net.h 3.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112
  1. /* SPDX-License-Identifier: GPL-2.0-only */
  2. /*
  3. * AppArmor security module
  4. *
  5. * This file contains AppArmor network mediation definitions.
  6. *
  7. * Copyright (C) 1998-2008 Novell/SUSE
  8. * Copyright 2009-2017 Canonical Ltd.
  9. */
  10. #ifndef __AA_NET_H
  11. #define __AA_NET_H
  12. #include <net/sock.h>
  13. #include <linux/path.h>
  14. #include "apparmorfs.h"
  15. #include "label.h"
  16. #include "perms.h"
  17. #include "policy.h"
  18. #define AA_MAY_SEND AA_MAY_WRITE
  19. #define AA_MAY_RECEIVE AA_MAY_READ
  20. #define AA_MAY_SHUTDOWN AA_MAY_DELETE
  21. #define AA_MAY_CONNECT AA_MAY_OPEN
  22. #define AA_MAY_ACCEPT 0x00100000
  23. #define AA_MAY_BIND 0x00200000
  24. #define AA_MAY_LISTEN 0x00400000
  25. #define AA_MAY_SETOPT 0x01000000
  26. #define AA_MAY_GETOPT 0x02000000
  27. #define NET_PERMS_MASK (AA_MAY_SEND | AA_MAY_RECEIVE | AA_MAY_CREATE | \
  28. AA_MAY_SHUTDOWN | AA_MAY_BIND | AA_MAY_LISTEN | \
  29. AA_MAY_CONNECT | AA_MAY_ACCEPT | AA_MAY_SETATTR | \
  30. AA_MAY_GETATTR | AA_MAY_SETOPT | AA_MAY_GETOPT)
  31. #define NET_FS_PERMS (AA_MAY_SEND | AA_MAY_RECEIVE | AA_MAY_CREATE | \
  32. AA_MAY_SHUTDOWN | AA_MAY_CONNECT | AA_MAY_RENAME |\
  33. AA_MAY_SETATTR | AA_MAY_GETATTR | AA_MAY_CHMOD | \
  34. AA_MAY_CHOWN | AA_MAY_CHGRP | AA_MAY_LOCK | \
  35. AA_MAY_MPROT)
  36. #define NET_PEER_MASK (AA_MAY_SEND | AA_MAY_RECEIVE | AA_MAY_CONNECT | \
  37. AA_MAY_ACCEPT)
  38. struct aa_sk_ctx {
  39. struct aa_label *label;
  40. struct aa_label *peer;
  41. };
  42. #define SK_CTX(X) ((X)->sk_security)
  43. #define SOCK_ctx(X) SOCK_INODE(X)->i_security
  44. #define DEFINE_AUDIT_NET(NAME, OP, SK, F, T, P) \
  45. struct lsm_network_audit NAME ## _net = { .sk = (SK), \
  46. .family = (F)}; \
  47. DEFINE_AUDIT_DATA(NAME, \
  48. ((SK) && (F) != AF_UNIX) ? LSM_AUDIT_DATA_NET : \
  49. LSM_AUDIT_DATA_NONE, \
  50. OP); \
  51. NAME.u.net = &(NAME ## _net); \
  52. aad(&NAME)->net.type = (T); \
  53. aad(&NAME)->net.protocol = (P)
  54. #define DEFINE_AUDIT_SK(NAME, OP, SK) \
  55. DEFINE_AUDIT_NET(NAME, OP, SK, (SK)->sk_family, (SK)->sk_type, \
  56. (SK)->sk_protocol)
  57. #define af_select(FAMILY, FN, DEF_FN) \
  58. ({ \
  59. int __e; \
  60. switch ((FAMILY)) { \
  61. default: \
  62. __e = DEF_FN; \
  63. } \
  64. __e; \
  65. })
  66. struct aa_secmark {
  67. u8 audit;
  68. u8 deny;
  69. u32 secid;
  70. char *label;
  71. };
  72. extern struct aa_sfs_entry aa_sfs_entry_network[];
  73. void audit_net_cb(struct audit_buffer *ab, void *va);
  74. int aa_profile_af_perm(struct aa_profile *profile, struct common_audit_data *sa,
  75. u32 request, u16 family, int type);
  76. int aa_af_perm(struct aa_label *label, const char *op, u32 request, u16 family,
  77. int type, int protocol);
  78. static inline int aa_profile_af_sk_perm(struct aa_profile *profile,
  79. struct common_audit_data *sa,
  80. u32 request,
  81. struct sock *sk)
  82. {
  83. return aa_profile_af_perm(profile, sa, request, sk->sk_family,
  84. sk->sk_type);
  85. }
  86. int aa_sk_perm(const char *op, u32 request, struct sock *sk);
  87. int aa_sock_file_perm(struct aa_label *label, const char *op, u32 request,
  88. struct socket *sock);
  89. int apparmor_secmark_check(struct aa_label *label, char *op, u32 request,
  90. u32 secid, const struct sock *sk);
  91. #endif /* __AA_NET_H */