~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/security/apparmor/include/perms.h

Version: ~ [ linux-5.14-rc3 ] ~ [ linux-5.13.5 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.53 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.135 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.198 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.240 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.276 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.276 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * AppArmor security module
  3  *
  4  * This file contains AppArmor basic permission sets definitions.
  5  *
  6  * Copyright 2017 Canonical Ltd.
  7  *
  8  * This program is free software; you can redistribute it and/or
  9  * modify it under the terms of the GNU General Public License as
 10  * published by the Free Software Foundation, version 2 of the
 11  * License.
 12  */
 13 
 14 #ifndef __AA_PERM_H
 15 #define __AA_PERM_H
 16 
 17 #include <linux/fs.h>
 18 #include "label.h"
 19 
 20 #define AA_MAY_EXEC             MAY_EXEC
 21 #define AA_MAY_WRITE            MAY_WRITE
 22 #define AA_MAY_READ             MAY_READ
 23 #define AA_MAY_APPEND           MAY_APPEND
 24 
 25 #define AA_MAY_CREATE           0x0010
 26 #define AA_MAY_DELETE           0x0020
 27 #define AA_MAY_OPEN             0x0040
 28 #define AA_MAY_RENAME           0x0080          /* pair */
 29 
 30 #define AA_MAY_SETATTR          0x0100          /* meta write */
 31 #define AA_MAY_GETATTR          0x0200          /* meta read */
 32 #define AA_MAY_SETCRED          0x0400          /* security cred/attr */
 33 #define AA_MAY_GETCRED          0x0800
 34 
 35 #define AA_MAY_CHMOD            0x1000          /* pair */
 36 #define AA_MAY_CHOWN            0x2000          /* pair */
 37 #define AA_MAY_CHGRP            0x4000          /* pair */
 38 #define AA_MAY_LOCK             0x8000          /* LINK_SUBSET overlaid */
 39 
 40 #define AA_EXEC_MMAP            0x00010000
 41 #define AA_MAY_MPROT            0x00020000      /* extend conditions */
 42 #define AA_MAY_LINK             0x00040000      /* pair */
 43 #define AA_MAY_SNAPSHOT         0x00080000      /* pair */
 44 
 45 #define AA_MAY_DELEGATE
 46 #define AA_CONT_MATCH           0x08000000
 47 
 48 #define AA_MAY_STACK            0x10000000
 49 #define AA_MAY_ONEXEC           0x20000000 /* either stack or change_profile */
 50 #define AA_MAY_CHANGE_PROFILE   0x40000000
 51 #define AA_MAY_CHANGEHAT        0x80000000
 52 
 53 #define AA_LINK_SUBSET          AA_MAY_LOCK     /* overlaid */
 54 
 55 
 56 #define PERMS_CHRS_MASK (MAY_READ | MAY_WRITE | AA_MAY_CREATE |         \
 57                          AA_MAY_DELETE | AA_MAY_LINK | AA_MAY_LOCK |    \
 58                          AA_MAY_EXEC | AA_EXEC_MMAP | AA_MAY_APPEND)
 59 
 60 #define PERMS_NAMES_MASK (PERMS_CHRS_MASK | AA_MAY_OPEN | AA_MAY_RENAME |     \
 61                           AA_MAY_SETATTR | AA_MAY_GETATTR | AA_MAY_SETCRED | \
 62                           AA_MAY_GETCRED | AA_MAY_CHMOD | AA_MAY_CHOWN | \
 63                           AA_MAY_CHGRP | AA_MAY_MPROT | AA_MAY_SNAPSHOT | \
 64                           AA_MAY_STACK | AA_MAY_ONEXEC |                \
 65                           AA_MAY_CHANGE_PROFILE | AA_MAY_CHANGEHAT)
 66 
 67 extern const char aa_file_perm_chrs[];
 68 extern const char *aa_file_perm_names[];
 69 
 70 struct aa_perms {
 71         u32 allow;
 72         u32 audit;      /* set only when allow is set */
 73 
 74         u32 deny;       /* explicit deny, or conflict if allow also set */
 75         u32 quiet;      /* set only when ~allow | deny */
 76         u32 kill;       /* set only when ~allow | deny */
 77         u32 stop;       /* set only when ~allow | deny */
 78 
 79         u32 complain;   /* accumulates only used when ~allow & ~deny */
