|
Defines |
| #define | RSBAC_VERSION "v1.2.4" |
| #define | RSBAC_VERSION_MAJOR 1 |
| #define | RSBAC_VERSION_MID 2 |
| #define | RSBAC_VERSION_MINOR 4 |
| #define | RSBAC_VERSION_NR ((RSBAC_VERSION_MAJOR << 16) | (RSBAC_VERSION_MID << 8) | RSBAC_VERSION_MINOR) |
| #define | RSBAC_VERSION_MAKE_NR(x, y, z) ((x << 16) & (y << 8) & z) |
| #define | NULL ((void *) 0) |
| #define | rsbac_min(a, b) (((a)<(b))?(a):(b)) |
| #define | rsbac_max(a, b) (((a)>(b))?(a):(b)) |
| #define | RSBAC_OLD_NO_USER 65533 |
| #define | RSBAC_OLD_ALL_USERS 65532 |
| #define | RSBAC_NO_USER ((rsbac_uid_t) -3) |
| #define | RSBAC_ALL_USERS ((rsbac_uid_t) -4) |
| #define | RSBAC_NO_GROUP ((rsbac_gid_t) -3) |
| #define | RSBAC_ALL_GROUPS ((rsbac_gid_t) -4) |
| #define | FALSE 0 |
| #define | TRUE 1 |
| #define | RSBAC_IFNAMSIZ 16 |
| #define | RSBAC_SEC_DEL_CHUNK_SIZE 65536 |
| #define | RSBAC_AUTH_LOGIN_PATH "/bin/login" |
| #define | RSBAC_AUTH_LOGIN_PATH_DIR "bin" |
| #define | RSBAC_AUTH_LOGIN_PATH_FILE "login" |
| #define | RSBAC_LIST_TTL_KEEP ((rsbac_time_t) -1) |
| #define | RSBAC_SYSADM_UID 0 |
| #define | RSBAC_BIN_UID 1 |
| #define | RSBAC_SECOFF_UID 400 |
| #define | RSBAC_DATAPROT_UID (RSBAC_SECOFF_UID+1) |
| #define | RSBAC_TPMAN_UID (RSBAC_SECOFF_UID+2) |
| #define | RSBAC_AUDITOR_UID (RSBAC_SECOFF_UID+4) |
| #define | SL_max 252 |
| #define | SL_min 0 |
| #define | SL_inherit 254 |
| #define | SL_none 255 |
| #define | RSBAC_MAC_GENERAL_CATEGORY 0 |
| #define | RSBAC_MAC_DEF_CAT_VECTOR ((rsbac_mac_category_vector_t) 1) |
| #define | RSBAC_MAC_MAX_CAT_VECTOR ((rsbac_mac_category_vector_t) -1) |
| #define | RSBAC_MAC_MIN_CAT_VECTOR ((rsbac_mac_category_vector_t) 0) |
| #define | RSBAC_MAC_INHERIT_CAT_VECTOR ((rsbac_mac_category_vector_t) 0) |
| #define | RSBAC_MAC_NR_CATS 64 |
| #define | RSBAC_MAC_MAX_CAT 63 |
| #define | RSBAC_MAC_CAT_VECTOR(x) ((rsbac_mac_category_vector_t) 1 << (x)) |
| #define | RSBAC_FC_OC_DEF OC_inherit |
| #define | RSBAC_FC_OC_ROOT_DEF OC_general |
| #define | RSBAC_SIM_DT_DEF DT_inherit |
| #define | RSBAC_SIM_DT_ROOT_DEF DT_none |
| #define | RSBAC_REQUEST_VECTOR(x) ((rsbac_request_vector_t) 1 << (x)) |
| #define | RSBAC_MAXNAMELEN 256 |
| #define | RSBAC_LIST_TA_MAX_PASSLEN 36 |
| #define | RSBAC_MAC_MAX_MAXNUM 1000000 |
| #define | MAC_override 1 |
| #define | MAC_auto 2 |
| #define | MAC_trusted 4 |
| #define | MAC_write_up 8 |
| #define | MAC_read_up 16 |
| #define | MAC_write_down 32 |
| #define | MAC_allow_auto 64 |
| #define | MAC_prop_trusted 128 |
| #define | MAC_program_auto 256 |
| #define | RSBAC_MAC_U_FLAGS (MAC_override | MAC_trusted | MAC_write_up | MAC_read_up | MAC_write_down | MAC_allow_auto) |
| #define | RSBAC_MAC_P_FLAGS (MAC_override | MAC_auto | MAC_trusted | MAC_write_up | MAC_read_up | MAC_write_down | MAC_prop_trusted | MAC_program_auto) |
| #define | RSBAC_MAC_F_FLAGS (MAC_auto | MAC_trusted | MAC_write_up | MAC_read_up | MAC_write_down) |
