/*********************************** */
/* Rule Set Based Access Control     */
/* Author and (c)1999,2000:          */
/* Amon Ott <ao@compuniverse.com>    */
/* API: Data types for attributes    */
/*      and standard module calls    */
/* Last modified: 10/Nov/2000        */
/*********************************** */

#ifndef __RSBAC_TYPES_H
#define __RSBAC_TYPES_H

#define RSBAC_VERSION "v1.1.0"

#include <linux/types.h>

#ifdef __KERNEL__
#include <linux/fs.h>
#include <linux/socket.h>
#include <linux/pipe_fs_i.h>
#include <linux/kdev_t.h>

/* version checks */
#ifndef LINUX_VERSION_CODE
#include <linux/version.h>
#endif
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,2,0)
#error "RSBAC: unsupported kernel version"
#endif

#endif

/* General */

#ifndef NULL
#define NULL ((void *) 0)
#endif

#ifndef	min
#define min(a,b) (((a)<(b))?(a):(b))
#endif
#ifndef	max
#define max(a,b) (((a)>(b))?(a):(b))
#endif

#define RSBAC_OLD_NO_USER 65533
#define RSBAC_OLD_ALL_USERS 65532
#define RSBAC_NO_USER ((rsbac_uid_t) -3)
#define RSBAC_ALL_USERS ((rsbac_uid_t) -4)

#ifndef __cplusplus
#if defined(FALSE) || defined(TRUE) || defined(boolean)
#ifndef boolean
typedef int boolean;
#endif
#ifndef FALSE
#define FALSE 0
#endif
#ifndef TRUE
#define TRUE 1
#endif
#else
typedef enum {FALSE, TRUE} boolean;
#endif
#else
typedef bool boolean;
#endif

#define RSBAC_SEC_DEL_CHUNK_SIZE 4096

/* These data structures work parallel to the Linux data structures, */
/* so all data for RSBAC decisions is maintained seperately.         */
/* Any change to RSBAC data will NOT modify any other linux data,    */
/* e.g. userlists, process lists or inodes.                          */

/* The first enum member is treated as default value.                */

typedef __u32 rsbac_version_t;
typedef __u32 rsbac_uid_t;                   /* Same as user in Linux kernel */
typedef __u32 rsbac_gid_t;                   /* Same as group in Linux kernel */
typedef __u16 rsbac_old_uid_t;               /* Same as user in Linux kernel */
typedef __u16 rsbac_old_gid_t;               /* Same as group in Linux kernel */
#define RSBAC_SYSADM_UID 0
#define RSBAC_BIN_UID 1
#define RSBAC_SECOFF_UID 400
#define RSBAC_DATAPROT_UID 401

typedef __u32 rsbac_pseudo_t;               /* For Pseudonymic Logging */
typedef pid_t rsbac_pid_t;                   /* Same as pid in Linux  */
typedef __u8 rsbac_security_level_t;
#define SL_max            252
#define SL_rsbac_internal 253
#define SL_inherit        254
#define SL_none           255
enum    rsbac_old_security_level_t {SL_unclassified, SL_confidential, SL_secret,
                                    SL_top_secret, SL_old_rsbac_internal,
                                    SL_old_inherit, SL_old_none};
                                             /* MAC security levels   */
typedef __u64 rsbac_mac_category_vector_t;   /* MAC category sets */
#define RSBAC_MAC_GENERAL_CATEGORY 0
#define RSBAC_MAC_DEF_CAT_VECTOR ((rsbac_mac_category_vector_t) 1)
  /* 1 << GENERAL_CAT */
#define RSBAC_MAC_MAX_CAT_VECTOR ((rsbac_mac_category_vector_t) -1)
  /* all bits set */
#define RSBAC_MAC_MIN_CAT_VECTOR ((rsbac_mac_category_vector_t) 0)
  /* no bits set */
#define RSBAC_MAC_INHERIT_CAT_VECTOR ((rsbac_mac_category_vector_t) 0)
  /* for fd: no bits set */
#define RSBAC_MAC_NR_CATS 64
#define RSBAC_MAC_MAX_CAT 63

typedef u_int rsbac_cwi_relation_id_t;

enum    rsbac_system_role_t {SR_user, SR_security_officer, SR_administrator,
                             SR_inherit};
                                             /* For FC, SIM and (MAC) */
enum    rsbac_integrity_role_t {IR_none, IR_TP_user, IR_TP_manager,
                                IR_IVP_user, IR_inherit};
                                             /* For CWI */
enum    rsbac_process_type_t {PT_none, PT_TP, PT_IVP, PT_TPICD};
                                             /* For CWI */
enum    rsbac_object_category_t {OC_general, OC_security, OC_system,
                                 OC_inherit, OC_none};
                                             /* For FC  */
typedef enum rsbac_process_type_t rsbac_program_type_t;
                                             /* For CWI */
enum    rsbac_data_type_t {DT_none, DT_CDI, DT_CDIIC, DT_SI,
                           DT_inherit};
                                             /* For CWI and SIM */
enum    rsbac_scd_type_t {ST_time_strucs, ST_clock, ST_host_id,
                          ST_net_id, ST_ioports, ST_rlimit,
                          ST_swap, ST_syslog, ST_rsbac, ST_rsbaclog,
                          ST_other, ST_kmem, ST_none};
                                             /* For all models */
enum    rsbac_dev_type_t {D_block, D_char, D_none};


enum    rsbac_ipc_type_t {I_sem, I_msg, I_shm, I_sock, I_sockid, I_fifo, I_none};
union   rsbac_ipc_id_t
  {
    u_long id_nr;
#ifdef __KERNEL__
    struct sock * sock;
           char * fifo;
#endif
  };

typedef __u32 rsbac_inode_nr_t;

#ifdef __KERNEL__
/* We need unique identifiers for each file/dir. inode means inode in */
/* the file system.                                                   */
struct rsbac_fs_file_t
    {
      kdev_t               device;
      rsbac_inode_nr_t     inode;
      struct dentry      * dentry_p;  /* used for inheritance recursion */
    };

/* We need unique ids for dev objects */
struct rsbac_dev_t
    {
      enum  rsbac_dev_type_t     type;
            kdev_t               id;
    };
#else /* we need a dummy as big as fs_file_t for union target_id */
struct rsbac_dummy_fs_t
    {
      struct {u_short major,minor;} device;
      rsbac_inode_nr_t              inode;
      void                        * dentry_p;
    };
#endif /* __KERNEL */

/* And we need unique ids for ipc objects */
struct rsbac_ipc_t
    {
      enum  rsbac_ipc_type_t     type;
      union rsbac_ipc_id_t       id;
    };

/* log levels: nothing, denied requests only, all, refer to request log level */
enum    rsbac_log_level_t {LL_none, LL_denied, LL_full, LL_request, LL_invalid};
typedef __u64 rsbac_log_array_t;

/* request bitvectors */
typedef __u64 rsbac_request_vector_t;

/* The max length of each filename is kept in a macro */
#define RSBAC_MAXNAMELEN     256

/* PM */

#include <rsbac/pm_types.h>

/* MS */

typedef __u32 rsbac_ms_scanned_t;            /* For MS               */
#define MS_unscanned 0
#define MS_rejected 1
#define MS_active_rejected 2

struct ms_segment_t
  {
    int len;
    char * ubuf;
    enum {MP_TCP,MP_UDP} prot;
  };

enum    rsbac_ms_trusted_t {MT_not_trusted, MT_read, MT_full, MT_none};
enum    rsbac_ms_sock_trusted_t {MS_not_trusted, MS_active, MS_full, MS_none};

/* FF */

typedef __u8 rsbac_ff_flags_t;
#define FF_read_only       1
#define FF_execute_only    2
#define FF_search_only     4
#define FF_write_only      8
#define FF_secure_delete  16
#define FF_no_execute     32
#define FF_add_inherited 128

/***** RC *****/

#include <rsbac/rc_types.h>

/**** AUTH ****/
/* special cap value, replaced by process owner at execute time */
#define RSBAC_AUTH_OLD_OWNER_F_CAP (rsbac_old_uid_t) -3
#define RSBAC_AUTH_OWNER_F_CAP (rsbac_uid_t) -3
typedef rsbac_pid_t            rsbac_auth_p_cap_set_id_t;
typedef struct rsbac_fs_file_t rsbac_auth_file_t;
typedef __u32                  rsbac_auth_f_cap_set_id_t;

/**** ACL ****/
/* include at end of types.h */

/****************************************************************************/
/* ADF types                                                                */
/****************************************************************************/

#define RSBAC_ADF_REQUEST_ARRAY_VERSION 1

enum  rsbac_adf_request_t {
                        R_ADD_TO_KERNEL,
                        R_ALTER,
                        R_APPEND_OPEN,
                        R_CHANGE_GROUP,
                        R_CHANGE_OWNER,
                        R_CHDIR,
                        R_CLONE,
                        R_CLOSE,
                        R_CREATE,
                        R_DELETE,
                        R_EXECUTE,
                        R_GET_PERMISSIONS_DATA,
                        R_GET_STATUS_DATA,
                        R_LINK_HARD,
                        R_MODIFY_ACCESS_DATA,
                        R_MODIFY_ATTRIBUTE,
                        R_MODIFY_PERMISSIONS_DATA,
                        R_MODIFY_SYSTEM_DATA,
                        R_MOUNT,
                        R_READ,
                        R_READ_ATTRIBUTE,
                        R_READ_WRITE_OPEN,
                        R_READ_OPEN,
                        R_REMOVE_FROM_KERNEL,
                        R_RENAME,
                        R_SEARCH,
                        R_SEND_SIGNAL,
                        R_SHUTDOWN,
                        R_SWITCH_LOG,
                        R_SWITCH_MODULE,
                        R_TERMINATE,
                        R_TRACE,
                        R_TRUNCATE,
                        R_UMOUNT,
                        R_WRITE,
                        R_WRITE_OPEN,
                        R_NONE
                      };

#include <rsbac/request_groups.h>

/* This type is returned from the rsbac_adf_request() function. Since a */
/* decision of undefined means an error, it is never returned.          */

enum  rsbac_adf_req_ret_t {NOT_GRANTED,GRANTED,DO_NOT_CARE,UNDEFINED};

/****************************************************************************/
/* ACI types                                                                */
/****************************************************************************/

/* For switching adf-modules */
enum  rsbac_switch_target_t {MAC,FC,SIM,PM,MS,FF,RC,AUTH,REG,ACL,SW_NONE};

/****************************************************************************/
/* For objects, users and processes all manipulation is encapsulated by the */
/* function calls rsbac_set_attr, rsbac_get_attr and rsbac_remove_target.   */

/* For those, we declare some extra types to specify target and attribute.  */

enum   rsbac_target_t {T_FILE, T_DIR, T_DEV, T_IPC, T_SCD, T_USER, T_PROCESS,
#ifndef __KERNEL__
                       T_FD,
#endif
                       T_NONE};

union  rsbac_target_id_t
       {
#ifdef __KERNEL__
          struct rsbac_fs_file_t   file;
          struct rsbac_fs_file_t   dir;
          struct rsbac_dev_t       dev;
#else
          struct rsbac_dummy_fs_t  dummy_fs;
#endif
          struct rsbac_ipc_t       ipc;
          enum rsbac_scd_type_t    scd;
          rsbac_uid_t              user;
          rsbac_pid_t              process;
          int                      dummy;
       };

enum   rsbac_attribute_t
  {
    A_owner,
    A_pseudo,
    A_security_level,
    A_mac_categories,
    A_object_category,
    A_data_type,
    A_system_role,
    A_current_sec_level,
    A_mac_curr_categories,
    A_min_write_open,
    A_min_write_categories,
    A_max_read_open,
    A_max_read_categories,
    A_mac_auto,
    A_mac_trusted,
    A_mac_trusted_for_user,
    A_mac_check,
    A_pm_role,
    A_pm_process_type,
    A_pm_current_task,
    A_pm_object_class,
    A_pm_ipc_purpose,
    A_pm_object_type,
    A_pm_program_type,
    A_pm_tp,
    A_pm_task_set,
    A_ms_scanned,
    A_ms_trusted,
    A_ms_backbuf,
    A_ms_buflen,
    A_ms_str_nr,
    A_ms_str_offset,
    A_ms_sock_trusted_tcp,
    A_ms_sock_trusted_udp,
    A_ff_flags,
    A_rc_type,
    A_rc_type_fd,
    A_rc_force_role,
    A_rc_role,
    A_rc_def_role,
    A_auth_may_setuid,
    A_auth_may_set_cap,
    A_log_array_low,
    A_log_array_high,
    A_log_program_based,
    A_log_user_based,
#ifdef __KERNEL__
    /* adf-request helpers */
    A_group,
    A_sockaddr_p,
    A_signal,
    A_mode,
    A_nlink,
    A_switch_target,
    A_mod_name,
    A_request,
    A_ms_segment,
    A_trace_request,
    A_auth_add_f_cap,
    A_auth_remove_f_cap,
    A_auth_get_caplist,
    A_prot_bits,
#endif
    A_none};

#include <rsbac/ms_strings.h>

union  rsbac_attribute_value_t
  {
         rsbac_uid_t                 owner;           /* process owner */
         rsbac_pseudo_t              pseudo;
         rsbac_security_level_t      security_level;
         rsbac_mac_category_vector_t mac_categories;
    enum rsbac_object_category_t     object_category;
    enum rsbac_data_type_t           data_type;
    enum rsbac_system_role_t         system_role;
         rsbac_security_level_t      current_sec_level;
         rsbac_security_level_t      min_write_open;
         rsbac_security_level_t      max_read_open;
         boolean                     mac_auto;
         boolean                     mac_trusted;
         rsbac_uid_t                 mac_trusted_for_user;
         boolean                     mac_check;
    enum rsbac_pm_role_t             pm_role;
    enum rsbac_pm_process_type_t     pm_process_type;
         rsbac_pm_task_id_t          pm_current_task;
         rsbac_pm_object_class_id_t  pm_object_class;
         rsbac_pm_purpose_id_t       pm_ipc_purpose;
    enum rsbac_pm_object_type_t      pm_object_type;
         rsbac_pm_program_type_t     pm_program_type;
         rsbac_pm_tp_id_t            pm_tp;
         rsbac_pm_task_set_id_t      pm_task_set;
         rsbac_ms_scanned_t          ms_scanned;
    enum rsbac_ms_trusted_t          ms_trusted;
         char                      * ms_backbuf;
         int                         ms_buflen;
         int                         ms_str_nr[RSBAC_MS_NR_MALWARE];
         int                         ms_str_offset[RSBAC_MS_NR_MALWARE];
    enum rsbac_ms_sock_trusted_t     ms_sock_trusted_tcp;
    enum rsbac_ms_sock_trusted_t     ms_sock_trusted_udp;
         rsbac_ff_flags_t            ff_flags;
         rsbac_rc_type_id_t          rc_type;
         rsbac_rc_type_id_t          rc_type_fd;
         rsbac_rc_role_id_t          rc_force_role;
         rsbac_rc_role_id_t          rc_role;
         rsbac_rc_role_id_t          rc_def_role;
         boolean                     auth_may_setuid;
         boolean                     auth_may_set_cap;
         rsbac_auth_p_cap_set_id_t   auth_p_capset;
         rsbac_auth_f_cap_set_id_t   auth_f_capset;
         rsbac_log_array_t           log_array_low;
         rsbac_log_array_t           log_array_high;
         rsbac_request_vector_t      log_program_based;
         rsbac_request_vector_t      log_user_based;
#ifdef __KERNEL__
         rsbac_gid_t                 group;        /* process/fd group */
    struct sockaddr                * sockaddr_p; /* socket-ipc address */
         long                        signal;        /* signal for kill */
         int                         mode;    /* mode for create/mount */
         int                         nlink;       /* for DELETE/unlink */
    enum rsbac_switch_target_t       switch_target; /* for SWITCH_MODULE */
         char                      * mod_name;    /* for ADD_TO_KERNEL */
    enum rsbac_adf_request_t         request;        /* for SWITCH_LOG */
         struct ms_segment_t         ms_segment;
         long                        trace_request; /* request for sys_trace */
         rsbac_uid_t                 auth_cap;
    	 int                         prot_bits;/* prot bits for mmap()/mprotect() */
#endif
         u_char                      u_char_dummy;
         int                         dummy;
         u_int                       u_dummy;
         long                        long_dummy;
         u_long                      u_long_dummy;
       };


/**** ACL ****/

#include <rsbac/acl_types.h>

#endif
