1107273Srwatson/*- 2126097Srwatson * Copyright (c) 1999-2002 Robert N. M. Watson 3126097Srwatson * Copyright (c) 2001-2002 Networks Associates Technology, Inc. 4107273Srwatson * All rights reserved. 5107273Srwatson * 6107273Srwatson * This software was developed by Robert Watson for the TrustedBSD Project. 7107273Srwatson * 8107273Srwatson * This software was developed for the FreeBSD Project in part by NAI Labs, 9107273Srwatson * the Security Research Division of Network Associates, Inc. under 10107273Srwatson * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA 11107273Srwatson * CHATS research program. 12107273Srwatson * 13107273Srwatson * Redistribution and use in source and binary forms, with or without 14107273Srwatson * modification, are permitted provided that the following conditions 15107273Srwatson * are met: 16107273Srwatson * 1. Redistributions of source code must retain the above copyright 17107273Srwatson * notice, this list of conditions and the following disclaimer. 18107273Srwatson * 2. Redistributions in binary form must reproduce the above copyright 19107273Srwatson * notice, this list of conditions and the following disclaimer in the 20107273Srwatson * documentation and/or other materials provided with the distribution. 21107273Srwatson * 22107273Srwatson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 23107273Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24107273Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25107273Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 26107273Srwatson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27107273Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28107273Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29107273Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30107273Srwatson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31107273Srwatson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32107273Srwatson * SUCH DAMAGE. 33107273Srwatson * 34107273Srwatson * $FreeBSD$ 35107273Srwatson */ 36107273Srwatson/* 37107273Srwatson * Definitions for the TrustedBSD LOMAC integrity policy module. 38107273Srwatson */ 39107273Srwatson#ifndef _SYS_SECURITY_MAC_LOMAC_H 40107273Srwatson#define _SYS_SECURITY_MAC_LOMAC_H 41107273Srwatson 42107273Srwatson#define MAC_LOMAC_EXTATTR_NAMESPACE EXTATTR_NAMESPACE_SYSTEM 43107273Srwatson#define MAC_LOMAC_EXTATTR_NAME "mac_lomac" 44107273Srwatson 45107273Srwatson#define MAC_LOMAC_LABEL_NAME "lomac" 46107273Srwatson 47107273Srwatson#define MAC_LOMAC_FLAG_SINGLE 0x00000001 /* ml_single initialized */ 48107273Srwatson#define MAC_LOMAC_FLAG_RANGE 0x00000002 /* ml_range* initialized */ 49107273Srwatson#define MAC_LOMAC_FLAG_AUX 0x00000004 /* ml_auxsingle initialized */ 50107273Srwatson#define MAC_LOMAC_FLAGS_BOTH (MAC_LOMAC_FLAG_SINGLE | MAC_LOMAC_FLAG_RANGE) 51107273Srwatson#define MAC_LOMAC_FLAG_UPDATE 0x00000008 /* must demote this process */ 52107273Srwatson 53107273Srwatson#define MAC_LOMAC_TYPE_UNDEF 0 /* Undefined */ 54107273Srwatson#define MAC_LOMAC_TYPE_GRADE 1 /* Hierarchal grade with mb_grade. */ 55107273Srwatson#define MAC_LOMAC_TYPE_LOW 2 /* Dominated by any 56107273Srwatson * MAC_LOMAC_TYPE_LABEL. */ 57107273Srwatson#define MAC_LOMAC_TYPE_HIGH 3 /* Dominates any 58107273Srwatson * MAC_LOMAC_TYPE_LABEL. */ 59299187Spfg#define MAC_LOMAC_TYPE_EQUAL 4 /* Equivalent to any 60107273Srwatson * MAC_LOMAC_TYPE_LABEL. */ 61107273Srwatson 62107273Srwatson/* 63107273Srwatson * Structures and constants associated with a LOMAC Integrity policy. 64107273Srwatson * mac_lomac represents a LOMAC label, with mb_type determining its properties, 65107273Srwatson * and mb_grade represents the hierarchal grade if valid for the current 66107273Srwatson * mb_type. 67107273Srwatson */ 68107273Srwatson 69107273Srwatsonstruct mac_lomac_element { 70107273Srwatson u_short mle_type; 71107273Srwatson u_short mle_grade; 72107273Srwatson}; 73107273Srwatson 74107273Srwatson/* 75107273Srwatson * LOMAC labels start with two components: a single label, and a label 76107273Srwatson * range. Depending on the context, one or both may be used; the ml_flags 77107273Srwatson * field permits the provider to indicate what fields are intended for 78107273Srwatson * use. The auxiliary label works the same way, but is only valid on 79107273Srwatson * filesystem objects to provide inheritance semantics on directories 80107273Srwatson * and "non-demoting" execution on executable files. 81107273Srwatson */ 82107273Srwatsonstruct mac_lomac { 83107273Srwatson int ml_flags; 84107273Srwatson struct mac_lomac_element ml_single; 85107273Srwatson struct mac_lomac_element ml_rangelow, ml_rangehigh; 86107273Srwatson struct mac_lomac_element ml_auxsingle; 87107273Srwatson}; 88107273Srwatson 89107273Srwatson#endif /* !_SYS_SECURITY_MAC_LOMAC_H */ 90