Deleted Added
sdiff udiff text old ( 105643 ) new ( 105693 )
full compact
mac_framework.h (105643) mac_framework.h (105693)
1/*-
2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
3 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc.
4 * All rights reserved.
5 *
6 * This software was developed by Robert Watson for the TrustedBSD Project.
7 *
8 * This software was developed for the FreeBSD Project in part by NAI Labs,

--- 20 unchanged lines hidden (view full) ---

29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * SUCH DAMAGE.
36 *
1/*-
2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
3 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc.
4 * All rights reserved.
5 *
6 * This software was developed by Robert Watson for the TrustedBSD Project.
7 *
8 * This software was developed for the FreeBSD Project in part by NAI Labs,

--- 20 unchanged lines hidden (view full) ---

29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * SUCH DAMAGE.
36 *
37 * $FreeBSD: head/sys/security/mac/mac_framework.h 105643 2002-10-21 18:42:01Z rwatson $
37 * $FreeBSD: head/sys/security/mac/mac_framework.h 105693 2002-10-22 14:27:44Z rwatson $
38 */
39/*
40 * Userland/kernel interface for Mandatory Access Control.
41 *
42 * The POSIX.1e implementation page may be reached at:
43 * http://www.trustedbsd.org/
44 */
45#ifndef _SYS_MAC_H

--- 11 unchanged lines hidden (view full) ---

57 * with UFS2.
58 */
59#define FREEBSD_MAC_EXTATTR_NAME "freebsd.mac"
60#define FREEBSD_MAC_EXTATTR_NAMESPACE EXTATTR_NAMESPACE_SYSTEM
61
62/*
63 * MAC framework-related constants and limits.
64 */
38 */
39/*
40 * Userland/kernel interface for Mandatory Access Control.
41 *
42 * The POSIX.1e implementation page may be reached at:
43 * http://www.trustedbsd.org/
44 */
45#ifndef _SYS_MAC_H

