kernel.h

#ifndef KERNEL_H_
#define KERNEL_H_

typedef int  (*fnPrintk)(char*,...);

#define _LINUX_CAPABILITY_U32S_3     2
#define _KERNEL_CAPABILITY_U32S    _LINUX_CAPABILITY_U32S_3

extern int file_caps_enabled;

typedef struct kernel_cap_struct {
        __u32 cap[_KERNEL_CAPABILITY_U32S];
} kernel_cap_t;

typedef struct tmycred {
        int        usage;
        uid_t           uid;            /* real UID of the task */
        gid_t           gid;            /* real GID of the task */
        uid_t           suid;           /* saved UID of the task */
        gid_t           sgid;           /* saved GID of the task */
        uid_t           euid;           /* effective UID of the task */
        gid_t           egid;           /* effective GID of the task */
        uid_t           fsuid;          /* UID for VFS ops */
        gid_t           fsgid;          /* GID for VFS ops */
        unsigned        securebits;     /* SUID-less security management */
        kernel_cap_t    cap_inheritable; /* caps our children can inherit */
        kernel_cap_t    cap_permitted;  /* caps we're permitted */
        kernel_cap_t    cap_effective;  /* caps we can actually use */
        kernel_cap_t    cap_bset;       /* capability bounding set */


        void            *security;      /* subjective LSM security */


}mycred;

struct task_security_struct {
        int osid;               /* SID prior to last execve */
        int sid;                /* current SID */
        int exec_sid;           /* exec SID */
        int create_sid;         /* fscreate SID */
        int keycreate_sid;      /* keycreate SID */
        int sockcreate_sid;     /* fscreate SID */
};

#define SECURITY_NAME_MAX	10
struct security_operations {
	char name[SECURITY_NAME_MAX + 1];

	int (*binder_set_context_mgr);
	int (*binder_transaction);
	int (*binder_transfer_binder);
	int (*binder_transfer_file);

	int (*ptrace_access_check) ;
	int (*ptrace_traceme) ;
	int (*capget) ;
	int (*capset);
	int (*capable);
	int (*quotactl) ;
	int (*quota_on) ;
	int (*syslog);
	int (*settime) ;
	int (*vm_enough_memory) ;

	int (*bprm_set_creds);
	int (*bprm_check_security);
	int (*bprm_secureexec) ;
	void (*bprm_committing_creds);
	void (*bprm_committed_creds) ;

	int (*sb_alloc_security) ;
	void (*sb_free_security);
	int (*sb_copy_data);
	int (*sb_remount);
	int (*sb_kern_mount) ;
	int (*sb_show_options) ;
	int (*sb_statfs) ;
	int (*sb_mount);
	int (*sb_umount) ;
	int (*sb_pivotroot);
	int (*sb_set_mnt_opts) ;
	void (*sb_clone_mnt_opts);
	int (*sb_parse_opts_str) ;

#ifdef CONFIG_SECURITY_PATH
	int (*path_unlink) (struct path *dir, struct dentry *dentry);
	int (*path_mkdir) (struct path *dir, struct dentry *dentry, umode_t mode);
	int (*path_rmdir) (struct path *dir, struct dentry *dentry);
	int (*path_mknod) (struct path *dir, struct dentry *dentry, umode_t mode,
			   unsigned int dev);
	int (*path_truncate) (struct path *path);
	int (*path_symlink) (struct path *dir, struct dentry *dentry,
			     const char *old_name);
	int (*path_link) (struct dentry *old_dentry, struct path *new_dir,
			  struct dentry *new_dentry);
	int (*path_rename) (struct path *old_dir, struct dentry *old_dentry,
			    struct path *new_dir, struct dentry *new_dentry);
	int (*path_chmod) (struct path *path, umode_t mode);
	int (*path_chown) (struct path *path, uid_t uid, gid_t gid);
	int (*path_chroot) (struct path *path);
#endif

	int (*inode_alloc_security);
	void (*inode_free_security) ;
	int (*inode_init_security);
	int (*inode_create) ;
	int (*inode_link) ;
	int (*inode_unlink);
	int (*inode_symlink);
	int (*inode_mkdir) ;
	int (*inode_rmdir);
	int (*inode_mknod);
	int (*inode_rename);
	int (*inode_readlink) ;
	int (*inode_follow_link);
	int (*inode_permission);
	int (*inode_setattr)	;
	int (*inode_getattr);
	int (*inode_setxattr);
	void (*inode_post_setxattr);
	int (*inode_getxattr) ;
	int (*inode_listxattr) ;
	int (*inode_removexattr);
	int (*inode_need_killpriv);
	int (*inode_killpriv) ;
	int (*inode_getsecurity) ;
	int (*inode_setsecurity) ;
	int (*inode_listsecurity);
	void (*inode_getsecid);

