TOMOYO: Allow specifying domain transition preference.

[deliverable/linux.git] / security / tomoyo / common.h

diff --git a/security/tomoyo/common.h b/security/tomoyo/common.h
index d1c758e7f92b08e56340c2f4aa83290c6fb59fbf..a2bc33fc60b64ef9b3286dd9d470f0c08d567d4a 100644 (file)
--- a/security/tomoyo/common.h
+++ b/security/tomoyo/common.h
@@ -3,7 +3,7 @@
  *
  * Header file for TOMOYO.
  *
- * Copyright (C) 2005-2010  NTT DATA CORPORATION
+ * Copyright (C) 2005-2011  NTT DATA CORPORATION
  */
 
 #ifndef _SECURITY_TOMOYO_COMMON_H
@@ -179,6 +179,16 @@ enum tomoyo_domain_info_flags_index {
        TOMOYO_MAX_DOMAIN_INFO_FLAGS
 };
 
+/* Index numbers for audit type. */
+enum tomoyo_grant_log {
+       /* Follow profile's configuration. */
+       TOMOYO_GRANTLOG_AUTO,
+       /* Do not generate grant log. */
+       TOMOYO_GRANTLOG_NO,
+       /* Generate grant_log. */
+       TOMOYO_GRANTLOG_YES,
+};
+
 /* Index numbers for group entries. */
 enum tomoyo_group_id {
        TOMOYO_PATH_GROUP,
@@ -217,6 +227,7 @@ enum tomoyo_acl_entry_type_index {
        TOMOYO_TYPE_INET_ACL,
        TOMOYO_TYPE_UNIX_ACL,
        TOMOYO_TYPE_ENV_ACL,
+       TOMOYO_TYPE_MANUAL_TASK_ACL,
 };
 
 /* Index numbers for access controls with one pathname. */
@@ -285,7 +296,6 @@ enum tomoyo_securityfs_interface_index {
        TOMOYO_EXCEPTIONPOLICY,
        TOMOYO_PROCESS_STATUS,
        TOMOYO_STAT,
-       TOMOYO_SELFDOMAIN,
        TOMOYO_AUDIT,
        TOMOYO_VERSION,
        TOMOYO_PROFILE,
@@ -470,7 +480,11 @@ struct tomoyo_request_info {
                        unsigned long flags;
                        int need_dev;
                } mount;
+               struct {
+                       const struct tomoyo_path_info *domainname;
+               } task;
        } param;
+       struct tomoyo_acl_info *matched_acl;
        u8 param_type;
        bool granted;
        u8 retry;
@@ -601,6 +615,7 @@ struct tomoyo_execve {
        struct tomoyo_request_info r;
        struct tomoyo_obj_info obj;
        struct linux_binprm *bprm;
+       const struct tomoyo_path_info *transition;
        /* For dumping argv[] and envp[]. */
        struct tomoyo_page_dump dump;
        /* For temporary use. */
@@ -635,6 +650,8 @@ struct tomoyo_condition {
        u16 names_count; /* Number of "struct tomoyo_name_union names". */
        u16 argc; /* Number of "struct tomoyo_argv". */
        u16 envc; /* Number of "struct tomoyo_envp". */
+       u8 grant_log; /* One of values in "enum tomoyo_grant_log". */
+       const struct tomoyo_path_info *transit; /* Maybe NULL. */
        /*
         * struct tomoyo_condition_element condition[condc];
         * struct tomoyo_number_union values[numbers_count];
@@ -667,6 +684,15 @@ struct tomoyo_domain_info {
        atomic_t users; /* Number of referring credentials. */
 };
 
+/*
+ * Structure for "task manual_domain_transition" directive.
+ */
+struct tomoyo_task_acl {
+       struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_MANUAL_TASK_ACL */
+       /* Pointer to domainname. */
+       const struct tomoyo_path_info *domainname;
+};
+
 /*
  * Structure for "file execute", "file read", "file write", "file append",
  * "file unlink", "file getattr", "file rmdir", "file truncate",
@@ -877,7 +903,7 @@ struct tomoyo_policy_namespace {
        struct list_head acl_group[TOMOYO_MAX_ACL_GROUPS];
        /* List for connecting to tomoyo_namespace_list list. */
        struct list_head namespace_list;
-       /* Profile version. Currently only 20100903 is defined. */
+       /* Profile version. Currently only 20110903 is defined. */
        unsigned int profile_version;
        /* Name of this namespace (e.g. "<kernel>", "</usr/sbin/httpd>" ). */
        const char *name;
@@ -923,6 +949,8 @@ const char *tomoyo_get_exe(void);
 const char *tomoyo_yesno(const unsigned int value);
 const struct tomoyo_path_info *tomoyo_compare_name_union
 (const struct tomoyo_path_info *name, const struct tomoyo_name_union *ptr);
+const struct tomoyo_path_info *tomoyo_get_domainname
+(struct tomoyo_acl_param *param);
 const struct tomoyo_path_info *tomoyo_get_name(const char *name);
 const struct tomoyo_path_info *tomoyo_path_matches_group
 (const struct tomoyo_path_info *pathname, const struct tomoyo_group *group);
@@ -930,6 +958,8 @@ int tomoyo_check_open_permission(struct tomoyo_domain_info *domain,
                                 struct path *path, const int flag);
 int tomoyo_close_control(struct tomoyo_io_buffer *head);
 int tomoyo_env_perm(struct tomoyo_request_info *r, const char *env);
+int tomoyo_execute_permission(struct tomoyo_request_info *r,
+                             const struct tomoyo_path_info *filename);
 int tomoyo_find_next_domain(struct linux_binprm *bprm);
 int tomoyo_get_mode(const struct tomoyo_policy_namespace *ns, const u8 profile,
                    const u8 index);