lkml.org 
[lkml]   [2008]   [Apr]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[TOMOYO #7 05/30] External functions prototypes for SAKURA.
This file defines prototypes and constants that are needed by hooks.

Signed-off-by: Kentaro Takeda <takedakn@nttdata.co.jp>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Toshiharu Harada <haradats@nttdata.co.jp>
---
include/linux/sakura.h | 82 +++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 82 insertions(+)

--- /dev/null
+++ linux-2.6.25-rc8-mm1/include/linux/sakura.h
@@ -0,0 +1,82 @@
+/*
+ * include/linux/sakura.h
+ *
+ * Implementation of the Domain-Free Mandatory Access Control.
+ *
+ * Copyright (C) 2005-2008 NTT DATA CORPORATION
+ *
+ * Version: 1.6.0 2008/04/01
+ *
+ */
+/*
+ * A brief description about SAKURA:
+ *
+ * SAKURA stands for "Security Advancement Know-how Upon Read-only Approach".
+ * As the name shows, SAKURA was originally a methodology to make root fs
+ * read-only to avoid tampering the system files.
+ * But now, SAKURA is not only a methodology but also a kernel patch
+ * that improves the system security with less effort.
+ *
+ * SAKURA can restrict operations that affect systemwide.
+ * SAKURA manages the filesystem's namespace related operations so that
+ * files remains where the administrator expects.
+ */
+
+#ifndef _LINUX_SAKURA_H
+#define _LINUX_SAKURA_H
+
+#if defined(CONFIG_SAKURA)
+
+/* Check whether the given pathname is allowed to chroot to. */
+int ccs_check_chroot_permission(struct nameidata *nd);
+
+/* Check whether the mount operation with the given parameters is allowed. */
+int ccs_check_mount_permission(char *dev_name, char *dir_name, char *type,
+ const unsigned long *flags);
+
+/* Check whether the current process is allowed to pivot_root. */
+int ccs_check_pivot_root_permission(struct nameidata *old_nd,
+ struct nameidata *new_nd);
+
+/* Check whether the given mount operation hides an mounted partition. */
+int ccs_may_mount(struct nameidata *nd);
+
+/* Check whether the given mountpoint is allowed to umount. */
+int ccs_may_umount(struct vfsmount *mnt);
+
+/* Check whether the given port is allowed to autobind. */
+int ccs_may_autobind(const u16 port);
+
+#else
+
+static inline int ccs_check_chroot_permission(struct nameidata *nd)
+{
+ return 0;
+}
+static inline int ccs_check_mount_permission(char *dev_name, char *dir_name,
+ char *type,
+ const unsigned long *flags)
+{
+ return 0;
+}
+static inline int ccs_check_pivot_root_permission(struct nameidata *old_nd,
+ struct nameidata *new_nd)
+{
+ return 0;
+}
+static inline int ccs_may_mount(struct nameidata *nd)
+{
+ return 0;
+}
+static inline int ccs_may_umount(struct vfsmount *mnt)
+{
+ return 0;
+}
+static inline int ccs_may_autobind(const u16 port)
+{
+ return 0;
+}
+
+#endif
+
+#endif
--


\
 
 \ /
  Last update: 2008-04-04 14:53    [W:0.141 / U:0.080 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site