--- 11 unchanged lines hidden (view full) ---

57 * with UFS2.
58 */
59#define FREEBSD_MAC_EXTATTR_NAME "freebsd.mac"
60#define FREEBSD_MAC_EXTATTR_NAMESPACE EXTATTR_NAMESPACE_SYSTEM
61
62/*
63 * MAC framework-related constants and limits.
64 */
65#define MAC_MAX_POLICY_NAME 32
65#define MAC_MAX_POLICY_NAME 32
66#define MAC_MAX_LABEL_ELEMENT_NAME 32
67#define MAC_MAX_LABEL_ELEMENT_DATA 4096
68#define MAC_MAX_LABEL_BUF_LEN 8192
66
69
70struct mac {
71 size_t m_buflen;
72 char *m_string;
73};
74
75typedef struct mac *mac_t;
76
77#ifndef _KERNEL
78
67/*
79/*
68 * XXXMAC: Per-policy structures will be moved from mac.h to per-policy
69 * include files once the revised user interface is available.
80 * Location of the userland MAC framework configuration file. mac.conf
81 * binds policy names to shared libraries that understand those policies,
82 * as well as setting defaults for MAC-aware applications.
70 */
83 */
84#define MAC_CONFFILE "/etc/mac.conf"
71
72/*
85
86/*
73 * Structures and constants associated with a Biba Integrity policy.
74 * mac_biba represents a Biba label, with mb_type determining its properties,
75 * and mb_grade represents the hierarchal grade if valid for the current
76 * mb_type. These structures will move to mac_biba.h once we have dymamic
77 * labels exposed to userland.
87 * Extended non-POSIX.1e interfaces that offer additional services
88 * available from the userland and kernel MAC frameworks.
78 */
89 */
90int mac_free(mac_t _label);
91int mac_from_text(mac_t *_label, const char *_text);
92int mac_get_fd(int _fd, mac_t _label);
93int mac_get_file(const char *_path, mac_t _label);
94int mac_get_link(const char *_path, mac_t _label);
95int mac_get_pid(pid_t _pid, mac_t _label);
96int mac_get_proc(mac_t _label);
97int mac_is_present(const char *_policyname);
98int mac_prepare(mac_t *_label, char *_elements);
99int mac_prepare_file_label(mac_t *_label);
100int mac_prepare_ifnet_label(mac_t *_label);
101int mac_prepare_process_label(mac_t *_label);
102int mac_set_fd(int _fildes, const mac_t _label);
103int mac_set_file(const char *_path, mac_t _label);
104int mac_set_link(const char *_path, mac_t _label);
105int mac_set_proc(const mac_t _label);
106int mac_syscall(const char *_policyname, int _call, void *_arg);
107int mac_to_text(mac_t mac, char **_text);
108
109#endif /* !_KERNEL */
110
111/*
112 * XXXMAC: For compatibility until the labels on disk are changed. We
113 * will enable the definitions in various policy include files once
114 * these can be disabled.
115 */
116
79#define MAC_BIBA_MAX_COMPARTMENTS 256
117#define MAC_BIBA_MAX_COMPARTMENTS 256
118
80struct mac_biba_element {
81 u_short mbe_type;
82 u_short mbe_grade;
83 u_char mbe_compartments[MAC_BIBA_MAX_COMPARTMENTS >> 3];
84};
85
119struct mac_biba_element {
120 u_short mbe_type;
121 u_short mbe_grade;
122 u_char mbe_compartments[MAC_BIBA_MAX_COMPARTMENTS >> 3];
123};
124
86/*
87 * Biba labels consist of two components: a single label, and a label
88 * range. Depending on the context, one or both may be used; the mb_flags
89 * field permits the provider to indicate what fields are intended for
90 * use.
91 */
92struct mac_biba {
93 int mb_flags;
94 struct mac_biba_element mb_single;
125struct mac_biba {
126 int mb_flags;
127 struct mac_biba_element mb_single;
95 struct mac_biba_element mb_rangelow, mb_rangehigh;
128 struct mac_biba_element mb_rangelow, mb_rangehigh;
96};
97
129};
130
98/*
99 * Structures and constants associated with a Multi-Level Security policy.
100 * mac_mls represents an MLS label, with mm_type determining its properties,
101 * and mm_level represents the hierarchal sensitivity level if valid for the
102 * current mm_type. These structures will move to mac_mls.h once we have
103 * dynamic labels exposed to userland.
104 */
105#define MAC_MLS_MAX_COMPARTMENTS 256
131#define MAC_MLS_MAX_COMPARTMENTS 256
132
106struct mac_mls_element {
107 u_short mme_type;
108 u_short mme_level;
109 u_char mme_compartments[MAC_MLS_MAX_COMPARTMENTS >> 3];
110};
111
133struct mac_mls_element {
134 u_short mme_type;
135 u_short mme_level;
136 u_char mme_compartments[MAC_MLS_MAX_COMPARTMENTS >> 3];
137};
138
112/*
113 * MLS labels consist of two components: a single label, and a label
114 * range. Depending on the context, one or both may be used; the mb_flags
115 * field permits the provider to indicate what fields are intended for
116 * use.
117 */
118struct mac_mls {
119 int mm_flags;
120 struct mac_mls_element mm_single;
121 struct mac_mls_element mm_rangelow, mm_rangehigh;
122};
123
139struct mac_mls {
140 int mm_flags;
141 struct mac_mls_element mm_single;
142 struct mac_mls_element mm_rangelow, mm_rangehigh;
143};
144
124/*
125 * Structures and constants associated with a Type Enforcement policy.
126 * mac_te represents a Type Enforcement label.
127 */
128#define MAC_TE_TYPE_MAXLEN 32
129struct mac_te {
145#define MAC_TE_TYPE_MAXLEN 32
146struct mac_te {
130 char mt_type[MAC_TE_TYPE_MAXLEN+1]; /* TE type */
147 char mt_type[MAC_TE_TYPE_MAXLEN];
131};
132
133struct mac_sebsd {
148};
149
150struct mac_sebsd {
134 uint32_t ms_psid; /* persistent sid storage */
151 uint32_t ms_psid;
135};
136
152};
153
137/*
138 * Composite structures and constants which combine the various policy
139 * elements into common structures to be associated with subjects and
140 * objects.
141 */
142struct mac {
143 int m_macflags;
144 struct mac_biba m_biba;
145 struct mac_mls m_mls;
146 struct mac_te m_te;
147 struct mac_sebsd m_sebsd;
154struct oldmac {
155 int m_macflags;
156 struct mac_biba m_biba;
157 struct mac_mls m_mls;
158 struct mac_te m_te;
159 struct mac_sebsd m_sebsd;
148};
160};
149typedef struct mac *mac_t;
150
161
151#define MAC_FLAG_INITIALIZED 0x00000001 /* Is initialized. */
162#ifdef _KERNEL
152
163
153#ifndef _KERNEL
154
155/*
164/*
156 * POSIX.1e functions visible in the application namespace.
157 */
158int mac_dominate(const mac_t _labela, const mac_t _labelb);
159int mac_equal(const mac_t labela, const mac_t _labelb);
160int mac_free(void *_buf_p);
161mac_t mac_from_text(const char *_text_p);
162mac_t mac_get_fd(int _fildes);
163mac_t mac_get_file(const char *_path_p);
164mac_t mac_get_proc(void);
165mac_t mac_glb(const mac_t _labela, const mac_t _labelb);
166mac_t mac_lub(const mac_t _labela, const mac_t _labelb);
167int mac_set_fd(int _fildes, const mac_t _label);
168int mac_set_file(const char *_path_p, mac_t _label);
169int mac_set_proc(const mac_t _label);
170ssize_t mac_size(mac_t _label);
171char * mac_to_text(const mac_t _label, size_t *_len_p);
172int mac_valid(const mac_t _label);
173
174/*
175 * Extensions to POSIX.1e visible in the application namespace.
176 */
177int mac_is_present_np(const char *_policyname);
178int mac_syscall(const char *_policyname, int call, void *arg);
179
180/*
181 * System calls wrapped by some POSIX.1e functions.
182 */
183int __mac_get_fd(int _fd, struct mac *_mac_p);
184int __mac_get_file(const char *_path_p, struct mac *_mac_p);
185int __mac_get_proc(struct mac *_mac_p);
186int __mac_set_fd(int fd, struct mac *_mac_p);
187int __mac_set_file(const char *_path_p, struct mac *_mac_p);
188int __mac_set_proc(struct mac *_mac_p);
189
190#else /* _KERNEL */
191
192/*
193 * Kernel functions to manage and evaluate labels.
194 */
195struct bpf_d;
196struct componentname;
197struct devfs_dirent;
198struct ifnet;
199struct ifreq;
200struct ipq;

