1 /* 2 * Security server interface. 3 * 4 * Author : Stephen Smalley, <sds@epoch.ncsc.mil> 5 * 6 */ 7 8 /* Ported to Xen 3.0, George Coker, <gscoker@alpha.ncsc.mil> */ 9 10 #ifndef _FLASK_SECURITY_H_ 11 #define _FLASK_SECURITY_H_ 12 13 #include "flask.h" 14 15 #define SECSID_NULL 0x00000000 /* unspecified SID */ 16 #define SECSID_WILD 0xffffffff /* wildcard SID */ 17 #define SECCLASS_NULL 0x0000 /* no class */ 18 19 #define FLASK_MAGIC 0xf97cff8c 20 21 /* Identify specific policy version changes */ 22 #define POLICYDB_VERSION_BASE 15 23 #define POLICYDB_VERSION_BOOL 16 24 #define POLICYDB_VERSION_IPV6 17 25 #define POLICYDB_VERSION_NLCLASS 18 26 #define POLICYDB_VERSION_VALIDATETRANS 19 27 #define POLICYDB_VERSION_MLS 19 28 #define POLICYDB_VERSION_AVTAB 20 29 #define POLICYDB_VERSION_RANGETRANS 21 30 #define POLICYDB_VERSION_POLCAP 22 31 #define POLICYDB_VERSION_PERMISSIVE 23 32 #define POLICYDB_VERSION_BOUNDARY 24 33 #define POLICYDB_VERSION_FILENAME_TRANS 25 34 #define POLICYDB_VERSION_ROLETRANS 26 35 #define POLICYDB_VERSION_NEW_OBJECT_DEFAULTS 27 36 #define POLICYDB_VERSION_DEFAULT_TYPE 28 37 #define POLICYDB_VERSION_CONSTRAINT_NAMES 29 38 #define POLICYDB_VERSION_XEN_DEVICETREE 30 39 40 /* Range of policy versions we understand*/ 41 #define POLICYDB_VERSION_MIN POLICYDB_VERSION_BASE 42 #define POLICYDB_VERSION_MAX POLICYDB_VERSION_XEN_DEVICETREE 43 44 enum flask_bootparam_t { 45 FLASK_BOOTPARAM_PERMISSIVE, 46 FLASK_BOOTPARAM_ENFORCING, 47 FLASK_BOOTPARAM_LATELOAD, 48 FLASK_BOOTPARAM_DISABLED, 49 FLASK_BOOTPARAM_INVALID, 50 }; 51 52 extern enum flask_bootparam_t flask_bootparam; 53 extern int flask_mls_enabled; 54 55 int security_load_policy(const void *data, size_t len); 56 57 struct av_decision { 58 u32 allowed; 59 u32 auditallow; 60 u32 auditdeny; 61 u32 seqno; 62 u32 flags; 63 }; 64 65 /* definitions of av_decision.flags */ 66 #define AVD_FLAGS_PERMISSIVE 0x0001 67 68 int security_compute_av(u32 ssid, u32 tsid, u16 tclass, u32 requested, 69 struct av_decision *avd); 70 71 int security_transition_sid(u32 ssid, u32 tsid, u16 tclass, u32 *out_sid); 72 73 int security_member_sid(u32 ssid, u32 tsid, u16 tclass, u32 *out_sid); 74 75 int security_change_sid(u32 ssid, u32 tsid, u16 tclass, u32 *out_sid); 76 77 int security_sid_to_context(u32 sid, char **scontext, u32 *scontext_len); 78 79 int security_context_to_sid(char *scontext, u32 scontext_len, u32 *out_sid); 80 81 int security_get_allow_unknown(void); 82 83 int security_irq_sid(int pirq, u32 *out_sid); 84 85 int security_iomem_sid(unsigned long, u32 *out_sid); 86 87 int security_ioport_sid(u32 ioport, u32 *out_sid); 88 89 int security_device_sid(u32 device, u32 *out_sid); 90 91 int security_devicetree_sid(const char *path, u32 *out_sid); 92 93 int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid, 94 u16 tclass); 95 96 typedef int (*security_iterate_fn)(void *data, u32 sid, unsigned long start, 97 unsigned long end); 98 int security_iterate_iomem_sids(unsigned long start, unsigned long end, 99 security_iterate_fn fn, void *data); 100 101 int security_iterate_ioport_sids(u32 start, u32 end, 102 security_iterate_fn fn, void *data); 103 104 int security_ocontext_add(u32 ocontext, unsigned long low, 105 unsigned long high, u32 sid); 106 107 int security_ocontext_del(u32 ocontext, unsigned long low, unsigned long high); 108 109 int security_devicetree_setlabel(char *path, u32 sid); 110 #endif /* _FLASK_SECURITY_H_ */ 111