1/*- 2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. 4 * All rights reserved. 5 * 6 * This software was developed by Robert Watson for the TrustedBSD Project. 7 * 8 * This software was developed for the FreeBSD Project in part by NAI Labs, --- 20 unchanged lines hidden (view full) --- 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 * |
37 * $FreeBSD: head/sys/security/mac/mac_framework.h 105693 2002-10-22 14:27:44Z rwatson $ |
38 */ 39/* 40 * Userland/kernel interface for Mandatory Access Control. 41 * 42 * The POSIX.1e implementation page may be reached at: 43 * http://www.trustedbsd.org/ 44 */ 45#ifndef _SYS_MAC_H --- 11 unchanged lines hidden (view full) --- 57 * with UFS2. 58 */ 59#define FREEBSD_MAC_EXTATTR_NAME "freebsd.mac" 60#define FREEBSD_MAC_EXTATTR_NAMESPACE EXTATTR_NAMESPACE_SYSTEM 61 62/* 63 * MAC framework-related constants and limits. 64 */ |
65#define MAC_MAX_POLICY_NAME 32 66#define MAC_MAX_LABEL_ELEMENT_NAME 32 67#define MAC_MAX_LABEL_ELEMENT_DATA 4096 68#define MAC_MAX_LABEL_BUF_LEN 8192 |
69 |
70struct mac { 71 size_t m_buflen; 72 char *m_string; 73}; 74 75typedef struct mac *mac_t; 76 77#ifndef _KERNEL 78 |
79/* |
80 * Location of the userland MAC framework configuration file. mac.conf 81 * binds policy names to shared libraries that understand those policies, 82 * as well as setting defaults for MAC-aware applications. |
83 */ |
84#define MAC_CONFFILE "/etc/mac.conf" |
85 86/* |
87 * Extended non-POSIX.1e interfaces that offer additional services 88 * available from the userland and kernel MAC frameworks. |
89 */ |
90int mac_free(mac_t _label); 91int mac_from_text(mac_t *_label, const char *_text); 92int mac_get_fd(int _fd, mac_t _label); 93int mac_get_file(const char *_path, mac_t _label); 94int mac_get_link(const char *_path, mac_t _label); 95int mac_get_pid(pid_t _pid, mac_t _label); 96int mac_get_proc(mac_t _label); 97int mac_is_present(const char *_policyname); 98int mac_prepare(mac_t *_label, char *_elements); 99int mac_prepare_file_label(mac_t *_label); 100int mac_prepare_ifnet_label(mac_t *_label); 101int mac_prepare_process_label(mac_t *_label); 102int mac_set_fd(int _fildes, const mac_t _label); 103int mac_set_file(const char *_path, mac_t _label); 104int mac_set_link(const char *_path, mac_t _label); 105int mac_set_proc(const mac_t _label); 106int mac_syscall(const char *_policyname, int _call, void *_arg); 107int mac_to_text(mac_t mac, char **_text); 108 109#endif /* !_KERNEL */ 110 111/* 112 * XXXMAC: For compatibility until the labels on disk are changed. We 113 * will enable the definitions in various policy include files once 114 * these can be disabled. 115 */ 116 |
117#define MAC_BIBA_MAX_COMPARTMENTS 256 |
118 |
119struct mac_biba_element { 120 u_short mbe_type; 121 u_short mbe_grade; 122 u_char mbe_compartments[MAC_BIBA_MAX_COMPARTMENTS >> 3]; 123}; 124 |
125struct mac_biba { 126 int mb_flags; 127 struct mac_biba_element mb_single; |
128 struct mac_biba_element mb_rangelow, mb_rangehigh; |
129}; 130 |
131#define MAC_MLS_MAX_COMPARTMENTS 256 |
132 |
133struct mac_mls_element { 134 u_short mme_type; 135 u_short mme_level; 136 u_char mme_compartments[MAC_MLS_MAX_COMPARTMENTS >> 3]; 137}; 138 |
139struct mac_mls { 140 int mm_flags; 141 struct mac_mls_element mm_single; 142 struct mac_mls_element mm_rangelow, mm_rangehigh; 143}; 144 |
145#define MAC_TE_TYPE_MAXLEN 32 146struct mac_te { |
147 char mt_type[MAC_TE_TYPE_MAXLEN]; |
148}; 149 150struct mac_sebsd { |
151 uint32_t ms_psid; |
152}; 153 |
154struct oldmac { 155 int m_macflags; 156 struct mac_biba m_biba; 157 struct mac_mls m_mls; 158 struct mac_te m_te; 159 struct mac_sebsd m_sebsd; |
160}; |
161 |
162#ifdef _KERNEL |
163 |
164/* |
165 * Kernel functions to manage and evaluate labels. 166 */ 167struct bpf_d; 168struct componentname; 169struct devfs_dirent; 170struct ifnet; 171struct ifreq; 172struct ipq; --- 41 unchanged lines hidden (view full) --- 214 215/* 216 * Labeling event operations: file system objects, and things that 217 * look a lot like file system objects. 218 */ 219void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de); 220void mac_create_devfs_directory(char *dirname, int dirnamelen, 221 struct devfs_dirent *de); |
222void mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd, 223 struct devfs_dirent *de); |
224void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp); |
225void mac_create_vnode(struct ucred *cred, struct vnode *parent, 226 struct vnode *child); 227void mac_create_mount(struct ucred *cred, struct mount *mp); 228void mac_create_root_mount(struct ucred *cred, struct mount *mp); 229void mac_relabel_vnode(struct ucred *cred, struct vnode *vp, 230 struct label *newlabel); 231void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp); 232void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred); --- 145 unchanged lines hidden --- |