オープンソース・ソフトウェアの開発とダウンロード

TOMOYO

Subversion リポジトリの参照

/[tomoyo]/trunk/1.5.x/ccs-patch/include/linux/tomoyo.h

Contents of /trunk/1.5.x/ccs-patch/include/linux/tomoyo.h

Parent Directory Parent Directory | Revision Log Revision Log

Revision 473 - (show annotations) (download) (as text)
Thu Sep 20 12:18:18 2007 UTC (16 years, 8 months ago) by kumaneko
File MIME type: text/x-chdr
File size: 9720 byte(s) 
1.5.0-rc
1 /*
2 * include/linux/tomoyo.h
3 *
4 * Implementation of the Domain-Based Mandatory Access Control.
5 *
6 * Copyright (C) 2005-2007 NTT DATA CORPORATION
7 *
8 * Version: 1.5.0-rc 2007/09/20
9 *
10 * This file is applicable to both 2.4.30 and 2.6.11 and later.
11 * See README.ccs for ChangeLog.
12 *
13 */
14 /*
15 * A brief description about TOMOYO:
16 *
17 * TOMOYO stands for "Task Oriented Management Obviates Your Onus".
18 * TOMOYO is intended to provide the Domain-Based MAC utilizing task_struct.
19 *
20 * The biggest feature of TOMOYO is that TOMOYO has "learning mode".
21 * The learning mode can automatically generate policy definition,
22 * and dramatically reduces the policy definition labors.
23 *
24 * TOMOYO is applicable to figuring out the system's behavior, for
25 * TOMOYO uses the canonicalized absolute pathnames and TreeView style domain transitions.
26 */
27
28 #ifndef _LINUX_TOMOYO_H
29 #define _LINUX_TOMOYO_H
30
31 #ifndef __user
32 #define __user
33 #endif
34
35 /***** TOMOYO Linux start. *****/
36
37 struct path_info;
38 struct dentry;
39 struct vfsmount;
40 struct inode;
41 struct linux_binprm;
42 struct pt_regs;
43
44 #if defined(CONFIG_TOMOYO)
45
46 /* Check whether the given filename is allowed to read/write/execute. */
47 int CheckFilePerm(const char *filename, const u8 perm, const char *operation);
48 int CheckExecPerm(const struct path_info *filename, struct file *filp);
49 /* Check whether the given dentry is allowed to read/write/execute. */
50 int CheckOpenPermission(struct dentry *dentry, struct vfsmount *mnt, const int flag);
51 /* Check whether the given dentry is allowed to write. */
52 int CheckSingleWritePermission(const unsigned int operation, struct dentry *dentry, struct vfsmount *mnt);
53 int CheckDoubleWritePermission(const unsigned int operation, struct dentry *dentry1, struct vfsmount *mnt1, struct dentry *dentry2, struct vfsmount *mnt2);
54 int CheckReWritePermission(struct file *filp);
55
56 /* Check whether the basename of program and argv0 is allowed to differ. */
57 int CheckArgv0Perm(const struct path_info *filename, const char *argv0);
58
59 /* Check whether the given IP address and port number are allowed to use. */
60 int CheckNetworkListenACL(const int is_ipv6, const u8 *address, const u16 port);
61 int CheckNetworkConnectACL(const int is_ipv6, const int sock_type, const u8 *address, const u16 port);
62 int CheckNetworkBindACL(const int is_ipv6, const int sock_type, const u8 *address, const u16 port);
63 int CheckNetworkAcceptACL(const int is_ipv6, const u8 *address, const u16 port);
