/************************************ */
/* Rule Set Based Access Control      */
/* Author and (c) 1999,2000: Amon Ott */
/* API: Data types for                */
/*    Role Compatibility Module       */
/* Last modified: 25/Sep/2000         */
/************************************ */

#ifndef __RSBAC_RC_TYPES_H
#define __RSBAC_RC_TYPES_H

#include <linux/types.h>

/***** RC *****/

#define RSBAC_RC_GENERAL_ROLE 0
#define RSBAC_RC_ROLE_ADMIN_ROLE 1
#define RSBAC_RC_SYSTEM_ADMIN_ROLE 2
#define RSBAC_RC_GENERAL_TYPE 0

#ifdef __KERNEL__
#if defined(CONFIG_RSBAC_RC_NR_ROLES) && CONFIG_RSBAC_RC_NR_ROLES < 3
#define RSBAC_RC_NR_ROLES 3
#elif defined(CONFIG_RSBAC_RC_NR_ROLES) && CONFIG_RSBAC_RC_NR_ROLES > 64
#define RSBAC_RC_NR_ROLES 64
#elif defined(CONFIG_RSBAC_RC_NR_ROLES)
#define RSBAC_RC_NR_ROLES CONFIG_RSBAC_RC_NR_ROLES
#else
#define RSBAC_RC_NR_ROLES 64
#endif

#else /* not __KERNEL__ */
#define RSBAC_RC_NR_ROLES 64
#endif

#define RSBAC_RC_NR_TYPES 64
#define RSBAC_RC_MAX_ROLE (RSBAC_RC_NR_ROLES - 1)
#define RSBAC_RC_MAX_TYPE (RSBAC_RC_NR_TYPES - 1)
#define RSBAC_RC_NAME_LEN 16
#define RSBAC_RC_ALL_REQUESTS ((rsbac_rc_request_vector_t) -1)
#define RSBAC_RC_ALL_ROLES ((rsbac_rc_role_vector_t) -1)

#define RSBAC_RC_SPECIAL_RIGHT_BASE 48

enum rsbac_rc_special_rights_t
  { RCR_ADMIN = RSBAC_RC_SPECIAL_RIGHT_BASE,
    RCR_ASSIGN,
    RCR_ACCESS_CONTROL,
    RCR_SUPERVISOR,
    RCR_NONE};

typedef __u64 rsbac_rc_rights_vector_t;

#define RSBAC_RC_RIGHTS_VECTOR(x) ((rsbac_rc_rights_vector_t) 1 << (x))
#define RSBAC_RC_ROLE_VECTOR(x) ((rsbac_rc_role_vector_t) 1 << (x))
#define RSBAC_RC_TYPE_VECTOR(x) ((rsbac_rc_type_vector_t) 1 << (x))

#define RSBAC_RC_SPECIAL_RIGHTS_VECTOR (\
  RSBAC_RC_RIGHTS_VECTOR(RCR_ADMIN) | \
  RSBAC_RC_RIGHTS_VECTOR(RCR_ASSIGN) | \
  RSBAC_RC_RIGHTS_VECTOR(RCR_ACCESS_CONTROL) | \
  RSBAC_RC_RIGHTS_VECTOR(RCR_SUPERVISOR) \
  )

#define RSBAC_RC_SUPERVISOR_RIGHT_VECTOR (\
    RSBAC_RC_RIGHTS_VECTOR(RCR_SUPERVISOR) | \
  )

#define RSBAC_RC_ALL_RIGHTS_VECTOR (RSBAC_ALL_REQUEST_VECTOR | RSBAC_RC_SPECIAL_RIGHTS_VECTOR)

#define RSBAC_RC_GEN_RIGHTS_VECTOR 0

typedef __u8 rsbac_rc_role_id_t;
typedef __u8 rsbac_rc_type_id_t;
typedef rsbac_request_vector_t rsbac_rc_request_vector_t;
typedef rsbac_rc_request_vector_t rsbac_rc_type_comp_array_t[RSBAC_RC_NR_TYPES];
typedef __u64 rsbac_rc_role_vector_t;
typedef __u64 rsbac_rc_type_vector_t;
#define RSBAC_RC_ALL_ROLE_VECTOR ((rsbac_rc_role_vector_t) -1)
#define RSBAC_RC_ALL_TYPE_VECTOR ((rsbac_rc_type_vector_t) -1)

enum rsbac_rc_admin_type_t {RC_no_admin, RC_role_admin, RC_system_admin, RC_none};

/*
 * System Control Types, including general SCD types
 * (start at 32 to allow future SCD types, max is 63)
 */
#define RST_min 32
enum rsbac_rc_scd_type_t {RST_auth_administration = RST_min,
                          RST_none};

/* what should always be there to keep system functional */
#ifdef CONFIG_RSBAC_USER_MOD_IOPERM
#define RSBAC_RC_GENERAL_COMP_SCD { \
                          0, \
                          0, \
                          0, \
                          0, \
         /* ST_ioports */ ((rsbac_request_vector_t) 1 << R_MODIFY_PERMISSIONS_DATA), \
         /* ST_rlimit */ -1, \
         /* ST_swap */              0, \
         /* ST_syslog */            0, \
         /* ST_rsbac */             0, \
         /* ST_rsbac_log */         0, \
         /* ST_other */             ( \
                                       ((rsbac_request_vector_t) 1 << R_EXECUTE) \
                                    ) \
          }
#else
#define RSBAC_RC_GENERAL_COMP_SCD { \
                          0, \
                          0, \
                          0, \
                          0, \
                          0, \
         /* ST_rlimit */ -1, \
         /* ST_swap */              0, \
         /* ST_syslog */            0, \
         /* ST_rsbac */             0, \
         /* ST_rsbac_log */         0, \
         /* ST_other */             ( \
                                       ((rsbac_request_vector_t) 1 << R_EXECUTE) \
                                    ) \
          }
#endif

