Open-Source-Software-Entwicklung und Downloads

TOMOYO

Browse Subversion Repository

/[tomoyo]/trunk/1.6.x/ccs-patch/include/linux/tomoyo.h

Annotation of /trunk/1.6.x/ccs-patch/include/linux/tomoyo.h

Parent Directory Parent Directory | Revision Log Revision Log

Revision 512 - (hide annotations) (download) (as text)
Thu Sep 27 08:52:16 2007 UTC (16 years, 8 months ago) by kumaneko
Original Path: trunk/1.5.x/ccs-patch/include/linux/tomoyo.h
File MIME type: text/x-chdr
File size: 9705 byte(s) 
























1

kumaneko
111

/*








2

 
 

 * include/linux/tomoyo.h








3

 
 

 *








4

 
 

 * Implementation of the Domain-Based Mandatory Access Control.








5

 
 

 *








6

 
 

 * Copyright (C) 2005-2007  NTT DATA CORPORATION








7

 
 

 *













8

kumaneko
502

 * Version: 1.5.0   2007/09/20













9

kumaneko
111

 *








10

 
 

 * This file is applicable to both 2.4.30 and 2.6.11 and later.








11

 
 

 * See README.ccs for ChangeLog.








12

 
 

 *








13

 
 

 */








14

 
 

/*








15

 
 

 * A brief description about TOMOYO:








16

 
 

 *








17

 
 

 *  TOMOYO stands for "Task Oriented Management Obviates Your Onus".








18

 
 

 *  TOMOYO is intended to provide the Domain-Based MAC utilizing task_struct.








19

 
 

 *













20

kumaneko
461

 *  The biggest feature of TOMOYO is that TOMOYO has "learning mode".








21

 
 

 *  The learning mode can automatically generate policy definition,













22

kumaneko
111

 *  and dramatically reduces the policy definition labors.








23

 
 

 *








24

 
 

 *  TOMOYO is applicable to figuring out the system's behavior, for








25

 
 

 *  TOMOYO uses the canonicalized absolute pathnames and TreeView style domain transitions.








26

 
 

 */








27

 
 










28

 
 

#ifndef _LINUX_TOMOYO_H








29

 
 

#define _LINUX_TOMOYO_H








30

 
 










31

 
 

#ifndef __user








32

 
 

#define __user








33

 
 

#endif








34

 
 










35

 
 

/***** TOMOYO Linux start. *****/








36

 
 










37

 
 

struct path_info;













38

kumaneko
325

struct dentry;








39

 
 

struct vfsmount;








40

 
 

struct inode;













41

kumaneko
461

struct linux_binprm;








42

 
 

struct pt_regs;













43

kumaneko
111















44

kumaneko
461

#if defined(CONFIG_TOMOYO)








45

 
 















46

kumaneko
111

/* Check whether the given filename is allowed to read/write/execute. */








47

 
 

int CheckFilePerm(const char *filename, const u8 perm, const char *operation);








48

 
 

int CheckExecPerm(const struct path_info *filename, struct file *filp);








49

 
 

/* Check whether the given dentry is allowed to read/write/execute. */








50

 
 

int CheckOpenPermission(struct dentry *dentry, struct vfsmount *mnt, const int flag);








51

 
 

/* Check whether the given dentry is allowed to write. */








52

 
 

int CheckSingleWritePermission(const unsigned int operation, struct dentry *dentry, struct vfsmount *mnt);








53

 
 

int CheckDoubleWritePermission(const unsigned int operation, struct dentry *dentry1, struct vfsmount *mnt1, struct dentry *dentry2, struct vfsmount *mnt2);








54

 
 

int CheckReWritePermission(struct file *filp);








55

 
 










56

 
 

/* Check whether the basename of program and argv0 is allowed to differ. */








57

 
 

int CheckArgv0Perm(const struct path_info *filename, const char *argv0);








58

 
 










59

 
 

/* Check whether the given IP address and port number are allowed to use. */











60

kumaneko
512

int CheckNetworkListenACL(const u8 is_ipv6, const u8 *address, const u16 port);








61

 
 

int CheckNetworkConnectACL(const u8 is_ipv6, const int sock_type, const u8 *address, const u16 port);








62

 
 

int CheckNetworkBindACL(const u8 is_ipv6, const int sock_type, const u8 *address, const u16 port);








63

 
 

int CheckNetworkAcceptACL(const u8 is_ipv6, const u8 *address, const u16 port);








64

 
 

int CheckNetworkSendMsgACL(const u8 is_ipv6, const int sock_type, const u8 *address, const u16 port);








65

 
 

int CheckNetworkRecvMsgACL(const u8 is_ipv6, const int sock_type, const u8 *address, const u16 port);