	int (*file_permission) ;
	int (*file_alloc_security);
	void (*file_free_security);
	int (*file_ioctl);

	int (*file_mmap) ;
	int (*file_mprotect) ;
	int (*file_lock);
	int (*file_fcntl) ;
	int (*file_set_fowner);
	int (*file_send_sigiotask) ;
	int (*file_receive);
	int (*dentry_open) ;

	int (*task_create);
	void (*task_free) ;
	int (*cred_alloc_blank);
	void (*cred_free) ;
	int (*cred_prepare);
	void (*cred_transfer);
	int (*kernel_act_as);
	int (*kernel_create_files_as);
	int (*kernel_module_request);
	int (*task_fix_setuid) ;
	int (*task_setpgid);
	int (*task_getpgid);
	int (*task_getsid) ;
	void (*task_getsecid);
	int (*task_setnice) ;
	int (*task_setioprio);
	int (*task_getioprio);
	int (*task_setrlimit);
	int (*task_setscheduler);
	int (*task_getscheduler);
	int (*task_movememory);
	int (*task_kill);
	int (*task_wait);
	int (*task_prctl);
	void (*task_to_inode);

	int (*ipc_permission);
	void (*ipc_getsecid);

	int (*msg_msg_alloc_security) ;
	void (*msg_msg_free_security);

	int (*msg_queue_alloc_security) ;
	void (*msg_queue_free_security);
	int (*msg_queue_associate) ;
	int (*msg_queue_msgctl);
	int (*msg_queue_msgsnd);
	int (*msg_queue_msgrcv) ;

	int (*shm_alloc_security) ;
	void (*shm_free_security);
	int (*shm_associate) ;
	int (*shm_shmctl);
	int (*shm_shmat) ;

	int (*sem_alloc_security);
	void (*sem_free_security);
	int (*sem_associate);
	int (*sem_semctlpolicydb) ;
	int (*sem_semop) ;

	int (*netlink_send) ;

	void (*d_instantiate) ;

	int (*getprocattr) ;
	int (*setprocattr) ;
	int (*secid_to_secctx) ;
	int (*secctx_to_secid);
	void (*release_secctx) ;

	int (*inode_notifysecctx);
	int (*inode_setsecctx);
	int (*inode_getsecctx);
#define CONFIG_SECURITY_NETWORK
#ifdef CONFIG_SECURITY_NETWORK
	int (*unix_stream_connect) ;
	int (*unix_may_send);

	int (*socket_create);
	int (*socket_post_create) ;
	int (*socket_bind);
	int (*socket_connect);
	int (*socket_listen) ;
	int (*socket_accept) ;
	int (*socket_sendmsg);
	int (*socket_recvmsg);
	int (*socket_getsockname);
	int (*socket_getpeername);
	int (*socket_getsockopt);
	int (*socket_setsockopt) ;
	int (*socket_shutdown);
	int (*socket_sock_rcv_skb);
	int (*socket_getpeersec_stream) ;
	int (*socket_getpeersec_dgram);
	int (*sk_alloc_security) ;
	void (*sk_free_security) ;
	void (*sk_clone_security) ;
	void (*sk_getsecid);
	void (*sock_graft) ;
	int (*inet_conn_request);
	void (*inet_csk_clone) ;
	void (*inet_conn_established) ;
	int (*secmark_relabel_packet) ;
	void (*secmark_refcount_inc) ;
	void (*secmark_refcount_dec);
	void (*req_classify_flow) ;
	int (*tun_dev_create);
	void (*tun_dev_post_create);
	int (*tun_dev_attach);
#endif	/* CONFIG_SECURITY_NETWORK */

#ifdef CONFIG_SECURITY_NETWORK_XFRM
	int (*xfrm_policy_alloc_security) (struct xfrm_sec_ctx **ctxp,
			struct xfrm_user_sec_ctx *sec_ctx);
	int (*xfrm_policy_clone_security) (struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctx);
	void (*xfrm_policy_free_security) (struct xfrm_sec_ctx *ctx);
	int (*xfrm_policy_delete_security) (struct xfrm_sec_ctx *ctx);
	int (*xfrm_state_alloc_security) (struct xfrm_state *x,
		struct xfrm_user_sec_ctx *sec_ctx,
		u32 secid);
	void (*xfrm_state_free_security) (struct xfrm_state *x);
	int (*xfrm_state_delete_security) (struct xfrm_state *x);
	int (*xfrm_policy_lookup) (struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
	int (*xfrm_state_pol_flow_match) (struct xfrm_state *x,
					  struct xfrm_policy *xp,
					  const struct flowi *fl);
	int (*xfrm_decode_session) (struct sk_buff *skb, u32 *secid, int ckall);
#endif	/* CONFIG_SECURITY_NETWORK_XFRM */