#define RSBAC_RC_ROLEADM_COMP_SCD { \
         /* 0 = ST_time_structs */  0, \
         /* ST_clock */             0, \
         /* ST_host_id */           0, \
         /* ST_net_id */            0, \
         /* ST_ioports */           0, \
         /* ST_rlimit */           -1, \
         /* ST_swap */              0, \
         /* ST_syslog */            0, \
         /* ST_rsbac */            -1, \
         /* ST_rsbac_log */        -1, \
         /* ST_other */             ( \
                                       ((rsbac_request_vector_t) 1 << R_EXECUTE) \
                                     | ((rsbac_request_vector_t) 1 << R_SWITCH_LOG) \
                                     | ((rsbac_request_vector_t) 1 << R_SWITCH_MODULE) \
                                    ), \
         /* 11 = ST_none */         0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
         /* 20 */                   0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
         /* 30 */                   0, \
                                    0, \
         /* 32 = RST_auth_admin */ -1, \
         /* 33 = RST_none */        0 \
          }

#define RSBAC_RC_SYSADM_COMP_SCD { \
         /* 0 = ST_time_structs */ -1, \
         /* ST_clock */            -1, \
         /* ST_host_id */          -1, \
         /* ST_net_id */           -1, \
         /* ST_ioports */          -1, \
         /* ST_rlimit */           -1, \
         /* ST_swap */             -1, \
         /* ST_syslog */           -1, \
         /* ST_rsbac */            -1, \
         /* ST_rsbac_log */         0, \
         /* ST_other */             ( \
                                       ((rsbac_request_vector_t) 1 << R_ADD_TO_KERNEL) \
                                     | ((rsbac_request_vector_t) 1 << R_EXECUTE) \
                                     | ((rsbac_request_vector_t) 1 << R_MOUNT) \
                                     | ((rsbac_request_vector_t) 1 << R_REMOVE_FROM_KERNEL) \
                                     | ((rsbac_request_vector_t) 1 << R_UMOUNT) \
                                     | ((rsbac_request_vector_t) 1 << R_SHUTDOWN) \
                                    ), \
         /* ST_kmem */             -1, \
         /* 12 = ST_none */         0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
         /* 20 */                   0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
                                    0, \
         /* 30 */                   0, \
                                    0, \
         /* 32 = RST_auth_admin */  0, \
         /* 33 = RST_none */        0 \
          }

#define RC_type_inherit_process 64
#define RC_type_inherit_parent 65
#define RC_type_no_create 66
#define RC_type_no_execute 67
#define RC_type_use_new_role_def_create 68  /* for process chown (setuid) */
#define RC_type_no_chown 69
#define RC_type_max_value 69

#define RC_role_min_special 64
#define RC_role_inherit_user 64
#define RC_role_inherit_process 65
#define RC_role_inherit_parent 66
#define RC_role_inherit_up_mixed 67
#define RC_role_max_value 67

#define RC_default_force_role RC_role_inherit_parent
#define RC_default_root_dir_force_role RC_role_inherit_up_mixed
#define RC_default_init_force_role RC_role_inherit_user

/****************************************************************************/
/* RC ACI types                                                             */
/****************************************************************************/

enum   rsbac_rc_target_t { RT_ROLE, RT_TYPE, RT_NONE };

union  rsbac_rc_target_id_t
       {
         rsbac_rc_role_id_t role;
         rsbac_rc_type_id_t type;
       };

enum   rsbac_rc_item_t { RI_role_comp,
                         RI_admin_roles,  /* new in version 3 */
                         RI_assign_roles, /* new in version 3 */
                         RI_type_comp_fd,
                         RI_type_comp_dev,
                         RI_type_comp_process,
                         RI_type_comp_ipc,
                         RI_type_comp_scd,
                         RI_admin_type,
                         RI_name,
                         RI_def_fd_create_type,
                         RI_def_process_create_type,
                         RI_def_process_chown_type,
                         RI_def_process_execute_type,
                         RI_def_ipc_create_type,
                         RI_type_fd_name,
                         RI_type_dev_name,
                         RI_type_ipc_name,
                         RI_type_process_name,
                         RI_type_fd_need_secdel,
                         RI_type_scd_name, /* Pseudo, using get_rc_scd_name() */
#ifdef __KERNEL__
#endif
                         RI_none};

union  rsbac_rc_item_value_t
       {
          rsbac_rc_role_vector_t        role_comp;
          rsbac_rc_role_vector_t        admin_roles;
          rsbac_rc_role_vector_t        assign_roles;
          rsbac_rc_type_comp_array_t    type_comp;
          enum rsbac_rc_admin_type_t    admin_type;
          char                          name[RSBAC_RC_NAME_LEN];
          rsbac_rc_type_id_t            type_id;
          boolean                       need_secdel;
#ifdef __KERNEL__
#endif
          u_char                        u_char_dummy;
          int                           dummy;
          long                          long_dummy;
          long long                     long_long_dummy;
       };

#endif
