/*********************************/
/* Rule Set Based Access Control */
/* Author and (c) 1999: Amon Ott */
/* Data structures for Role      */
/* Compatibility module          */
/* Last modified: 29/Oct/99      */
/*********************************/


#ifndef __RSBAC_RC_DATA_STRUC_H
#define __RSBAC_RC_DATA_STRUC_H

#ifdef __KERNEL__   /* only include in kernel code */
#include <linux/types.h>
#include <rsbac/types.h>
#endif /* __KERNEL__ */

/* First of all we define dirname and filenames for saving the roles to disk. */
/* The path must be a valid single dir name! Each mounted device gets its    */
/* own file set, residing in 'DEVICE_ROOT/RSBAC_ACI_PATH/'.                  */
/* All user access to these files will be denied.                            */
/* Backups are kept in FILENAMEb.                                            */

#ifdef __KERNEL__
#define RSBAC_RC_ROLE_FILE_NAME "rc_role"
#define RSBAC_RC_TYPE_FILE_NAME "rc_type"
#endif /* __KERNEL__ */

/*
 * The following structures provide the role model data structures.
 * All RSBAC_RC_NR_ROLES roles and RSBAC_RC_NR_TYPES x target-no. types
 * and SCD-type definitions are kept in arrays and saved to disk as such.
 */

/***************************************
 *               Roles                 *
 ***************************************/

/* Caution: whenever role struct changes, version and old_version must be increased! */

#define RSBAC_RC_OLD_ROLE_VERSION 2
#define RSBAC_RC_ROLE_VERSION 3

struct rsbac_rc_role_entry_t            
    {
      rsbac_rc_role_vector_t role_comp;     /* roles we are compatible with
                                             * ( = we can change to) */
      rsbac_rc_role_vector_t admin_roles;   /* roles we may administrate (replaces admin_type) */
      rsbac_rc_role_vector_t assign_roles;   /* roles we may read and assign to users,
                                              * if they were in one of these before. */
      rsbac_rc_type_comp_array_t  type_comp_fd;  /* file/dir types we are compatible with
                                                  * ( = we can access ) */
      rsbac_rc_type_comp_array_t  type_comp_dev; /* dev types we are compatible with */
      rsbac_rc_type_comp_array_t  type_comp_process; /* process types we are compatible with */
      rsbac_rc_type_comp_array_t  type_comp_ipc; /* ipc types we are compatible with */
      rsbac_rc_type_comp_array_t  type_comp_scd; /* scd types we are compatible with */
      enum rsbac_rc_admin_type_t admin_type; /* role admin: none, system or role admin? */
      char                   name[RSBAC_RC_NAME_LEN];
      rsbac_rc_type_id_t     def_fd_create_type;
      rsbac_rc_type_id_t     def_process_create_type;
      rsbac_rc_type_id_t     def_process_chown_type;
      rsbac_rc_type_id_t     def_process_execute_type;
      rsbac_rc_type_id_t     def_ipc_create_type;
    };

#define RSBAC_RC_NR_ROLE_ENTRY_ITEMS 15
#define RSBAC_RC_ROLE_ENTRY_ITEM_LIST { \
      RI_role_comp, \
      RI_admin_roles, \
      RI_assign_roles, \
      RI_type_comp_fd, \
      RI_type_comp_dev, \
      RI_type_comp_process, \
      RI_type_comp_ipc, \
      RI_type_comp_scd, \
      RI_admin_type, \
      RI_name, \
      RI_def_fd_create_type, \
      RI_def_process_create_type, \
      RI_def_process_chown_type, \
      RI_def_process_execute_type, \
      RI_def_ipc_create_type \
      }

