1/* 2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License as published by 6 * the Free Software Foundation, version 2. 7 * 8 * Author: 9 * Casey Schaufler <casey@schaufler-ca.com> 10 * 11 */ 12 13#ifndef _SECURITY_SMACK_H 14#define _SECURITY_SMACK_H 15 16#include <linux/capability.h> 17#include <linux/spinlock.h> 18#include <linux/security.h> 19#include <net/netlabel.h> 20 21/* 22 * Why 23? CIPSO is constrained to 30, so a 32 byte buffer is 23 * bigger than can be used, and 24 is the next lower multiple 24 * of 8, and there are too many issues if there isn't space set 25 * aside for the terminating null byte. 26 */ 27#define SMK_MAXLEN 23 28#define SMK_LABELLEN (SMK_MAXLEN+1) 29 30struct superblock_smack { 31 char *smk_root; 32 char *smk_floor; 33 char *smk_hat; 34 char *smk_default; 35 int smk_initialized; 36 spinlock_t smk_sblock; /* for initialization */ 37}; 38 39struct socket_smack { 40 char *smk_out; /* outbound label */ 41 char *smk_in; /* inbound label */ 42 char smk_packet[SMK_LABELLEN]; /* TCP peer label */ 43}; 44 45/* 46 * Inode smack data 47 */ 48struct inode_smack { 49 char *smk_inode; /* label of the fso */ 50 struct mutex smk_lock; /* initialization lock */ 51 int smk_flags; /* smack inode flags */ 52}; 53 54#define SMK_INODE_INSTANT 0x01 /* inode is instantiated */ 55 56/* 57 * A label access rule. 58 */ 59struct smack_rule { 60 char *smk_subject; 61 char *smk_object; 62 int smk_access; 63}; 64 65/* 66 * An entry in the table of permitted label accesses. 67 */ 68struct smk_list_entry { 69 struct smk_list_entry *smk_next; 70 struct smack_rule smk_rule; 71}; 72 73/* 74 * An entry in the table mapping smack values to 75 * CIPSO level/category-set values. 76 */ 77struct smack_cipso { 78 int smk_level; 79 char smk_catset[SMK_LABELLEN]; 80}; 81 82/* 83 * This is the repository for labels seen so that it is 84 * not necessary to keep allocating tiny chuncks of memory 85 * and so that they can be shared. 86 * 87 * Labels are never modified in place. Anytime a label 88 * is imported (e.g. xattrset on a file) the list is checked 89 * for it and it is added if it doesn't exist. The address 90 * is passed out in either case. Entries are added, but 91 * never deleted. 92 * 93 * Since labels are hanging around anyway it doesn't 94 * hurt to maintain a secid for those awkward situations 95 * where kernel components that ought to use LSM independent 96 * interfaces don't. The secid should go away when all of 97 * these components have been repaired. 98 * 99 * If there is a cipso value associated with the label it 100 * gets stored here, too. This will most likely be rare as 101 * the cipso direct mapping in used internally. 102 */ 103struct smack_known { 104 struct smack_known *smk_next; 105 char smk_known[SMK_LABELLEN]; 106 u32 smk_secid; 107 struct smack_cipso *smk_cipso; 108 spinlock_t smk_cipsolock; /* for changing cipso map */ 109}; 110 111/* 112 * Mount options 113 */ 114#define SMK_FSDEFAULT "smackfsdef=" 115#define SMK_FSFLOOR "smackfsfloor=" 116#define SMK_FSHAT "smackfshat=" 117#define SMK_FSROOT "smackfsroot=" 118 119/* 120 * xattr names 121 */ 122#define XATTR_SMACK_SUFFIX "SMACK64" 123#define XATTR_SMACK_IPIN "SMACK64IPIN" 124#define XATTR_SMACK_IPOUT "SMACK64IPOUT" 125#define XATTR_NAME_SMACK XATTR_SECURITY_PREFIX XATTR_SMACK_SUFFIX 126#define XATTR_NAME_SMACKIPIN XATTR_SECURITY_PREFIX XATTR_SMACK_IPIN 127#define XATTR_NAME_SMACKIPOUT XATTR_SECURITY_PREFIX XATTR_SMACK_IPOUT 128 129/* 130 * smackfs macic number 131 */ 132#define SMACK_MAGIC 0x43415d53 /* "SMAC" */ 133 134/* 135 * A limit on the number of entries in the lists 136 * makes some of the list administration easier. 137 */ 138#define SMACK_LIST_MAX 10000 139 140/* 141 * CIPSO defaults. 142 */ 143#define SMACK_CIPSO_DOI_DEFAULT 3 /* Historical */ 144#define SMACK_CIPSO_DIRECT_DEFAULT 250 /* Arbitrary */ 145#define SMACK_CIPSO_MAXCATVAL 63 /* Bigger gets harder */ 146#define SMACK_CIPSO_MAXLEVEL 255 /* CIPSO 2.2 standard */ 147#define SMACK_CIPSO_MAXCATNUM 239 /* CIPSO 2.2 standard */ 148 149/* 150 * Just to make the common cases easier to deal with 151 */ 152#define MAY_ANY (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) 153#define MAY_ANYREAD (MAY_READ | MAY_EXEC) 154#define MAY_ANYWRITE (MAY_WRITE | MAY_APPEND) 155#define MAY_READWRITE (MAY_READ | MAY_WRITE) 156#define MAY_NOT 0 157 158/* 159 * These functions are in smack_lsm.c 160 */ 161struct inode_smack *new_inode_smack(char *); 162 163/* 164 * These functions are in smack_access.c 165 */ 166int smk_access(char *, char *, int); 167int smk_curacc(char *, u32); 168int smack_to_cipso(const char *, struct smack_cipso *); 169void smack_from_cipso(u32, char *, char *); 170char *smack_from_secid(const u32); 171char *smk_import(const char *, int); 172struct smack_known *smk_import_entry(const char *, int); 173u32 smack_to_secid(const char *); 174 175/* 176 * Shared data. 177 */ 178extern int smack_cipso_direct; 179extern int smack_net_nltype; 180extern char *smack_net_ambient; 181extern char *smack_onlycap; 182 183extern struct smack_known *smack_known; 184extern struct smack_known smack_known_floor; 185extern struct smack_known smack_known_hat; 186extern struct smack_known smack_known_huh; 187extern struct smack_known smack_known_invalid; 188extern struct smack_known smack_known_star; 189extern struct smack_known smack_known_unset; 190 191extern struct smk_list_entry *smack_list; 192extern struct security_operations smack_ops; 193 194/* 195 * Stricly for CIPSO level manipulation. 196 * Set the category bit number in a smack label sized buffer. 197 */ 198static inline void smack_catset_bit(int cat, char *catsetp) 199{ 200 if (cat > SMK_LABELLEN * 8) 201 return; 202 203 catsetp[(cat - 1) / 8] |= 0x80 >> ((cat - 1) % 8); 204} 205 206/* 207 * Present a pointer to the smack label in an inode blob. 208 */ 209static inline char *smk_of_inode(const struct inode *isp) 210{ 211 struct inode_smack *sip = isp->i_security; 212 return sip->smk_inode; 213} 214 215#endif /* _SECURITY_SMACK_H */ 216