64 int CheckNetworkSendMsgACL(const int is_ipv6, const int sock_type, const u8 *address, const u16 port);
65 int CheckNetworkRecvMsgACL(const int is_ipv6, const int sock_type, const u8 *address, const u16 port);
66
67 /* Check whether the given signal is allowed to use. */
68 int CheckSignalACL(const int sig, const int pid);
69
70 /* Check whether the given capability is allowed to use. */
71 int CheckCapabilityACL(const unsigned int capability);
72
73 #else
74
75 static inline int CheckFilePerm(const char *filename, const u8 perm, const char *operation) { return 0; }
76 static inline int CheckExecPerm(const struct path_info *filename, struct file *filp) { return 0; }
77 static inline int CheckOpenPermission(struct dentry *dentry, struct vfsmount *mnt, const int flag) { return 0; }
78 static inline int CheckSingleWritePermission(const unsigned int operation, struct dentry *dentry, struct vfsmount *mnt) { return 0; }
79 static inline int CheckDoubleWritePermission(const unsigned int operation, struct dentry *dentry1, struct vfsmount *mnt1, struct dentry *dentry2, struct vfsmount *mnt2) { return 0; }
80 static inline int CheckReWritePermission(struct file *filp) { return 0; }
81 static inline int CheckArgv0Perm(const struct path_info *filename, const char *argv0) { return 0; }
82 static inline int CheckNetworkListenACL(const int is_ipv6, const u8 *address, const u16 port) { return 0; }
83 static inline int CheckNetworkConnectACL(const int is_ipv6, const int sock_type, const u8 *address, const u16 port) { return 0; }
84 static inline int CheckNetworkBindACL(const int is_ipv6, const int sock_type, const u8 *address, const u16 port) { return 0; }
85 static inline int CheckNetworkAcceptACL(const int is_ipv6, const u8 *address, const u16 port) { return 0; }
86 static inline int CheckNetworkSendMsgACL(const int is_ipv6, const int sock_type, const u8 *address, const u16 port) { return 0; }
87 static inline int CheckNetworkRecvMsgACL(const int is_ipv6, const int sock_type, const u8 *address, const u16 port) { return 0; }
88 static inline int CheckSignalACL(const int sig, const int pid) { return 0; }
89 static inline int CheckCapabilityACL(const unsigned int capability) { return 0; }
90
91 #endif
92
93 #include <linux/version.h>
94 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
95 int pre_vfs_mknod(struct inode *dir, struct dentry *dentry);
96 #else
97 int pre_vfs_mknod(struct inode *dir, struct dentry *dentry, int mode);
98 #endif
99
100 int search_binary_handler_with_transition(struct linux_binprm *bprm, struct pt_regs *regs);
101 #define TOMOYO_CHECK_READ_FOR_OPEN_EXEC 1
102
103 /************************* Index numbers for Access Controls. *************************/
104
105 #define TYPE_CREATE_ACL 0
106 #define TYPE_UNLINK_ACL 1
107 #define TYPE_MKDIR_ACL 2
108 #define TYPE_RMDIR_ACL 3
109 #define TYPE_MKFIFO_ACL 4
110 #define TYPE_MKSOCK_ACL 5
111 #define TYPE_MKBLOCK_ACL 6
112 #define TYPE_MKCHAR_ACL 7
113 #define TYPE_TRUNCATE_ACL 8
114 #define TYPE_SYMLINK_ACL 9
