オープンソース・ソフトウェアの開発とダウンロード

TOMOYO

Subversion リポジトリの参照

/[tomoyo]/trunk/1.5.x/ccs-patch/include/linux/tomoyo.h

Contents of /trunk/1.5.x/ccs-patch/include/linux/tomoyo.h

Parent Directory Parent Directory | Revision Log Revision Log

Revision 850 - (show annotations) (download) (as text)
Wed Jan 2 03:47:54 2008 UTC (16 years, 4 months ago) by kumaneko
File MIME type: text/x-chdr
File size: 10223 byte(s) 
Change keywords: 4/2/1 -> allow_read/allow_write/allow_execute
1 /*
2 * include/linux/tomoyo.h
3 *
4 * Implementation of the Domain-Based Mandatory Access Control.
5 *
6 * Copyright (C) 2005-2008 NTT DATA CORPORATION
7 *
8 * Version: 1.5.3-pre 2008/01/02
9 *
10 * This file is applicable to both 2.4.30 and 2.6.11 and later.
11 * See README.ccs for ChangeLog.
12 *
13 */
14 /*
15 * A brief description about TOMOYO:
16 *
17 * TOMOYO stands for "Task Oriented Management Obviates Your Onus".
18 * TOMOYO is intended to provide the Domain-Based MAC utilizing task_struct.
19 *
20 * The biggest feature of TOMOYO is that TOMOYO has "learning mode".
21 * The learning mode can automatically generate policy definition,
22 * and dramatically reduces the policy definition labors.
23 *
24 * TOMOYO is applicable to figuring out the system's behavior, for
25 * TOMOYO uses the canonicalized absolute pathnames and TreeView style domain transitions.
26 */
27
28 #ifndef _LINUX_TOMOYO_H
29 #define _LINUX_TOMOYO_H
30
31 #ifndef __user
32 #define __user
33 #endif
34
35 /***** TOMOYO Linux start. *****/
36
37 struct path_info;
38 struct dentry;
39 struct vfsmount;
40 struct inode;
41 struct linux_binprm;
42 struct pt_regs;
43
44 #define CheckSingleWritePermission CheckSinglePathPermission
45 #define CheckDoubleWritePermission CheckDoublePathPermission
46
47 #if defined(CONFIG_TOMOYO)
48
49 int CheckFilePerm(const char *filename, const u8 perm, const char *operation);
50 int CheckExecPerm(const struct path_info *filename, struct file *filp);
51 int CheckOpenPermission(struct dentry *dentry, struct vfsmount *mnt, const int flag);
52 int CheckSinglePathPermission(const unsigned int operation, struct dentry *dentry, struct vfsmount *mnt);
53 int CheckDoublePathPermission(const unsigned int operation, struct dentry *dentry1, struct vfsmount *mnt1, struct dentry *dentry2, struct vfsmount *mnt2);
54 int CheckReWritePermission(struct file *filp);
55
56 /* Check whether the basename of program and argv0 is allowed to differ. */
57 int CheckArgv0Perm(const struct path_info *filename, const char *argv0);
58
59 /* Check whether the given environment is allowed to be received. */
60 int CheckEnvPerm(const char *env, const u8 profile, const unsigned int mode);
61
62 /* Check whether the given IP address and port number are allowed to use. */
63 int CheckNetworkListenACL(const _Bool is_ipv6, const u8 *address, const u16 port);
64 int CheckNetworkConnectACL(const _Bool is_ipv6, const int sock_type, const u8 *address, const u16 port);
65 int CheckNetworkBindACL(const _Bool is_ipv6, const int sock_type, const u8 *address, const u16 port);
66 int CheckNetworkAcceptACL(const _Bool is_ipv6, const u8 *address, const u16 port);