66

kumaneko
111










67

 
 

/* Check whether the given signal is allowed to use. */








68

 
 

int CheckSignalACL(const int sig, const int pid);








69

 
 










70

 
 

/* Check whether the given capability is allowed to use. */








71

 
 

int CheckCapabilityACL(const unsigned int capability);








72

 
 















73

kumaneko
461

#else








74

 
 










75

 
 

static inline int CheckFilePerm(const char *filename, const u8 perm, const char *operation) { return 0; }








76

 
 

static inline int CheckExecPerm(const struct path_info *filename, struct file *filp)  { return 0; }








77

 
 

static inline int CheckOpenPermission(struct dentry *dentry, struct vfsmount *mnt, const int flag) { return 0; }








78

 
 

static inline int CheckSingleWritePermission(const unsigned int operation, struct dentry *dentry, struct vfsmount *mnt) { return 0; }








79

 
 

static inline int CheckDoubleWritePermission(const unsigned int operation, struct dentry *dentry1, struct vfsmount *mnt1, struct dentry *dentry2, struct vfsmount *mnt2) { return 0; }








80

 
 

static inline int CheckReWritePermission(struct file *filp) { return 0; }








81

 
 

static inline int CheckArgv0Perm(const struct path_info *filename, const char *argv0) { return 0; }











82

kumaneko
512

static inline int CheckNetworkListenACL(const u8 is_ipv6, const u8 *address, const u16 port) { return 0; }








83

 
 

static inline int CheckNetworkConnectACL(const u8 is_ipv6, const int sock_type, const u8 *address, const u16 port) { return 0; }








84

 
 

static inline int CheckNetworkBindACL(const u8 is_ipv6, const int sock_type, const u8 *address, const u16 port) { return 0; }








85

 
 

static inline int CheckNetworkAcceptACL(const u8 is_ipv6, const u8 *address, const u16 port) { return 0; }








86

 
 

static inline int CheckNetworkSendMsgACL(const u8 is_ipv6, const int sock_type, const u8 *address, const u16 port) { return 0; }








87

 
 

static inline int CheckNetworkRecvMsgACL(const u8 is_ipv6, const int sock_type, const u8 *address, const u16 port) { return 0; }













88

kumaneko
461

static inline int CheckSignalACL(const int sig, const int pid) { return 0; }








89

 
 

static inline int CheckCapabilityACL(const unsigned int capability) { return 0; }








90

 
 










91

 
 

#endif








92

 
 















93

kumaneko
111

#include <linux/version.h>








94

 
 

#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)








95

 
 

int pre_vfs_mknod(struct inode *dir, struct dentry *dentry);








96

 
 

#else








97

 
 

int pre_vfs_mknod(struct inode *dir, struct dentry *dentry, int mode);








98

 
 

#endif








99

 
 















100

kumaneko
461

int search_binary_handler_with_transition(struct linux_binprm *bprm, struct pt_regs *regs);








101

 
 

#define TOMOYO_CHECK_READ_FOR_OPEN_EXEC 1








102

 
 















103

kumaneko
111

/*************************  Index numbers for Access Controls.  *************************/








104

 
 










105

 
 

#define TYPE_CREATE_ACL       0








106

 
 

#define TYPE_UNLINK_ACL       1








107

 
 

#define TYPE_MKDIR_ACL        2








108

 
 

#define TYPE_RMDIR_ACL        3








109

 
 

#define TYPE_MKFIFO_ACL       4








110

 
 

#define TYPE_MKSOCK_ACL       5








111

 
 

#define TYPE_MKBLOCK_ACL      6








112

 
 

#define TYPE_MKCHAR_ACL       7








113

 
 

#define TYPE_TRUNCATE_ACL     8








114

 
 

#define TYPE_SYMLINK_ACL      9








115

 
 

#define TYPE_LINK_ACL        10








116

 
 

#define TYPE_RENAME_ACL      11








117

 
 

#define TYPE_REWRITE_ACL     12








118

 
 










119

 
 

#define TYPE_FILE_ACL         100








120

 
 

#define TYPE_ARGV0_ACL        101








121

 
 

#define TYPE_CAPABILITY_ACL   102








122

 
 

#define TYPE_IP_NETWORK_ACL   103













123

kumaneko
115

#define TYPE_SIGNAL_ACL       104













124

kumaneko
111










125

 
 

/*************************  Index numbers for Capability Controls.  *************************/








126

 
 










127

 
 

#define TOMOYO_INET_STREAM_SOCKET_CREATE         0  /* socket(PF_INET or PF_INET6, SOCK_STREAM, *)                 */








128

 
 

#define TOMOYO_INET_STREAM_SOCKET_LISTEN         1  /* listen() for PF_INET or PF_INET6, SOCK_STREAM               */








