESPACE EXTATTR_NAMESPACE_SYSTEM
61
62/*
63 * MAC framework-related constants and limits.
64 */
65#define MAC_MAX_POLICY_NAME 32
66
67/*
68 * XXXMAC: Per-policy structures will be moved from mac.h to per-policy
69 * include files once the revised user interface is available.
70 */
71
72/*
73 * Structures and constants associated with a Biba Integrity policy.
74 * mac_biba represents a Biba label, with mb_type determining its properties,
75 * and mb_grade represents the hierarchal grade if valid for the current
76 * mb_type. These structures will move to mac_biba.h once we have dymamic
77 * labels exposed to userland.
78 */
79#define MAC_BIBA_MAX_COMPARTMENTS 256
80struct mac_biba_element {
81 u_short mbe_type;
82 u_short mbe_grade;
83 u_char mbe_compartments[MAC_BIBA_MAX_COMPARTMENTS >> 3];
84};
85
86/*
87 * Biba labels consist of two components: a single label, and a label
88 * range. Depending on the context, one or both may be used; the mb_flags
89 * field permits the provider to indicate what fields are intended for
90 * use.
91 */
92struct mac_biba {
93 int mb_flags;
94 struct mac_biba_element mb_single;
95 struct mac_biba_element mb_rangelow, mb_rangehigh;
96};
97
98/*
99 * Structures and constants associated with a Multi-Level Security policy.
100 * mac_mls represents an MLS label, with mm_type determining its properties,
101 * and mm_level represents the hierarchal sensitivity level if valid for the
102 * current mm_type. These structures will move to mac_mls.h once we have
103 * dynamic labels exposed to userland.
104 */
105#define MAC_MLS_MAX_COMPARTMENTS 256
106struct mac_mls_element {
107 u_short mme_type;
108 u_short mme_level;
109 u_char mme_compartments[MAC_MLS_MAX_COMPARTMENTS >> 3];
110};
111
112/*
113 * MLS labels consist of two components: a single label, and a label
114 * range. Depending on the context, one or both may be used; the mb_flags
115 * field permits the provider to indicate what fields are intended for
116 * use.
117 */
118struct mac_mls {
119 int mm_flags;
120 struct mac_mls_element mm_single;
121 struct mac_mls_element mm_rangelow, mm_rangehigh;
122};
123
124/*
125 * Structures and constants associated with a Type Enforcement policy.
126 * mac_te represents a Type Enforcement label.
127 */
128#define MAC_TE_TYPE_MAXLEN 32
129struct mac_te {
130 char mt_type[MAC_TE_TYPE_MAXLEN+1]; /* TE type */
131};
132
133struct mac_sebsd {
134 uint32_t ms_psid; /* persistent sid storage */
135};
136
137/*
138 * Composite structures and constants which combine the various policy
139 * elements into common structures to be associated with subjects and
140 * objects.
141 */
142struct mac {
143 int m_macflags;
144 struct mac_biba m_biba;
145 struct mac_mls m_mls;
146 struct mac_te m_te;
147 struct mac_sebsd m_sebsd;
148};
149typedef struct mac *mac_t;
150
151#define MAC_FLAG_INITIALIZED 0x00000001 /* Is initialized. */
152
153#ifndef _KERNEL
154
155/*
156 * POSIX.1e functions visible in the application namespace.
157 */
158int mac_dominate(const mac_t _labela, const mac_t _labelb);
159int mac_equal(const mac_t labela, const mac_t _labelb);
160int mac_free(void *_buf_p);
161mac_t mac_from_text(const char *_text_p);
162mac_t mac_get_fd(int _fildes);
163mac_t mac_get_file(const char *_path_p);
164mac_t mac_get_proc(void);
165mac_t mac_glb(const mac_t _labela, const mac_t _labelb);
166mac_t mac_lub(const mac_t _labela, const mac_t _labelb);
167int mac_set_fd(int _fildes, const mac_t _label);
168int mac_set_file(const char *_path_p, mac_t _label);
169int mac_set_proc(const mac_t _label);
170ssize_t mac_size(mac_t _label);
171char * mac_to_text(const mac_t _label, size_t *_len_p);
172int mac_valid(const mac_t _label);
173
174/*
175 * Extensions to POSIX.1e visible in the application namespace.
176 */
177int mac_is_present_np(const char *_policyname);
178int mac_syscall(const char *_policyname, int call, void *arg);
179
180/*
181 * System calls wrapped by some POSIX.1e functions.
182 */
183int __mac_get_fd(int _fd, struct mac *_mac_p);
184int __mac_get_file(const char *_path_p, struct mac *_mac_p);
185int __mac_get_proc(struct mac *_mac_p);
186int __mac_set_fd(int fd, struct mac *_mac_p);
187int __mac_set_file(const char *_path_p, struct mac *_mac_p);
188int __mac_set_proc(struct mac *_mac_p);
189
190#else /* _KERNEL */
191
192/*
193 * Kernel functions to manage and evaluate labels.
194 */
195struct bpf_d;
196struct componentname;
197struct devfs_dirent;
198struct ifnet;
199struct ifreq;
200struct ipq;
--- 41 unchanged lines hidden (view full) ---
242
243/*
244 * Labeling event operations: file system objects, and things that
245 * look a lot like file system objects.
246 */
247void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de);
248void mac_create_devfs_directory(char *dirname, int dirnamelen,
249 struct devfs_dirent *de);
250void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp);
251void mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd,
252 struct devfs_dirent *de);
253void mac_create_vnode(struct ucred *cred, struct vnode *parent,
254 struct vnode *child);
255void mac_create_mount(struct ucred *cred, struct mount *mp);
256void mac_create_root_mount(struct ucred *cred, struct mount *mp);
257void mac_relabel_vnode(struct ucred *cred, struct vnode *vp,
258 struct label *newlabel);
259void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp);
260void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred);
--- 145 unchanged lines hidden ---