| #define | RSBAC_MAC_DEF_U_FLAGS 0 |
| #define | RSBAC_MAC_DEF_SYSADM_U_FLAGS MAC_allow_auto |
| #define | RSBAC_MAC_DEF_SECOFF_U_FLAGS MAC_override |
| #define | RSBAC_MAC_DEF_P_FLAGS 0 |
| #define | RSBAC_MAC_DEF_INIT_P_FLAGS MAC_auto |
| #define | DAZ_unscanned 0 |
| #define | DAZ_infected 1 |
| #define | DAZ_clean 2 |
| #define | DAZ_max 2 |
| #define | DEFAULT_DAZ_FD_SCANNED DAZ_unscanned |
| #define | FF_read_only 1 |
| #define | FF_execute_only 2 |
| #define | FF_search_only 4 |
| #define | FF_write_only 8 |
| #define | FF_secure_delete 16 |
| #define | FF_no_execute 32 |
| #define | FF_no_delete_or_rename 64 |
| #define | FF_append_only 256 |
| #define | FF_no_mount 512 |
| #define | FF_add_inherited 128 |
| #define | RSBAC_FF_DEF FF_add_inherited |
| #define | RSBAC_FF_ROOT_DEF 0 |
| #define | RSBAC_AUTH_MAX_MAXNUM 1000000 |
| #define | RSBAC_AUTH_OLD_OWNER_F_CAP (rsbac_old_uid_t) -3 |
| #define | RSBAC_AUTH_OWNER_F_CAP ((rsbac_uid_t) -3) |
| #define | RSBAC_AUTH_DAC_OWNER_F_CAP ((rsbac_uid_t) -4) |
| #define | RSBAC_AUTH_MAX_RANGE_UID ((rsbac_uid_t) -10) |
| #define | RSBAC_CAP_DEFAULT_MIN ((rsbac_cap_vector_t) 0) |
| #define | RSBAC_CAP_DEFAULT_MAX ((rsbac_cap_vector_t) -1) |
| #define | CAP_NONE 29 |
| #define | RSBAC_CAP_MAX CAP_NONE |
| #define | RSBAC_JAIL_VERSION 1 |
| #define | RSBAC_JAIL_DEF_ID 0 |
| #define | JAIL_allow_external_ipc 1 |
| #define | JAIL_allow_all_net_family 2 |
| #define | JAIL_allow_rlimit 4 |
| #define | JAIL_allow_inet_raw 8 |
| #define | JAIL_auto_adjust_inet_any 16 |
| #define | JAIL_allow_inet_localhost 32 |
| #define | JAIL_allow_clock 64 |
| #define | RSBAC_JAIL_LOCALHOST ((1 << 24) | 127) |
| #define | PF_PAX_PAGEEXEC 0x01000000 |
| #define | PF_PAX_EMUTRAMP 0x02000000 |
| #define | PF_PAX_MPROTECT 0x04000000 |
| #define | PF_PAX_RANDMMAP 0x08000000 |
| #define | PF_PAX_RANDEXEC 0x10000000 |
| #define | PF_PAX_SEGMEXEC 0x20000000 |
| #define | RSBAC_PAX_DEF_FLAGS (PF_PAX_SEGMEXEC | PF_PAX_PAGEEXEC | PF_PAX_MPROTECT | PF_PAX_RANDMMAP) |
| #define | RSBAC_PAX_ALL_FLAGS ((rsbac_pax_flags_t) 255 << 24) |
| #define | RSBAC_RES_UNSET 0 |
| #define | RSBAC_RES_MAX 10 |
| #define | RSBAC_RES_NONE 11 |
| #define | RSBAC_ADF_REQUEST_ARRAY_VERSION 2 |
| #define | RSBAC_MAX_MOD (SOFTMODE - 1) |
Typedefs |
| typedef __u32 | rsbac_version_t |
| typedef __u32 | rsbac_uid_t |
| typedef __u32 | rsbac_gid_t |
| typedef __u16 | rsbac_old_uid_t |
| typedef __u16 | rsbac_old_gid_t |
| typedef __u32 | rsbac_time_t |
| typedef __u32 | rsbac_cap_vector_t |
| typedef __u32 | rsbac_list_ta_number_t |
| typedef u_int | rsbac_boolean_t |
| typedef __u8 | rsbac_boolean_int_t |
| typedef u_char | rsbac_netdev_id_t [RSBAC_IFNAMSIZ+1] |
| typedef __u8 | rsbac_enum_t |
| typedef __u32 | rsbac_pseudo_t |
| typedef __u32 | rsbac_pid_t |
| typedef __u32 | rsbac_ta_number_t |
| typedef __u8 | rsbac_security_level_t |