struct rsbac_rc_old_role_entry_t            
    {
      rsbac_rc_role_vector_t role_comp;     /* roles we are compatible with
                                             * ( = we can change to) */
      rsbac_rc_type_comp_array_t  type_comp_fd;  /* file/dir types we are compatible with
                                                  * ( = we can access ) */
      rsbac_rc_type_comp_array_t  type_comp_dev; /* dev types we are compatible with */
      rsbac_rc_type_comp_array_t  type_comp_process; /* process types we are compatible with */
      rsbac_rc_type_comp_array_t  type_comp_ipc; /* ipc types we are compatible with */
      rsbac_rc_type_comp_array_t  type_comp_scd; /* scd types we are compatible with */
      enum rsbac_rc_admin_type_t admin_type; /* role admin: none, system or role admin? */
      char                   name[RSBAC_RC_NAME_LEN];
      rsbac_rc_type_id_t     def_fd_create_type;
      rsbac_rc_type_id_t     def_process_create_type;
      rsbac_rc_type_id_t     def_process_chown_type;
      rsbac_rc_type_id_t     def_process_execute_type;
      rsbac_rc_type_id_t     def_ipc_create_type;
    };


#ifdef __KERNEL__

/* All roles are kept in a big array. */
typedef struct rsbac_rc_role_entry_t rsbac_rc_role_array_t[RSBAC_RC_NR_ROLES];

#endif /* __KERNEL__ */

/***************************************
 *             Type names              *
 ***************************************/

/* Caution: whenever role struct changes, version and old_version must be increased! */

/* #define RSBAC_RC_OLD_TYPE_VERSION 1 */
#define RSBAC_RC_TYPE_VERSION 1

struct rsbac_rc_type_entry_t            
    {
      char                   fd_name[RSBAC_RC_NAME_LEN];
      char                   dev_name[RSBAC_RC_NAME_LEN];
      char                   ipc_name[RSBAC_RC_NAME_LEN];
      char                   process_name[RSBAC_RC_NAME_LEN];
      __u8                   fd_need_secdel;  /* boolean */
    };

#define RSBAC_RC_NR_TYPE_ENTRY_ITEMS 5
#define RSBAC_RC_TYPE_ENTRY_ITEM_LIST { \
      RI_type_fd_name, \
      RI_type_dev_name, \
      RI_type_ipc_name, \
      RI_type_process_name, \
      RI_type_fd_need_secdel \
      }

#ifdef __KERNEL__

/* All types are kept in big arrays, one for each target. */
typedef struct rsbac_rc_type_entry_t rsbac_rc_type_array_t[RSBAC_RC_NR_TYPES];

#endif /* __KERNEL__ */

/**********************************************/
/*              Default values                */
/**********************************************/

#ifdef CONFIG_RSBAC_DEF_INHERIT
#define RSBAC_RC_GENERAL_ROLE_ENTRY \
    { \
      1 << RSBAC_RC_GENERAL_ROLE, /* role_comp with this  */ \
      0,                          /* admin_roles */ \
      0,                          /* assign_roles */ \
      {RSBAC_READ_WRITE_REQUEST_VECTOR & RSBAC_FD_REQUEST_VECTOR}, /* type_comp_fd with general */ \
      {RSBAC_READ_WRITE_REQUEST_VECTOR & RSBAC_DEV_REQUEST_VECTOR}, /* type_comp_dev with general */ \
      {RSBAC_READ_WRITE_REQUEST_VECTOR & RSBAC_PROCESS_REQUEST_VECTOR}, /* type_comp_process with general */ \
      {RSBAC_READ_WRITE_REQUEST_VECTOR & RSBAC_IPC_REQUEST_VECTOR}, /* type_comp_ipc with general */ \
      RSBAC_RC_GENERAL_COMP_SCD,  /* type_comp_scd with generally needed ones */ \
      RC_no_admin,                /* admin_type */ \
      "General User",             /* name */ \
      RC_type_inherit_parent,     /* def_fd_create_type */ \
      RC_type_inherit_parent,     /* def_process_create_type */ \
      RC_type_use_new_role_def_create, /* def_process_chown_type */ \
      RC_type_inherit_process,    /* def_process_execute_type */ \
      RSBAC_RC_GENERAL_TYPE       /* def_ipc_create_type */ \
    }
#else
#define RSBAC_RC_GENERAL_ROLE_ENTRY \
    { \
      1 << RSBAC_RC_GENERAL_ROLE, /* role_comp with this  */ \
      0,                          /* admin_roles */ \
      0,                          /* assign_roles */ \
      {RSBAC_READ_WRITE_REQUEST_VECTOR & RSBAC_FD_REQUEST_VECTOR}, /* type_comp_fd with general */ \
      {RSBAC_READ_WRITE_REQUEST_VECTOR & RSBAC_DEV_REQUEST_VECTOR}, /* type_comp_dev with general */ \
      {RSBAC_READ_WRITE_REQUEST_VECTOR & RSBAC_PROCESS_REQUEST_VECTOR}, /* type_comp_process with general */ \
      {RSBAC_READ_WRITE_REQUEST_VECTOR & RSBAC_IPC_REQUEST_VECTOR}, /* type_comp_ipc with general */ \
      RSBAC_RC_GENERAL_COMP_SCD,  /* type_comp_scd with generally needed ones */ \
      RC_no_admin,                /* admin_type */ \
      "General User",             /* name */ \
      RSBAC_RC_GENERAL_TYPE,      /* def_fd_create_type */ \
      RC_type_inherit_parent,     /* def_process_create_type */ \
      RC_type_use_new_role_def_create, /* def_process_chown_type */ \
      RC_type_inherit_process,    /* def_process_execute_type */ \
      RSBAC_RC_GENERAL_TYPE       /* def_ipc_create_type */ \
    }
#endif

#ifdef CONFIG_RSBAC_DEF_INHERIT
#define RSBAC_RC_ROLE_ADMIN_ROLE_ENTRY \
    { \
      (1 << RSBAC_RC_GENERAL_ROLE) | (1 << RSBAC_RC_ROLE_ADMIN_ROLE), \
                                  /* role_comp with general and this  */ \
      RSBAC_RC_ALL_ROLE_VECTOR,   /* admin_roles */ \
      RSBAC_RC_ALL_ROLE_VECTOR,   /* assign_roles */ \
      {(RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SECURITY_REQUEST_VECTOR) & RSBAC_FD_REQUEST_VECTOR,  /* type_comp_fd with general */ \
       (RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SECURITY_REQUEST_VECTOR) & RSBAC_FD_REQUEST_VECTOR,  /* type_comp_fd with security */ \
       RSBAC_READ_REQUEST_VECTOR & RSBAC_FD_REQUEST_VECTOR},                                       /* type_comp_fd with system */ \
      {(RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SECURITY_REQUEST_VECTOR) & RSBAC_DEV_REQUEST_VECTOR,  /* type_comp_dev with general */ \
       (RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SECURITY_REQUEST_VECTOR) & RSBAC_DEV_REQUEST_VECTOR}, /* type_comp_dev with security */ \
      {(RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SECURITY_REQUEST_VECTOR) & RSBAC_PROCESS_REQUEST_VECTOR,  /* type_comp_process with general */ \
       (RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SECURITY_REQUEST_VECTOR) & RSBAC_PROCESS_REQUEST_VECTOR}, /* type_comp_process with security */ \
      {(RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SECURITY_REQUEST_VECTOR) & RSBAC_IPC_REQUEST_VECTOR,  /* type_comp_ipc with general */ \
       (RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SECURITY_REQUEST_VECTOR) & RSBAC_IPC_REQUEST_VECTOR}, /* type_comp_ipc with security */ \
      RSBAC_RC_ROLEADM_COMP_SCD,  /* type_comp_scd, what secoff/role_admin needs */ \
      RC_role_admin,              /* admin_type */ \
      "Role Admin",               /* name */ \
      RC_type_inherit_parent,     /* def_fd_create_type */ \
      RC_type_inherit_parent,     /* def_process_create_type */ \
      RC_type_use_new_role_def_create, /* def_process_chown_type */ \
      RC_type_inherit_process,    /* def_process_execute_type */ \
      RSBAC_RC_GENERAL_TYPE       /* def_ipc_create_type */ \
    }
#else
#define RSBAC_RC_ROLE_ADMIN_ROLE_ENTRY \
    { \
      (1 << RSBAC_RC_GENERAL_ROLE) | (1 << RSBAC_RC_ROLE_ADMIN_ROLE), \
                                  /* role_comp with general and this  */ \
      RSBAC_RC_ALL_ROLE_VECTOR,   /* admin_roles */ \
      RSBAC_RC_ALL_ROLE_VECTOR,   /* assign_roles */ \
      {(RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SECURITY_REQUEST_VECTOR) & RSBAC_FD_REQUEST_VECTOR,  /* type_comp_fd with general */ \
       (RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SECURITY_REQUEST_VECTOR) & RSBAC_FD_REQUEST_VECTOR,  /* type_comp_fd with security */ \
       RSBAC_READ_REQUEST_VECTOR & RSBAC_FD_REQUEST_VECTOR},                                       /* type_comp_fd with system */ \
      {(RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SECURITY_REQUEST_VECTOR) & RSBAC_DEV_REQUEST_VECTOR,  /* type_comp_dev with general */ \
       (RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SECURITY_REQUEST_VECTOR) & RSBAC_DEV_REQUEST_VECTOR}, /* type_comp_dev with security */ \
      {(RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SECURITY_REQUEST_VECTOR) & RSBAC_PROCESS_REQUEST_VECTOR,  /* type_comp_process with general */ \
       (RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SECURITY_REQUEST_VECTOR) & RSBAC_PROCESS_REQUEST_VECTOR}, /* type_comp_process with security */ \
      {(RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SECURITY_REQUEST_VECTOR) & RSBAC_IPC_REQUEST_VECTOR,  /* type_comp_ipc with general */ \
       (RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SECURITY_REQUEST_VECTOR) & RSBAC_IPC_REQUEST_VECTOR}, /* type_comp_ipc with security */ \
      RSBAC_RC_ROLEADM_COMP_SCD,  /* type_comp_scd, what secoff/role_admin needs */ \
      RC_role_admin,              /* admin_type */ \
      "Role Admin",               /* name */ \
      RSBAC_RC_GENERAL_TYPE,      /* def_fd_create_type */ \
      RC_type_inherit_parent,     /* def_process_create_type */ \
      RC_type_use_new_role_def_create, /* def_process_chown_type */ \
      RC_type_inherit_process,    /* def_process_execute_type */ \
      RSBAC_RC_GENERAL_TYPE       /* def_ipc_create_type */ \
    }
#endif

#ifdef CONFIG_RSBAC_DEF_INHERIT
#define RSBAC_RC_SYSTEM_ADMIN_ROLE_ENTRY \
    { \
      (1 << RSBAC_RC_GENERAL_ROLE) | (1 << RSBAC_RC_SYSTEM_ADMIN_ROLE), \
                                  /* role_comp with general and this  */ \
      0,                          /* admin_roles */ \
      0,                          /* assign_roles */ \
      {(RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SYSTEM_REQUEST_VECTOR) & RSBAC_FD_REQUEST_VECTOR,  /* type_comp_fd with general */ \
       0,                                                              /* type_comp_fd with security */ \
       (RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SYSTEM_REQUEST_VECTOR) & RSBAC_FD_REQUEST_VECTOR}, /* type_comp_fd with system */ \
      {(RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SYSTEM_REQUEST_VECTOR) & RSBAC_DEV_REQUEST_VECTOR,  /* type_comp_dev with general */ \
       0,                                                              /* type_comp_dev with security */ \
       (RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SYSTEM_REQUEST_VECTOR) & RSBAC_DEV_REQUEST_VECTOR}, /* type_comp_dev with system */ \
      {(RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SYSTEM_REQUEST_VECTOR) & RSBAC_PROCESS_REQUEST_VECTOR,  /* type_comp_process with general */ \
       0,                                                              /* type_comp_process with security */ \
       (RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SYSTEM_REQUEST_VECTOR) & RSBAC_PROCESS_REQUEST_VECTOR}, /* type_comp_process with system */ \
      {(RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SYSTEM_REQUEST_VECTOR) & RSBAC_IPC_REQUEST_VECTOR,  /* type_comp_ipc with general */ \
       0,                                                              /* type_comp_ipc with security */ \
       (RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SYSTEM_REQUEST_VECTOR) & RSBAC_IPC_REQUEST_VECTOR}, /* type_comp_ipc with system */ \
      RSBAC_RC_SYSADM_COMP_SCD,   /* type_comp_scd, what system_admin needs */ \
      RC_system_admin,            /* admin_type */ \
      "System Admin",             /* name */ \
      RC_type_inherit_parent,     /* def_fd_create_type */ \
      RC_type_inherit_parent,     /* def_process_create_type */ \
      RC_type_use_new_role_def_create, /* def_process_chown_type */ \
      RC_type_inherit_process,    /* def_process_execute_type */ \
      RSBAC_RC_GENERAL_TYPE       /* def_ipc_create_type */ \
    }
#else
#define RSBAC_RC_SYSTEM_ADMIN_ROLE_ENTRY \
    { \
      (1 << RSBAC_RC_GENERAL_ROLE) | (1 << RSBAC_RC_SYSTEM_ADMIN_ROLE), \
                                  /* role_comp with general and this  */ \
      0,                          /* admin_roles */ \
      0,                          /* assign_roles */ \
      {(RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SYSTEM_REQUEST_VECTOR) & RSBAC_FD_REQUEST_VECTOR,  /* type_comp_fd with general */ \
       0,                                                              /* type_comp_fd with security */ \
       (RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SYSTEM_REQUEST_VECTOR) & RSBAC_FD_REQUEST_VECTOR}, /* type_comp_fd with system */ \
      {(RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SYSTEM_REQUEST_VECTOR) & RSBAC_DEV_REQUEST_VECTOR,  /* type_comp_dev with general */ \
       0,                                                              /* type_comp_dev with security */ \
       (RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SYSTEM_REQUEST_VECTOR) & RSBAC_DEV_REQUEST_VECTOR}, /* type_comp_dev with system */ \
      {(RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SYSTEM_REQUEST_VECTOR) & RSBAC_PROCESS_REQUEST_VECTOR,  /* type_comp_process with general */ \
       0,                                                              /* type_comp_process with security */ \
       (RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SYSTEM_REQUEST_VECTOR) & RSBAC_PROCESS_REQUEST_VECTOR}, /* type_comp_process with system */ \
      {(RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SYSTEM_REQUEST_VECTOR) & RSBAC_IPC_REQUEST_VECTOR,  /* type_comp_ipc with general */ \
       0,                                                              /* type_comp_ipc with security */ \
       (RSBAC_READ_WRITE_REQUEST_VECTOR | RSBAC_SYSTEM_REQUEST_VECTOR) & RSBAC_IPC_REQUEST_VECTOR}, /* type_comp_ipc with system */ \
      RSBAC_RC_SYSADM_COMP_SCD,   /* type_comp_scd, what system_admin needs */ \
      RC_system_admin,            /* admin_type */ \
      "System Admin",             /* name */ \
      RSBAC_RC_GENERAL_TYPE,      /* def_fd_create_type */ \
      RC_type_inherit_parent,     /* def_process_create_type */ \
      RC_type_use_new_role_def_create, /* def_process_chown_type */ \
      RC_type_inherit_process,    /* def_process_execute_type */ \
      RSBAC_RC_GENERAL_TYPE       /* def_ipc_create_type */ \
    }
#endif


#define RSBAC_RC_GENERAL_TYPE_ENTRY \
    { \
      "General FD",          /* fd_name */ \
      "General Device",      /* dev_name */ \
      "General IPC",         /* ipc_name */ \
      "General Process",     /* process_name */ \
      FALSE                  /* need_secdel */ \
    }

#define RSBAC_RC_SECURITY_TYPE_ENTRY \
    { \
      "Security FD",         /* fd_name */ \
      "Security Device",     /* dev_name */ \
      "Security IPC",        /* ipc_name */ \
      "Security Proces",     /* process_name */ \
      FALSE                  /* need_secdel */ \
    }

#define RSBAC_RC_SYSTEM_TYPE_ENTRY \
    { \
      "System FD",           /* fd_name */ \
      "System Device",       /* dev_name */ \
      "System IPC",          /* ipc_name */ \
      "System Process",      /* process_name */ \
      FALSE                  /* need_secdel */ \
    }

/**********************************************/
/*              Declarations                  */
/**********************************************/

#ifdef __KERNEL__
#endif /* __KERNEL__ */

#endif /* __RSBAC_RC_DATA_STRUC_H */