129

 
 

#define TOMOYO_INET_STREAM_SOCKET_CONNECT        2  /* connect() for PF_INET or PF_INET6, SOCK_STREAM              */








130

 
 

#define TOMOYO_USE_INET_DGRAM_SOCKET             3  /* socket(PF_INET or PF_INET6, SOCK_DGRAM, *)                  */








131

 
 

#define TOMOYO_USE_INET_RAW_SOCKET               4  /* socket(PF_INET or PF_INET6, SOCK_RAW, *)                    */








132

 
 

#define TOMOYO_USE_ROUTE_SOCKET                  5  /* socket(PF_ROUTE, *, *)                                      */








133

 
 

#define TOMOYO_USE_PACKET_SOCKET                 6  /* socket(PF_PACKET, *, *)                                     */








134

 
 

#define TOMOYO_SYS_MOUNT                         7  /* sys_mount()                                                 */








135

 
 

#define TOMOYO_SYS_UMOUNT                        8  /* sys_umount()                                                */








136

 
 

#define TOMOYO_SYS_REBOOT                        9  /* sys_reboot()                                                */








137

 
 

#define TOMOYO_SYS_CHROOT                       10  /* sys_chroot()                                                */








138

 
 

#define TOMOYO_SYS_KILL                         11  /* sys_kill(), sys_tkill(), sys_tgkill()                       */








139

 
 

#define TOMOYO_SYS_VHANGUP                      12  /* sys_vhangup()                                               */








140

 
 

#define TOMOYO_SYS_SETTIME                      13  /* do_settimeofday(), sys_adjtimex()                           */








141

 
 

#define TOMOYO_SYS_NICE                         14  /* sys_nice(), sys_setpriority()                               */








142

 
 

#define TOMOYO_SYS_SETHOSTNAME                  15  /* sys_sethostname(), sys_setdomainname()                      */








143

 
 

#define TOMOYO_USE_KERNEL_MODULE                16  /* sys_create_module(), sys_init_module(), sys_delete_module() */








144

 
 

#define TOMOYO_CREATE_FIFO                      17  /* sys_mknod(S_IFIFO)                                          */








145

 
 

#define TOMOYO_CREATE_BLOCK_DEV                 18  /* sys_mknod(S_IFBLK)                                          */








146

 
 

#define TOMOYO_CREATE_CHAR_DEV                  19  /* sys_mknod(S_IFCHR)                                          */








147

 
 

#define TOMOYO_CREATE_UNIX_SOCKET               20  /* sys_mknod(S_IFSOCK)                                         */








148

 
 

#define TOMOYO_SYS_LINK                         21  /* sys_link()                                                  */








149

 
 

#define TOMOYO_SYS_SYMLINK                      22  /* sys_symlink()                                               */








150

 
 

#define TOMOYO_SYS_RENAME                       23  /* sys_rename()                                                */








151

 
 

#define TOMOYO_SYS_UNLINK                       24  /* sys_unlink()                                                */








152

 
 

#define TOMOYO_SYS_CHMOD                        25  /* sys_chmod(), sys_fchmod()                                   */








153

 
 

#define TOMOYO_SYS_CHOWN                        26  /* sys_chown(), sys_fchown(), sys_lchown()                     */








154

 
 

#define TOMOYO_SYS_IOCTL                        27  /* sys_ioctl(), compat_sys_ioctl()                             */








155

 
 

#define TOMOYO_SYS_KEXEC_LOAD                   28  /* sys_kexec_load()                                            */













156

kumaneko
141

#define TOMOYO_SYS_PIVOT_ROOT                   29  /* sys_pivot_root()                                            */








157

 
 

#define TOMOYO_MAX_CAPABILITY_INDEX             30













158

kumaneko
111










159

 
 

/*************************  Index numbers for Network Controls.  *************************/








160

 
 










161

 
 

#define NETWORK_ACL_UDP_BIND    0








162

 
 

#define NETWORK_ACL_UDP_CONNECT 1








163

 
 

#define NETWORK_ACL_TCP_BIND    2








164

 
 

#define NETWORK_ACL_TCP_LISTEN  3








165

 
 

#define NETWORK_ACL_TCP_CONNECT 4








166

 
 

#define NETWORK_ACL_TCP_ACCEPT  5








167

 
 

#define NETWORK_ACL_RAW_BIND    6








168

 
 

#define NETWORK_ACL_RAW_CONNECT 7








169

 
 










170

 
 

/***** TOMOYO Linux end. *****/








171

 
 

#endif




















Back to OSDN">Back to OSDN

ViewVC Help




Powered by ViewVC 1.1.26
 



















Über OSDN





Software suchen





Entwickeln Software





Hilfeseiten