| typedef __u64 | rsbac_mac_category_vector_t |
| typedef u_int | rsbac_cwi_relation_id_t |
| typedef rsbac_enum_t | rsbac_system_role_int_t |
| typedef rsbac_enum_t | rsbac_fc_oc_t |
| typedef rsbac_enum_t | rsbac_sim_dt_t |
| typedef rsbac_enum_t | rsbac_fake_root_uid_int_t |
| typedef __u32 | rsbac_inode_nr_t |
| typedef rsbac_enum_t | rsbac_linux_dac_disable_int_t |
| typedef __u64 | rsbac_log_array_t |
| typedef __u64 | rsbac_request_vector_t |
| typedef __u8 | rsbac_mac_user_flags_t |
| typedef __u16 | rsbac_mac_process_flags_t |
| typedef __u8 | rsbac_mac_file_flags_t |
| typedef rsbac_fs_file_t | rsbac_mac_file_t |
| typedef rsbac_enum_t | rsbac_mac_auto_int_t |
| typedef __u8 | rsbac_daz_scanned_t |
| typedef __u8 | rsbac_daz_scanner_t |
| typedef __u16 | rsbac_ff_flags_t |
| typedef rsbac_fs_file_t | rsbac_auth_file_t |
| typedef rsbac_enum_t | rsbac_auth_cap_type_int_t |
| typedef rsbac_enum_t | rsbac_auth_may_setuid_int_t |
| typedef rsbac_enum_t | rsbac_cap_process_hiding_int_t |
| typedef __u32 | rsbac_jail_id_t |
| typedef __u32 | rsbac_jail_ip_t |
| typedef __u32 | rsbac_jail_flags_t |
| typedef unsigned long | rsbac_pax_flags_t |
| typedef __u32 | rsbac_res_limit_t |
| typedef rsbac_res_limit_t | rsbac_res_array_t [RSBAC_RES_MAX+1] |
| typedef __s32 | rsbac_reg_handle_t |
| typedef void * | rsbac_net_obj_id_t |
| typedef rsbac_enum_t | rsbac_adf_request_int_t |
| typedef rsbac_enum_t | rsbac_switch_target_int_t |
Enumerations |
| enum | rsbac_old_security_level_t {
SL_unclassified,
SL_confidential,
SL_secret,
SL_top_secret,
SL_old_rsbac_internal,
SL_old_inherit,
SL_old_none
} |
| enum | rsbac_system_role_t {
SR_user,
SR_security_officer,
SR_administrator,
SR_auditor,
SR_none
} |
| enum | rsbac_object_category_t {
OC_general,
OC_security,
OC_system,
OC_inherit,
OC_none
} |
| enum | rsbac_data_type_t { DT_none,
DT_SI,
DT_inherit
} |
| enum | rsbac_fake_root_uid_t {
FR_off,
FR_uid_only,
FR_euid_only,
FR_both,
FR_none
} |
| enum | rsbac_scd_type_t {
ST_time_strucs,
ST_clock,
ST_host_id,
ST_net_id,
ST_ioports,
ST_rlimit,
ST_swap,
ST_syslog,
ST_rsbac,
ST_rsbaclog,
ST_other,
ST_kmem,
ST_network,
ST_firewall,
ST_priority,
ST_sysfs,
ST_rsbac_remote_log,
ST_none
} |
| enum | rsbac_dev_type_t { D_block,
D_char,
D_none
} |
| enum | rsbac_ipc_type_t { I_sem,
I_msg,
I_shm,
I_none
} |
| enum | rsbac_linux_dac_disable_t { LDD_false,
LDD_true,
LDD_inherit,
LDD_none
} |
| enum | rsbac_log_level_t {
LL_none,
LL_denied,
LL_full,
LL_request,
LL_invalid
} |
| enum | rsbac_mac_auto_t { MA_no,
MA_yes,
MA_inherit
} |
| enum | rsbac_auth_cap_type_t {
ACT_real,
ACT_eff,
ACT_fs,
ACT_group_real,
ACT_group_eff,
ACT_group_fs,
ACT_none
} |
| enum | rsbac_auth_may_setuid_t {
AMS_off,
AMS_full,
AMS_last_auth_only,
AMS_last_auth_and_gid,
AMS_none
} |
| enum | rsbac_cap_process_hiding_t { PH_off,
PH_from_other_users,
PH_full,
PH_none
} |
