1101099Srwatson/*- 2126097Srwatson * Copyright (c) 1999-2002 Robert N. M. Watson 3132232Srwatson * Copyright (c) 2001-2004 Networks Associates Technology, Inc. 4101099Srwatson * All rights reserved. 5101099Srwatson * 6101099Srwatson * This software was developed by Robert Watson for the TrustedBSD Project. 7101099Srwatson * 8106393Srwatson * This software was developed for the FreeBSD Project in part by Network 9106393Srwatson * Associates Laboratories, the Security Research Division of Network 10106393Srwatson * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 11106393Srwatson * as part of the DARPA CHATS research program. 12101099Srwatson * 13101099Srwatson * Redistribution and use in source and binary forms, with or without 14101099Srwatson * modification, are permitted provided that the following conditions 15101099Srwatson * are met: 16101099Srwatson * 1. Redistributions of source code must retain the above copyright 17101099Srwatson * notice, this list of conditions and the following disclaimer. 18101099Srwatson * 2. Redistributions in binary form must reproduce the above copyright 19101099Srwatson * notice, this list of conditions and the following disclaimer in the 20101099Srwatson * documentation and/or other materials provided with the distribution. 21101099Srwatson * 22101099Srwatson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 23101099Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24101099Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25101099Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 26101099Srwatson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27101099Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28101099Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29101099Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30101099Srwatson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31101099Srwatson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32101099Srwatson * SUCH DAMAGE. 33101099Srwatson * 34101099Srwatson * $FreeBSD: releng/11.0/sys/security/mac_biba/mac_biba.h 299187 2016-05-06 16:59:04Z pfg $ 35101099Srwatson */ 36101099Srwatson/* 37101099Srwatson * Definitions for the TrustedBSD Biba integrity policy module. 38101099Srwatson */ 39101099Srwatson#ifndef _SYS_SECURITY_MAC_BIBA_H 40101099Srwatson#define _SYS_SECURITY_MAC_BIBA_H 41101099Srwatson 42101099Srwatson#define MAC_BIBA_EXTATTR_NAMESPACE EXTATTR_NAMESPACE_SYSTEM 43101099Srwatson#define MAC_BIBA_EXTATTR_NAME "mac_biba" 44101099Srwatson 45105696Srwatson#define MAC_BIBA_LABEL_NAME "biba" 46105696Srwatson 47132232Srwatson#define MAC_BIBA_FLAG_EFFECTIVE 0x00000001 /* mb_effective initialized */ 48101099Srwatson#define MAC_BIBA_FLAG_RANGE 0x00000002 /* mb_range* initialized */ 49132232Srwatson#define MAC_BIBA_FLAGS_BOTH (MAC_BIBA_FLAG_EFFECTIVE | MAC_BIBA_FLAG_RANGE) 50101099Srwatson 51101099Srwatson#define MAC_BIBA_TYPE_UNDEF 0 /* Undefined */ 52101099Srwatson#define MAC_BIBA_TYPE_GRADE 1 /* Hierarchal grade with mb_grade. */ 53101099Srwatson#define MAC_BIBA_TYPE_LOW 2 /* Dominated by any 54101099Srwatson * MAC_BIBA_TYPE_LABEL. */ 55101099Srwatson#define MAC_BIBA_TYPE_HIGH 3 /* Dominates any 56101099Srwatson * MAC_BIBA_TYPE_LABEL. */ 57299187Spfg#define MAC_BIBA_TYPE_EQUAL 4 /* Equivalent to any 58101099Srwatson * MAC_BIBA_TYPE_LABEL. */ 59101099Srwatson 60105643Srwatson/* 61106093Srwatson * Structures and constants associated with a Biba Integrity policy. 62106093Srwatson * mac_biba represents a Biba label, with mb_type determining its properties, 63106093Srwatson * and mb_grade represents the hierarchal grade if valid for the current 64106093Srwatson * mb_type. 65106093Srwatson */ 66106093Srwatson 67106093Srwatson#define MAC_BIBA_MAX_COMPARTMENTS 256 68106093Srwatson 69106093Srwatsonstruct mac_biba_element { 70106093Srwatson u_short mbe_type; 71106093Srwatson u_short mbe_grade; 72106093Srwatson u_char mbe_compartments[MAC_BIBA_MAX_COMPARTMENTS >> 3]; 73106093Srwatson}; 74106093Srwatson 75106093Srwatson/* 76132232Srwatson * Biba labels consist of two components: an effective label, and a label 77106093Srwatson * range. Depending on the context, one or both may be used; the mb_flags 78106093Srwatson * field permits the provider to indicate what fields are intended for 79106093Srwatson * use. 80106093Srwatson */ 81106093Srwatsonstruct mac_biba { 82106093Srwatson int mb_flags; 83132232Srwatson struct mac_biba_element mb_effective; 84106093Srwatson struct mac_biba_element mb_rangelow, mb_rangehigh; 85106093Srwatson}; 86106093Srwatson 87106093Srwatson/* 88105643Srwatson * Biba compartments bit test/set macros. 89105643Srwatson * The range is 1 to MAC_BIBA_MAX_COMPARTMENTS. 90105643Srwatson */ 91105643Srwatson#define MAC_BIBA_BIT_TEST(b, w) \ 92105643Srwatson ((w)[(((b) - 1) >> 3)] & (1 << (((b) - 1) & 7))) 93105643Srwatson#define MAC_BIBA_BIT_SET(b, w) \ 94105643Srwatson ((w)[(((b) - 1) >> 3)] |= (1 << (((b) - 1) & 7))) 95105643Srwatson#define MAC_BIBA_BIT_SET_EMPTY(set) biba_bit_set_empty(set) 96105643Srwatson 97101099Srwatson#endif /* !_SYS_SECURITY_MAC_BIBA_H */ 98