--- 41 unchanged lines hidden (view full) ---

242
243/*
244 * Labeling event operations: file system objects, and things that
245 * look a lot like file system objects.
246 */
247void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de);
248void mac_create_devfs_directory(char *dirname, int dirnamelen,
249 struct devfs_dirent *de);
165 * Kernel functions to manage and evaluate labels.
166 */
167struct bpf_d;
168struct componentname;
169struct devfs_dirent;
170struct ifnet;
171struct ifreq;
172struct ipq;

--- 41 unchanged lines hidden (view full) ---

214
215/*
216 * Labeling event operations: file system objects, and things that
217 * look a lot like file system objects.
218 */
219void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de);
220void mac_create_devfs_directory(char *dirname, int dirnamelen,
221 struct devfs_dirent *de);
250void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp);
251void mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd,
252 struct devfs_dirent *de);
222void mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd,
223 struct devfs_dirent *de);
224void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp);
253void mac_create_vnode(struct ucred *cred, struct vnode *parent,
254 struct vnode *child);
255void mac_create_mount(struct ucred *cred, struct mount *mp);
256void mac_create_root_mount(struct ucred *cred, struct mount *mp);
257void mac_relabel_vnode(struct ucred *cred, struct vnode *vp,
258 struct label *newlabel);
259void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp);
260void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred);

--- 145 unchanged lines hidden --- 		225void mac_create_vnode(struct ucred *cred, struct vnode *parent,
226 struct vnode *child);
227void mac_create_mount(struct ucred *cred, struct mount *mp);
228void mac_create_root_mount(struct ucred *cred, struct mount *mp);
229void mac_relabel_vnode(struct ucred *cred, struct vnode *vp,
230 struct label *newlabel);
231void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp);
232void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred);

--- 145 unchanged lines hidden ---