| enum | rsbac_adf_request_t {
R_ADD_TO_KERNEL,
R_ALTER,
R_APPEND_OPEN,
R_CHANGE_GROUP,
R_CHANGE_OWNER,
R_CHDIR,
R_CLONE,
R_CLOSE,
R_CREATE,
R_DELETE,
R_EXECUTE,
R_GET_PERMISSIONS_DATA,
R_GET_STATUS_DATA,
R_LINK_HARD,
R_MODIFY_ACCESS_DATA,
R_MODIFY_ATTRIBUTE,
R_MODIFY_PERMISSIONS_DATA,
R_MODIFY_SYSTEM_DATA,
R_MOUNT,
R_READ,
R_READ_ATTRIBUTE,
R_READ_WRITE_OPEN,
R_READ_OPEN,
R_REMOVE_FROM_KERNEL,
R_RENAME,
R_SEARCH,
R_SEND_SIGNAL,
R_SHUTDOWN,
R_SWITCH_LOG,
R_SWITCH_MODULE,
R_TERMINATE,
R_TRACE,
R_TRUNCATE,
R_UMOUNT,
R_WRITE,
R_WRITE_OPEN,
R_MAP_EXEC,
R_BIND,
R_LISTEN,
R_ACCEPT,
R_CONNECT,
R_SEND,
R_RECEIVE,
R_NET_SHUTDOWN,
R_CHANGE_DAC_EFF_OWNER,
R_CHANGE_DAC_FS_OWNER,
R_CHANGE_DAC_EFF_GROUP,
R_CHANGE_DAC_FS_GROUP,
R_NONE
} |
| enum | rsbac_adf_req_ret_t { NOT_GRANTED,
GRANTED,
DO_NOT_CARE,
UNDEFINED
} |
| enum | rsbac_switch_target_t {
GEN,
MAC,
FC,
SIM,
PM,
DAZ,
FF,
RC,
AUTH,
REG,
ACL,
CAP,
JAIL,
RES,
PAX,
SOFTMODE,
DAC_DISABLE,
UM,
FREEZE,
SW_NONE
} |
| enum | rsbac_target_t {
T_FILE,
T_DIR,
T_FIFO,
T_SYMLINK,
T_DEV,
T_IPC,
T_SCD,
T_USER,
T_PROCESS,
T_NETDEV,
T_NETTEMP,
T_NETOBJ,
T_NETTEMP_NT,
T_GROUP,
T_FD,
T_NONE
} |
| enum | rsbac_attribute_t {
A_pseudo,
A_security_level,
A_initial_security_level,
A_local_sec_level,
A_remote_sec_level,
A_min_security_level,
A_mac_categories,
A_mac_initial_categories,
A_local_mac_categories,
A_remote_mac_categories,
A_mac_min_categories,
A_mac_user_flags,
A_mac_process_flags,
A_mac_file_flags,
A_object_category,
A_local_object_category,
A_remote_object_category,
A_data_type,
A_local_data_type,
A_remote_data_type,
A_system_role,
A_mac_role,
A_fc_role,
A_sim_role,
A_daz_role,
A_ff_role,
A_auth_role,
A_cap_role,
A_jail_role,
A_pax_role,
A_current_sec_level,
A_mac_curr_categories,
A_min_write_open,
A_min_write_categories,
A_max_read_open,
A_max_read_categories,
A_mac_auto,
A_mac_check,
A_mac_prop_trusted,
A_pm_role,
A_pm_process_type,
A_pm_current_task,
A_pm_object_class,
A_local_pm_object_class,
A_remote_pm_object_class,
A_pm_ipc_purpose,
A_local_pm_ipc_purpose,
A_remote_pm_ipc_purpose,
A_pm_object_type,
A_local_pm_object_type,
A_remote_pm_object_type,
A_pm_program_type,
A_pm_tp,
A_pm_task_set,
A_daz_scanned,
A_daz_scanner,
A_ff_flags,
A_rc_type,
A_local_rc_type,
A_remote_rc_type,
A_rc_type_fd,
A_rc_type_nt,
A_rc_force_role,
A_rc_initial_role,
A_rc_role,
A_rc_def_role,
A_auth_may_setuid,
A_auth_may_set_cap,
A_auth_learn,
A_min_caps,
A_max_caps,
A_max_caps_user,
A_max_caps_program,
A_jail_id,
A_jail_ip,
A_jail_flags,
A_jail_max_caps,
A_pax_flags,
A_res_role,
A_res_min,
A_res_max,
A_log_array_low,
A_local_log_array_low,
A_remote_log_array_low,
A_log_array_high,
A_local_log_array_high,
A_remote_log_array_high,
A_log_program_based,
A_log_user_based,
A_symlink_add_uid,
A_symlink_add_mac_level,
A_symlink_add_rc_role,
A_linux_dac_disable,
A_cap_process_hiding,
A_fake_root_uid,
A_audit_uid,
A_auid_exempt,
A_auth_last_auth,
A_none
} |