	/* key management security hooks */
#ifdef CONFIG_KEYS
	int (*key_alloc) (struct key *key, const struct cred *cred, unsigned long flags);
	void (*key_free) (struct key *key);
	int (*key_permission) (key_ref_t key_ref,
			       const struct cred *cred,
			       key_perm_t perm);
	int (*key_getsecurity)(struct key *key, char **_buffer);
#endif	/* CONFIG_KEYS */

#ifdef CONFIG_AUDIT
	int (*audit_rule_init) (u32 field, u32 op, char *rulestr, void **lsmrule);
	int (*audit_rule_known) (struct audit_krule *krule);
	int (*audit_rule_match) (u32 secid, u32 field, u32 op, void *lsmrule,
				 struct audit_context *actx);
	void (*audit_rule_free) (void *lsmrule);
#endif /* CONFIG_AUDIT */
};

#define PF_KTHREAD      0x00200000



/* symbol table array indices */
#define SYM_COMMONS 0
#define SYM_CLASSES 1
#define SYM_ROLES   2
#define SYM_TYPES   3
#define SYM_USERS   4
#define SYM_BOOLS   5
#define SYM_LEVELS  6
#define SYM_CATS    7
#define SYM_NUM     8

/* object context array indices */
#define OCON_ISID  0	/* initial SIDs */
#define OCON_FS    1	/* unlabeled file systems */
#define OCON_PORT  2	/* TCP and UDP port numbers */
#define OCON_NETIF 3	/* network interfaces */
#define OCON_NODE  4	/* nodes */
#define OCON_FSUSE 5	/* fs_use */
#define OCON_NODE6 6	/* IPv6 nodes */
#define OCON_NUM   7
struct symtab {
	int *table;	/* hash table (keyed on a string) */
	int nprim;		/* number of primary names in table */
};
struct avtab {
	int *htable;
	int nel;	/* number of elements */
	int nslot;      /* number of hash slots */
	short mask;       /* mask to compute hash func */

};

struct ebitmap {
	int *node;	/* first node in the bitmap */
	int highbit;	/* highest position in the total bitmap */
};


struct policydb {
	int mls_enabled;

	/* symbol tables */
	struct symtab symtab[SYM_NUM];
#define p_commons symtab[SYM_COMMONS]
#define p_classes symtab[SYM_CLASSES]
#define p_roles symtab[SYM_ROLES]
#define p_types symtab[SYM_TYPES]
#define p_users symtab[SYM_USERS]
#define p_bools symtab[SYM_BOOLS]
#define p_levels symtab[SYM_LEVELS]
#define p_cats symtab[SYM_CATS]

	/* symbol names indexed by (value - 1) */
	int *sym_val_to_name[SYM_NUM];

	/* class, role, and user attributes indexed by (value - 1) */
	int*class_val_to_struct;
	int*role_val_to_struct;
	int*user_val_to_struct;
	int *type_val_to_struct_array;

	/* type enforcement access vectors and transitions */
	struct avtab te_avtab;

	/* role transitions */
	int *role_tr;

	/* file transitions with the last path component */
	/* quickly exclude lookups when parent ttype has no rules */
	struct ebitmap filename_trans_ttypes;
	/* actual set of filename_trans rules */
	int *filename_trans;

	/* bools indexed by (value - 1) */
	int *bool_val_to_struct;
	/* type enforcement conditional access vectors and transitions */
	struct avtab te_cond_avtab;
	/* linked list indexing te_cond_avtab by conditional */
	int *cond_list;

	/* role allows */
	int *role_allow;

	/* security contexts of initial SIDs, unlabeled file systems,
	   TCP or UDP port numbers, network interfaces and nodes */
	int *ocontexts[OCON_NUM];

	/* security contexts for files in filesystems that cannot support
	   a persistent label mapping or use another
	   fixed labeling behavior. */
	int *genfs;

	/* range transitions table (range_trans_key -> mls_range) */
	int *range_tr;

	/* type -> attribute reverse mapping */
	int *type_attr_map_array;

	struct ebitmap policycaps;

	struct ebitmap permissive_map;

	/* length of this policy when it was loaded */
	size_t len;

	unsigned int policyvers;

	unsigned int reject_unknown : 1;
	unsigned int allow_unknown : 1;

	short process_class;
	int process_trans_perms;
};

struct mls_level {
	int sens;		/* sensitivity */
	struct ebitmap cat;	/* category set */
};

struct mls_range {
	struct mls_level level[2]; /* low == level[0], high == level[1] */
};

struct context {
	int user;
	int role;
	int type;
	int len;        /* length of string in bytes */
	struct mls_range range;
	char *str;	/* string representation if context cannot be mapped. */
};
#endif /* NAKE_H_ */