115 #define TYPE_LINK_ACL 10
116 #define TYPE_RENAME_ACL 11
117 #define TYPE_REWRITE_ACL 12
118
119 #define TYPE_FILE_ACL 100
120 #define TYPE_ARGV0_ACL 101
121 #define TYPE_CAPABILITY_ACL 102
122 #define TYPE_IP_NETWORK_ACL 103
123 #define TYPE_SIGNAL_ACL 104
124
125 /************************* Index numbers for Capability Controls. *************************/
126
127 #define TOMOYO_INET_STREAM_SOCKET_CREATE 0 /* socket(PF_INET or PF_INET6, SOCK_STREAM, *) */
128 #define TOMOYO_INET_STREAM_SOCKET_LISTEN 1 /* listen() for PF_INET or PF_INET6, SOCK_STREAM */
129 #define TOMOYO_INET_STREAM_SOCKET_CONNECT 2 /* connect() for PF_INET or PF_INET6, SOCK_STREAM */
130 #define TOMOYO_USE_INET_DGRAM_SOCKET 3 /* socket(PF_INET or PF_INET6, SOCK_DGRAM, *) */
131 #define TOMOYO_USE_INET_RAW_SOCKET 4 /* socket(PF_INET or PF_INET6, SOCK_RAW, *) */
132 #define TOMOYO_USE_ROUTE_SOCKET 5 /* socket(PF_ROUTE, *, *) */
133 #define TOMOYO_USE_PACKET_SOCKET 6 /* socket(PF_PACKET, *, *) */
134 #define TOMOYO_SYS_MOUNT 7 /* sys_mount() */
135 #define TOMOYO_SYS_UMOUNT 8 /* sys_umount() */
136 #define TOMOYO_SYS_REBOOT 9 /* sys_reboot() */
137 #define TOMOYO_SYS_CHROOT 10 /* sys_chroot() */
138 #define TOMOYO_SYS_KILL 11 /* sys_kill(), sys_tkill(), sys_tgkill() */
139 #define TOMOYO_SYS_VHANGUP 12 /* sys_vhangup() */
140 #define TOMOYO_SYS_SETTIME 13 /* do_settimeofday(), sys_adjtimex() */
141 #define TOMOYO_SYS_NICE 14 /* sys_nice(), sys_setpriority() */
142 #define TOMOYO_SYS_SETHOSTNAME 15 /* sys_sethostname(), sys_setdomainname() */
143 #define TOMOYO_USE_KERNEL_MODULE 16 /* sys_create_module(), sys_init_module(), sys_delete_module() */
144 #define TOMOYO_CREATE_FIFO 17 /* sys_mknod(S_IFIFO) */
145 #define TOMOYO_CREATE_BLOCK_DEV 18 /* sys_mknod(S_IFBLK) */
146 #define TOMOYO_CREATE_CHAR_DEV 19 /* sys_mknod(S_IFCHR) */
147 #define TOMOYO_CREATE_UNIX_SOCKET 20 /* sys_mknod(S_IFSOCK) */
148 #define TOMOYO_SYS_LINK 21 /* sys_link() */
149 #define TOMOYO_SYS_SYMLINK 22 /* sys_symlink() */
150 #define TOMOYO_SYS_RENAME 23 /* sys_rename() */
151 #define TOMOYO_SYS_UNLINK 24 /* sys_unlink() */
152 #define TOMOYO_SYS_CHMOD 25 /* sys_chmod(), sys_fchmod() */
153 #define TOMOYO_SYS_CHOWN 26 /* sys_chown(), sys_fchown(), sys_lchown() */
154 #define TOMOYO_SYS_IOCTL 27 /* sys_ioctl(), compat_sys_ioctl() */
155 #define TOMOYO_SYS_KEXEC_LOAD 28 /* sys_kexec_load() */
156 #define TOMOYO_SYS_PIVOT_ROOT 29 /* sys_pivot_root() */
157 #define TOMOYO_MAX_CAPABILITY_INDEX 30
158
159 /************************* Index numbers for Network Controls. *************************/
160
161 #define NETWORK_ACL_UDP_BIND 0
162 #define NETWORK_ACL_UDP_CONNECT 1
163 #define NETWORK_ACL_TCP_BIND 2
164 #define NETWORK_ACL_TCP_LISTEN 3
165 #define NETWORK_ACL_TCP_CONNECT 4
166 #define NETWORK_ACL_TCP_ACCEPT 5
167 #define NETWORK_ACL_RAW_BIND 6
168 #define NETWORK_ACL_RAW_CONNECT 7
169
170 /***** TOMOYO Linux end. *****/
171 #endif
Back to OSDN">Back to OSDN
 ViewVC Help
Powered by ViewVC 1.1.26  
サイト情報
ソフトウェアを探す
ソフトウェアを作る
コミュニティ
ヘルプ