67 int CheckNetworkSendMsgACL(const _Bool is_ipv6, const int sock_type, const u8 *address, const u16 port);
68 int CheckNetworkRecvMsgACL(const _Bool is_ipv6, const int sock_type, const u8 *address, const u16 port);
69
70 /* Check whether the given signal is allowed to use. */
71 int CheckSignalACL(const int sig, const int pid);
72
73 /* Check whether the given capability is allowed to use. */
74 int CheckCapabilityACL(const unsigned int capability);
75
76 #else
77
78 static inline int CheckFilePerm(const char *filename, const u8 perm, const char *operation) { return 0; }
79 static inline int CheckExecPerm(const struct path_info *filename, struct file *filp) { return 0; }
80 static inline int CheckOpenPermission(struct dentry *dentry, struct vfsmount *mnt, const int flag) { return 0; }
81 static inline int CheckSinglePathPermission(const unsigned int operation, struct dentry *dentry, struct vfsmount *mnt) { return 0; }
82 static inline int CheckDoublePathPermission(const unsigned int operation, struct dentry *dentry1, struct vfsmount *mnt1, struct dentry *dentry2, struct vfsmount *mnt2) { return 0; }
83 static inline int CheckReWritePermission(struct file *filp) { return 0; }
84 static inline int CheckArgv0Perm(const struct path_info *filename, const char *argv0) { return 0; }
85 static inline int CheckEnvPerm(const char *env) { return 0; }
86 static inline int CheckNetworkListenACL(const _Bool is_ipv6, const u8 *address, const u16 port) { return 0; }
87 static inline int CheckNetworkConnectACL(const _Bool is_ipv6, const int sock_type, const u8 *address, const u16 port) { return 0; }
88 static inline int CheckNetworkBindACL(const _Bool is_ipv6, const int sock_type, const u8 *address, const u16 port) { return 0; }
89 static inline int CheckNetworkAcceptACL(const _Bool is_ipv6, const u8 *address, const u16 port) { return 0; }
90 static inline int CheckNetworkSendMsgACL(const _Bool is_ipv6, const int sock_type, const u8 *address, const u16 port) { return 0; }
91 static inline int CheckNetworkRecvMsgACL(const _Bool is_ipv6, const int sock_type, const u8 *address, const u16 port) { return 0; }
92 static inline int CheckSignalACL(const int sig, const int pid) { return 0; }
93 static inline int CheckCapabilityACL(const unsigned int capability) { return 0; }
94
95 #endif
96
97 #include <linux/version.h>
98 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
99 int pre_vfs_mknod(struct inode *dir, struct dentry *dentry);
100 #else
101 int pre_vfs_mknod(struct inode *dir, struct dentry *dentry, int mode);
102 #endif
103
104 int search_binary_handler_with_transition(struct linux_binprm *bprm, struct pt_regs *regs);
105 #define TOMOYO_CHECK_READ_FOR_OPEN_EXEC 1
106 #define CCS_DONT_SLEEP_ON_ENFORCE_ERROR 2
107
108 /************************* Index numbers for Access Controls. *************************/
109
110 #define TYPE_EXECUTE_ACL 0
111 #define TYPE_READ_ACL 1
112 #define TYPE_WRITE_ACL 2
113 #define TYPE_CREATE_ACL 3
114 #define TYPE_UNLINK_ACL 4
115 #define TYPE_MKDIR_ACL 5
116 #define TYPE_RMDIR_ACL 6
117 #define TYPE_MKFIFO_ACL 7
118 #define TYPE_MKSOCK_ACL 8
119 #define TYPE_MKBLOCK_ACL 9
120 #define TYPE_MKCHAR_ACL 10
121 #define TYPE_TRUNCATE_ACL 11
122 #define TYPE_SYMLINK_ACL 12
