]>
Commit | Line | Data |
---|---|---|
1da177e4 | 1 | /* |
7b718769 NS |
2 | * Copyright (c) 2001-2002,2005 Silicon Graphics, Inc. |
3 | * All Rights Reserved. | |
1da177e4 | 4 | * |
7b718769 NS |
5 | * This program is free software; you can redistribute it and/or |
6 | * modify it under the terms of the GNU General Public License as | |
1da177e4 LT |
7 | * published by the Free Software Foundation. |
8 | * | |
7b718769 NS |
9 | * This program is distributed in the hope that it would be useful, |
10 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
11 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
12 | * GNU General Public License for more details. | |
1da177e4 | 13 | * |
7b718769 NS |
14 | * You should have received a copy of the GNU General Public License |
15 | * along with this program; if not, write the Free Software Foundation, | |
16 | * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA | |
1da177e4 LT |
17 | */ |
18 | #ifndef __XFS_MAC_H__ | |
19 | #define __XFS_MAC_H__ | |
20 | ||
21 | /* | |
22 | * Mandatory Access Control | |
23 | * | |
24 | * Layout of a composite MAC label: | |
25 | * ml_list contains the list of categories (MSEN) followed by the list of | |
26 | * divisions (MINT). This is actually a header for the data structure which | |
27 | * will have an ml_list with more than one element. | |
28 | * | |
29 | * ------------------------------- | |
30 | * | ml_msen_type | ml_mint_type | | |
31 | * ------------------------------- | |
32 | * | ml_level | ml_grade | | |
33 | * ------------------------------- | |
34 | * | ml_catcount | | |
35 | * ------------------------------- | |
36 | * | ml_divcount | | |
37 | * ------------------------------- | |
38 | * | category 1 | | |
39 | * | . . . | | |
40 | * | category N | (where N = ml_catcount) | |
41 | * ------------------------------- | |
42 | * | division 1 | | |
43 | * | . . . | | |
44 | * | division M | (where M = ml_divcount) | |
45 | * ------------------------------- | |
46 | */ | |
47 | #define XFS_MAC_MAX_SETS 250 | |
48 | typedef struct xfs_mac_label { | |
49 | __uint8_t ml_msen_type; /* MSEN label type */ | |
50 | __uint8_t ml_mint_type; /* MINT label type */ | |
51 | __uint8_t ml_level; /* Hierarchical level */ | |
52 | __uint8_t ml_grade; /* Hierarchical grade */ | |
53 | __uint16_t ml_catcount; /* Category count */ | |
54 | __uint16_t ml_divcount; /* Division count */ | |
55 | /* Category set, then Division set */ | |
56 | __uint16_t ml_list[XFS_MAC_MAX_SETS]; | |
57 | } xfs_mac_label_t; | |
58 | ||
59 | /* MSEN label type names. Choose an upper case ASCII character. */ | |
60 | #define XFS_MSEN_ADMIN_LABEL 'A' /* Admin: low<admin != tcsec<high */ | |
61 | #define XFS_MSEN_EQUAL_LABEL 'E' /* Wildcard - always equal */ | |
62 | #define XFS_MSEN_HIGH_LABEL 'H' /* System High - always dominates */ | |
63 | #define XFS_MSEN_MLD_HIGH_LABEL 'I' /* System High, multi-level dir */ | |
64 | #define XFS_MSEN_LOW_LABEL 'L' /* System Low - always dominated */ | |
65 | #define XFS_MSEN_MLD_LABEL 'M' /* TCSEC label on a multi-level dir */ | |
66 | #define XFS_MSEN_MLD_LOW_LABEL 'N' /* System Low, multi-level dir */ | |
67 | #define XFS_MSEN_TCSEC_LABEL 'T' /* TCSEC label */ | |
68 | #define XFS_MSEN_UNKNOWN_LABEL 'U' /* unknown label */ | |
69 | ||
70 | /* MINT label type names. Choose a lower case ASCII character. */ | |
71 | #define XFS_MINT_BIBA_LABEL 'b' /* Dual of a TCSEC label */ | |
72 | #define XFS_MINT_EQUAL_LABEL 'e' /* Wildcard - always equal */ | |
73 | #define XFS_MINT_HIGH_LABEL 'h' /* High Grade - always dominates */ | |
74 | #define XFS_MINT_LOW_LABEL 'l' /* Low Grade - always dominated */ | |
75 | ||
76 | /* On-disk XFS extended attribute names */ | |
77 | #define SGI_MAC_FILE "SGI_MAC_FILE" | |
78 | #define SGI_MAC_FILE_SIZE (sizeof(SGI_MAC_FILE)-1) | |
79 | ||
80 | ||
81 | #ifdef __KERNEL__ | |
82 | ||
83 | #ifdef CONFIG_FS_POSIX_MAC | |
84 | ||
85 | /* NOT YET IMPLEMENTED */ | |
86 | ||
87 | #define MACEXEC 00100 | |
88 | #define MACWRITE 00200 | |
89 | #define MACREAD 00400 | |
90 | ||
91 | struct xfs_inode; | |
92 | extern int xfs_mac_iaccess(struct xfs_inode *, mode_t, cred_t *); | |
93 | ||
94 | #define _MAC_XFS_IACCESS(i,m,c) (xfs_mac_iaccess(i,m,c)) | |
95 | #define _MAC_VACCESS(v,c,m) (xfs_mac_vaccess(v,c,m)) | |
96 | #define _MAC_EXISTS xfs_mac_vhaslabel | |
97 | ||
98 | #else | |
99 | #define _MAC_XFS_IACCESS(i,m,c) (0) | |
100 | #define _MAC_VACCESS(v,c,m) (0) | |
101 | #define _MAC_EXISTS (NULL) | |
102 | #endif | |
103 | ||
104 | #endif /* __KERNEL__ */ | |
105 | ||
106 | #endif /* __XFS_MAC_H__ */ |