1 /* 2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License as published by 6 * the Free Software Foundation, version 2. 7 * 8 * Author: 9 * Casey Schaufler <casey@schaufler-ca.com> 10 * 11 */ 12 13 #ifndef _SECURITY_SMACK_H 14 #define _SECURITY_SMACK_H 15 16 #include <linux/capability.h> 17 #include <linux/spinlock.h> 18 #include <linux/security.h> 19 #include <net/netlabel.h> 20 21 /* 22 * Why 23? CIPSO is constrained to 30, so a 32 byte buffer is 23 * bigger than can be used, and 24 is the next lower multiple 24 * of 8, and there are too many issues if there isn't space set 25 * aside for the terminating null byte. 26 */ 27 #define SMK_MAXLEN 23 28 #define SMK_LABELLEN (SMK_MAXLEN+1) 29 30 struct superblock_smack { 31 char *smk_root; 32 char *smk_floor; 33 char *smk_hat; 34 char *smk_default; 35 int smk_initialized; 36 spinlock_t smk_sblock; /* for initialization */ 37 }; 38 39 struct socket_smack { 40 char *smk_out; /* outbound label */ 41 char *smk_in; /* inbound label */ 42 char smk_packet[SMK_LABELLEN]; /* TCP peer label */ 43 }; 44 45 /* 46 * Inode smack data 47 */ 48 struct inode_smack { 49 char *smk_inode; /* label of the fso */ 50 struct mutex smk_lock; /* initialization lock */ 51 int smk_flags; /* smack inode flags */ 52 }; 53 54 #define SMK_INODE_INSTANT 0x01 /* inode is instantiated */ 55 56 /* 57 * A label access rule. 58 */ 59 struct smack_rule { 60 char *smk_subject; 61 char *smk_object; 62 int smk_access; 63 }; 64 65 /* 66 * An entry in the table of permitted label accesses. 67 */ 68 struct smk_list_entry { 69 struct smk_list_entry *smk_next; 70 struct smack_rule smk_rule; 71 }; 72 73 /* 74 * An entry in the table mapping smack values to 75 * CIPSO level/category-set values. 76 */ 77 struct smack_cipso { 78 int smk_level; 79 char smk_catset[SMK_LABELLEN]; 80 }; 81 82 /* 83 * This is the repository for labels seen so that it is 84 * not necessary to keep allocating tiny chuncks of memory 85 * and so that they can be shared. 86 * 87 * Labels are never modified in place. Anytime a label 88 * is imported (e.g. xattrset on a file) the list is checked 89 * for it and it is added if it doesn't exist. The address 90 * is passed out in either case. Entries are added, but 91 * never deleted. 92 * 93 * Since labels are hanging around anyway it doesn't 94 * hurt to maintain a secid for those awkward situations 95 * where kernel components that ought to use LSM independent 96 * interfaces don't. The secid should go away when all of 97 * these components have been repaired. 98 * 99 * If there is a cipso value associated with the label it 100 * gets stored here, too. This will most likely be rare as 101 * the cipso direct mapping in used internally. 102 */ 103 struct smack_known { 104 struct smack_known *smk_next; 105 char smk_known[SMK_LABELLEN]; 106 u32 smk_secid; 107 struct smack_cipso *smk_cipso; 108 spinlock_t smk_cipsolock; /* for changing cipso map */ 109 }; 110 111 /* 112 * Mount options 113 */ 114 #define SMK_FSDEFAULT "smackfsdef=" 115 #define SMK_FSFLOOR "smackfsfloor=" 116 #define SMK_FSHAT "smackfshat=" 117 #define SMK_FSROOT "smackfsroot=" 118 119 /* 120 * xattr names 121 */ 122 #define XATTR_SMACK_SUFFIX "SMACK64" 123 #define XATTR_SMACK_IPIN "SMACK64IPIN" 124 #define XATTR_SMACK_IPOUT "SMACK64IPOUT" 125 #define XATTR_NAME_SMACK XATTR_SECURITY_PREFIX XATTR_SMACK_SUFFIX 126 #define XATTR_NAME_SMACKIPIN XATTR_SECURITY_PREFIX XATTR_SMACK_IPIN 127 #define XATTR_NAME_SMACKIPOUT XATTR_SECURITY_PREFIX XATTR_SMACK_IPOUT 128 129 /* 130 * smackfs macic number 131 */ 132 #define SMACK_MAGIC 0x43415d53 /* "SMAC" */ 133 134 /* 135 * A limit on the number of entries in the lists 136 * makes some of the list administration easier. 137 */ 138 #define SMACK_LIST_MAX 10000 139 140 /* 141 * CIPSO defaults. 142 */ 143 #define SMACK_CIPSO_DOI_DEFAULT 3 /* Historical */ 144 #define SMACK_CIPSO_DIRECT_DEFAULT 250 /* Arbitrary */ 145 #define SMACK_CIPSO_MAXCATVAL 63 /* Bigger gets harder */ 146 #define SMACK_CIPSO_MAXLEVEL 255 /* CIPSO 2.2 standard */ 147 #define SMACK_CIPSO_MAXCATNUM 239 /* CIPSO 2.2 standard */ 148 149 /* 150 * Just to make the common cases easier to deal with 151 */ 152 #define MAY_ANY (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) 153 #define MAY_ANYREAD (MAY_READ | MAY_EXEC) 154 #define MAY_ANYWRITE (MAY_WRITE | MAY_APPEND) 155 #define MAY_READWRITE (MAY_READ | MAY_WRITE) 156 #define MAY_NOT 0 157 158 /* 159 * These functions are in smack_lsm.c 160 */ 161 struct inode_smack *new_inode_smack(char *); 162 163 /* 164 * These functions are in smack_access.c 165 */ 166 int smk_access(char *, char *, int); 167 int smk_curacc(char *, u32); 168 int smack_to_cipso(const char *, struct smack_cipso *); 169 void smack_from_cipso(u32, char *, char *); 170 char *smack_from_secid(const u32); 171 char *smk_import(const char *, int); 172 struct smack_known *smk_import_entry(const char *, int); 173 u32 smack_to_secid(const char *); 174 175 /* 176 * Shared data. 177 */ 178 extern int smack_cipso_direct; 179 extern int smack_net_nltype; 180 extern char *smack_net_ambient; 181 182 extern struct smack_known *smack_known; 183 extern struct smack_known smack_known_floor; 184 extern struct smack_known smack_known_hat; 185 extern struct smack_known smack_known_huh; 186 extern struct smack_known smack_known_invalid; 187 extern struct smack_known smack_known_star; 188 extern struct smack_known smack_known_unset; 189 190 extern struct smk_list_entry *smack_list; 191 extern struct security_operations smack_ops; 192 193 /* 194 * Stricly for CIPSO level manipulation. 195 * Set the category bit number in a smack label sized buffer. 196 */ 197 static inline void smack_catset_bit(int cat, char *catsetp) 198 { 199 if (cat > SMK_LABELLEN * 8) 200 return; 201 202 catsetp[(cat - 1) / 8] |= 0x80 >> ((cat - 1) % 8); 203 } 204 205 /* 206 * Present a pointer to the smack label in an inode blob. 207 */ 208 static inline char *smk_of_inode(const struct inode *isp) 209 { 210 struct inode_smack *sip = isp->i_security; 211 return sip->smk_inode; 212 } 213 214 #endif /* _SECURITY_SMACK_H */ 215