 80         u32 cond;       /* set only when ~allow and ~deny */
 81 
 82         u32 hide;       /* set only when  ~allow | deny */
 83         u32 prompt;     /* accumulates only used when ~allow & ~deny */
 84 
 85         /* Reserved:
 86          * u32 subtree; / * set only when allow is set * /
 87          */
 88         u16 xindex;
 89 };
 90 
 91 #define ALL_PERMS_MASK 0xffffffff
 92 extern struct aa_perms nullperms;
 93 extern struct aa_perms allperms;
 94 
 95 
 96 #define xcheck(FN1, FN2)        \
 97 ({                              \
 98         int e, error = FN1;     \
 99         e = FN2;                \
100         if (e)                  \
101                 error = e;      \
102         error;                  \
103 })
104 
105 
106 /*
107  * TODO: update for labels pointing to labels instead of profiles
108  * TODO: optimize the walk, currently does subwalk of L2 for each P in L1
109  * gah this doesn't allow for label compound check!!!!
110  */
111 #define xcheck_ns_profile_profile(P1, P2, FN, args...)          \
112 ({                                                              \
113         int ____e = 0;                                          \
114         if (P1->ns == P2->ns)                                   \
115                 ____e = FN((P1), (P2), args);                   \
116         (____e);                                                \
117 })
118 
119 #define xcheck_ns_profile_label(P, L, FN, args...)              \
120 ({                                                              \
121         struct aa_profile *__p2;                                \
122         fn_for_each((L), __p2,                                  \
123                     xcheck_ns_profile_profile((P), __p2, (FN), args));  \
124 })
125 
126 #define xcheck_ns_labels(L1, L2, FN, args...)                   \
127 ({                                                              \
128         struct aa_profile *__p1;                                \
129         fn_for_each((L1), __p1, FN(__p1, (L2), args));          \
130 })
131 
132 /* Do the cross check but applying FN at the profiles level */
133 #define xcheck_labels_profiles(L1, L2, FN, args...)             \
134         xcheck_ns_labels((L1), (L2), xcheck_ns_profile_label, (FN), args)
135 
136 #define xcheck_labels(L1, L2, P, FN1, FN2)                      \
137         xcheck(fn_for_each((L1), (P), (FN1)), fn_for_each((L2), (P), (FN2)))
138 
139 
140 void aa_perm_mask_to_str(char *str, const char *chrs, u32 mask);
141 void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
142                          u32 mask);
143 void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
144                         u32 chrsmask, const char * const *names, u32 namesmask);
145 void aa_apply_modes_to_perms(struct aa_profile *profile,
146                              struct aa_perms *perms);
147 void aa_compute_perms(struct aa_dfa *dfa, unsigned int state,
148                       struct aa_perms *perms);
149 void aa_perms_accum(struct aa_perms *accum, struct aa_perms *addend);
150 void aa_perms_accum_raw(struct aa_perms *accum, struct aa_perms *addend);
151 void aa_profile_match_label(struct aa_profile *profile, struct aa_label *label,
152                             int type, u32 request, struct aa_perms *perms);
153 int aa_profile_label_perm(struct aa_profile *profile, struct aa_profile *target,
154                           u32 request, int type, u32 *deny,
155                           struct common_audit_data *sa);
156 int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms,
157                    u32 request, struct common_audit_data *sa,
158                    void (*cb)(struct audit_buffer *, void *));
159 #endif /* __AA_PERM_H */
160 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp