1
2
3
4
5
6
7
8
9
10
11
12
13#ifndef _SECURITY_SMACK_H
14#define _SECURITY_SMACK_H
15
16#include <linux/capability.h>
17#include <linux/spinlock.h>
18#include <linux/security.h>
19#include <linux/in.h>
20#include <net/netlabel.h>
21#include <linux/list.h>
22#include <linux/rculist.h>
23#include <linux/lsm_audit.h>
24
25
26
27
28
29
30
31#define SMK_MAXLEN 23
32#define SMK_LABELLEN (SMK_MAXLEN+1)
33
34struct superblock_smack {
35 char *smk_root;
36 char *smk_floor;
37 char *smk_hat;
38 char *smk_default;
39 int smk_initialized;
40 spinlock_t smk_sblock;
41};
42
43struct socket_smack {
44 char *smk_out;
45 char *smk_in;
46 char smk_packet[SMK_LABELLEN];
47};
48
49
50
51
52struct inode_smack {
53 char *smk_inode;
54 struct mutex smk_lock;
55 int smk_flags;
56};
57
58#define SMK_INODE_INSTANT 0x01
59
60
61
62
63struct smack_rule {
64 struct list_head list;
65 char *smk_subject;
66 char *smk_object;
67 int smk_access;
68};
69
70
71
72
73
74struct smack_cipso {
75 int smk_level;
76 char smk_catset[SMK_LABELLEN];
77};
78
79
80
81
82struct smk_netlbladdr {
83 struct list_head list;
84 struct sockaddr_in smk_host;
85 struct in_addr smk_mask;
86 char *smk_label;
87};
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110struct smack_known {
111 struct list_head list;
112 char smk_known[SMK_LABELLEN];
113 u32 smk_secid;
114 struct smack_cipso *smk_cipso;
115 spinlock_t smk_cipsolock;
116};
117
118
119
120
121#define SMK_FSDEFAULT "smackfsdef="
122#define SMK_FSFLOOR "smackfsfloor="
123#define SMK_FSHAT "smackfshat="
124#define SMK_FSROOT "smackfsroot="
125
126
127
128
129#define XATTR_SMACK_SUFFIX "SMACK64"
130#define XATTR_SMACK_IPIN "SMACK64IPIN"
131#define XATTR_SMACK_IPOUT "SMACK64IPOUT"
132#define XATTR_NAME_SMACK XATTR_SECURITY_PREFIX XATTR_SMACK_SUFFIX
133#define XATTR_NAME_SMACKIPIN XATTR_SECURITY_PREFIX XATTR_SMACK_IPIN
134#define XATTR_NAME_SMACKIPOUT XATTR_SECURITY_PREFIX XATTR_SMACK_IPOUT
135
136#define SMACK_CIPSO_OPTION "-CIPSO"
137
138
139
140
141
142
143
144
145
146
147
148#define SMACK_UNLABELED_SOCKET 0
149#define SMACK_CIPSO_SOCKET 1
150
151
152
153
154
155#define SMACK_MAGIC 0x43415d53
156
157
158
159
160
161#define SMACK_LIST_MAX 10000
162
163
164
165
166#define SMACK_CIPSO_DOI_DEFAULT 3
167#define SMACK_CIPSO_DOI_INVALID -1
168#define SMACK_CIPSO_DIRECT_DEFAULT 250
169#define SMACK_CIPSO_MAXCATVAL 63
170#define SMACK_CIPSO_MAXLEVEL 255
171#define SMACK_CIPSO_MAXCATNUM 239
172
173
174
175
176#define MAY_ANY (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
177#define MAY_ANYREAD (MAY_READ | MAY_EXEC)
178#define MAY_ANYWRITE (MAY_WRITE | MAY_APPEND)
179#define MAY_READWRITE (MAY_READ | MAY_WRITE)
180#define MAY_NOT 0
181
182
183
184
185#define SMK_NUM_ACCESS_TYPE 4
186
187
188
189
190
191struct smk_audit_info {
192#ifdef CONFIG_AUDIT
193 struct common_audit_data a;
194#endif
195};
196
197
198
199struct inode_smack *new_inode_smack(char *);
200
201
202
203
204int smk_access(char *, char *, int, struct smk_audit_info *);
205int smk_curacc(char *, u32, struct smk_audit_info *);
206int smack_to_cipso(const char *, struct smack_cipso *);
207void smack_from_cipso(u32, char *, char *);
208char *smack_from_secid(const u32);
209char *smk_import(const char *, int);
210struct smack_known *smk_import_entry(const char *, int);
211u32 smack_to_secid(const char *);
212
213
214
215
216extern int smack_cipso_direct;
217extern char *smack_net_ambient;
218extern char *smack_onlycap;
219extern const char *smack_cipso_option;
220
221extern struct smack_known smack_known_floor;
222extern struct smack_known smack_known_hat;
223extern struct smack_known smack_known_huh;
224extern struct smack_known smack_known_invalid;
225extern struct smack_known smack_known_star;
226extern struct smack_known smack_known_web;
227
228extern struct list_head smack_known_list;
229extern struct list_head smack_rule_list;
230extern struct list_head smk_netlbladdr_list;
231
232extern struct security_operations smack_ops;
233
234
235
236
237
238static inline void smack_catset_bit(int cat, char *catsetp)
239{
240 if (cat > SMK_LABELLEN * 8)
241 return;
242
243 catsetp[(cat - 1) / 8] |= 0x80 >> ((cat - 1) % 8);
244}
245
246
247
248
249static inline char *smk_of_inode(const struct inode *isp)
250{
251 struct inode_smack *sip = isp->i_security;
252 return sip->smk_inode;
253}
254
255
256
257
258#define SMACK_AUDIT_DENIED 0x1
259#define SMACK_AUDIT_ACCEPT 0x2
260extern int log_policy;
261
262void smack_log(char *subject_label, char *object_label,
263 int request,
264 int result, struct smk_audit_info *auditdata);
265
266#ifdef CONFIG_AUDIT
267
268
269
270
271
272
273static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
274 char type)
275{
276 memset(a, 0, sizeof(*a));
277 a->a.type = type;
278 a->a.smack_audit_data.function = func;
279}
280
281static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
282 struct task_struct *t)
283{
284 a->a.u.tsk = t;
285}
286static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
287 struct dentry *d)
288{
289 a->a.u.fs.path.dentry = d;
290}
291static inline void smk_ad_setfield_u_fs_path_mnt(struct smk_audit_info *a,
292 struct vfsmount *m)
293{
294 a->a.u.fs.path.mnt = m;
295}
296static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
297 struct inode *i)
298{
299 a->a.u.fs.inode = i;
300}
301static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
302 struct path p)
303{
304 a->a.u.fs.path = p;
305}
306static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
307 struct sock *sk)
308{
309 a->a.u.net.sk = sk;
310}
311
312#else
313
314static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
315 char type)
316{
317}
318static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
319 struct task_struct *t)
320{
321}
322static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
323 struct dentry *d)
324{
325}
326static inline void smk_ad_setfield_u_fs_path_mnt(struct smk_audit_info *a,
327 struct vfsmount *m)
328{
329}
330static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
331 struct inode *i)
332{
333}
334static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
335 struct path p)
336{
337}
338static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
339 struct sock *sk)
340{
341}
342#endif
343
344#endif
345