123 #define TYPE_REWRITE_ACL 13
124 #define MAX_SINGLE_PATH_OPERATION 14
125
126 #define TYPE_LINK_ACL 0
127 #define TYPE_RENAME_ACL 1
128 #define MAX_DOUBLE_PATH_OPERATION 2
129
130 #define TYPE_SINGLE_PATH_ACL 101
131 #define TYPE_DOUBLE_PATH_ACL 102
132 #define TYPE_ARGV0_ACL 103
133 #define TYPE_ENV_ACL 104
134 #define TYPE_CAPABILITY_ACL 105
135 #define TYPE_IP_NETWORK_ACL 106
136 #define TYPE_SIGNAL_ACL 107
137
138 /************************* Index numbers for Capability Controls. *************************/
139
140 #define TOMOYO_INET_STREAM_SOCKET_CREATE 0 /* socket(PF_INET or PF_INET6, SOCK_STREAM, *) */
141 #define TOMOYO_INET_STREAM_SOCKET_LISTEN 1 /* listen() for PF_INET or PF_INET6, SOCK_STREAM */
142 #define TOMOYO_INET_STREAM_SOCKET_CONNECT 2 /* connect() for PF_INET or PF_INET6, SOCK_STREAM */
143 #define TOMOYO_USE_INET_DGRAM_SOCKET 3 /* socket(PF_INET or PF_INET6, SOCK_DGRAM, *) */
144 #define TOMOYO_USE_INET_RAW_SOCKET 4 /* socket(PF_INET or PF_INET6, SOCK_RAW, *) */
145 #define TOMOYO_USE_ROUTE_SOCKET 5 /* socket(PF_ROUTE, *, *) */
146 #define TOMOYO_USE_PACKET_SOCKET 6 /* socket(PF_PACKET, *, *) */
147 #define TOMOYO_SYS_MOUNT 7 /* sys_mount() */
148 #define TOMOYO_SYS_UMOUNT 8 /* sys_umount() */
149 #define TOMOYO_SYS_REBOOT 9 /* sys_reboot() */
150 #define TOMOYO_SYS_CHROOT 10 /* sys_chroot() */
151 #define TOMOYO_SYS_KILL 11 /* sys_kill(), sys_tkill(), sys_tgkill() */
152 #define TOMOYO_SYS_VHANGUP 12 /* sys_vhangup() */
153 #define TOMOYO_SYS_SETTIME 13 /* do_settimeofday(), sys_adjtimex() */
154 #define TOMOYO_SYS_NICE 14 /* sys_nice(), sys_setpriority() */
155 #define TOMOYO_SYS_SETHOSTNAME 15 /* sys_sethostname(), sys_setdomainname() */
156 #define TOMOYO_USE_KERNEL_MODULE 16 /* sys_create_module(), sys_init_module(), sys_delete_module() */
157 #define TOMOYO_CREATE_FIFO 17 /* sys_mknod(S_IFIFO) */
158 #define TOMOYO_CREATE_BLOCK_DEV 18 /* sys_mknod(S_IFBLK) */
159 #define TOMOYO_CREATE_CHAR_DEV 19 /* sys_mknod(S_IFCHR) */
160 #define TOMOYO_CREATE_UNIX_SOCKET 20 /* sys_mknod(S_IFSOCK) */
161 #define TOMOYO_SYS_LINK 21 /* sys_link() */
162 #define TOMOYO_SYS_SYMLINK 22 /* sys_symlink() */
163 #define TOMOYO_SYS_RENAME 23 /* sys_rename() */
164 #define TOMOYO_SYS_UNLINK 24 /* sys_unlink() */
165 #define TOMOYO_SYS_CHMOD 25 /* sys_chmod(), sys_fchmod() */
166 #define TOMOYO_SYS_CHOWN 26 /* sys_chown(), sys_fchown(), sys_lchown() */
167 #define TOMOYO_SYS_IOCTL 27 /* sys_ioctl(), compat_sys_ioctl() */
168 #define TOMOYO_SYS_KEXEC_LOAD 28 /* sys_kexec_load() */
169 #define TOMOYO_SYS_PIVOT_ROOT 29 /* sys_pivot_root() */
170 #define TOMOYO_MAX_CAPABILITY_INDEX 30
171
172 /************************* Index numbers for Network Controls. *************************/
173
174 #define NETWORK_ACL_UDP_BIND 0
175 #define NETWORK_ACL_UDP_CONNECT 1
176 #define NETWORK_ACL_TCP_BIND 2
177 #define NETWORK_ACL_TCP_LISTEN 3
178 #define NETWORK_ACL_TCP_CONNECT 4
179 #define NETWORK_ACL_TCP_ACCEPT 5
180 #define NETWORK_ACL_RAW_BIND 6
181 #define NETWORK_ACL_RAW_CONNECT 7
182
183 /***** TOMOYO Linux end. *****/
184 #endif
Back to OSDN">Back to OSDN
 ViewVC Help
Powered by ViewVC 1.1.26  
サイト情報
ソフトウェアを探す
ソフトウェアを作る
コミュニティ
ヘルプ