libsmack  1.3.0
smack.h File Reference
#include <sys/types.h>

Go to the source code of this file.

Macros

#define SMACK_LABEL_LEN   255
 

Functions

int smack_accesses_new (struct smack_accesses **handle)
 
void smack_accesses_free (struct smack_accesses *handle)
 
int smack_accesses_save (struct smack_accesses *handle, int fd)
 
int smack_accesses_apply (struct smack_accesses *handle)
 
int smack_accesses_clear (struct smack_accesses *handle)
 
int smack_accesses_add (struct smack_accesses *handle, const char *subject, const char *object, const char *access_type)
 
int smack_accesses_add_modify (struct smack_accesses *handle, const char *subject, const char *object, const char *allow_access_type, const char *deny_access_type)
 
int smack_accesses_add_from_file (struct smack_accesses *handle, int fd)
 
int smack_have_access (const char *subject, const char *object, const char *access_type)
 
int smack_cipso_new (struct smack_cipso **handle)
 
void smack_cipso_free (struct smack_cipso *handle)
 
int smack_cipso_apply (struct smack_cipso *handle)
 
int smack_cipso_add_from_file (struct smack_cipso *handle, int fd)
 
const char * smack_smackfs_path (void)
 
ssize_t smack_new_label_from_self (char **label)
 
ssize_t smack_new_label_from_process (pid_t pid, char **label)
 
ssize_t smack_new_label_from_socket (int fd, char **label)
 
ssize_t smack_new_label_from_path (const char *path, const char *xattr, int follow, char **label)
 
ssize_t smack_new_label_from_file (int fd, const char *xattr, char **label)
 
int smack_set_label_for_path (const char *path, const char *xattr, int follow, const char *label)
 
int smack_set_label_for_file (int fd, const char *xattr, const char *label)
 
int smack_remove_label_for_path (const char *path, const char *xattr, int follow)
 
int smack_remove_label_for_file (int fd, const char *xattr)
 
int smack_set_label_for_self (const char *label)
 
int smack_revoke_subject (const char *subject)
 
ssize_t smack_label_length (const char *label)
 
int smack_load_policy (void)
 
int smack_set_relabel_self (const char **labels, int cnt)
 
int smack_set_onlycap (const char **labels, int cnt)
 
int smack_set_onlycap_from_file (int fd)
 

Macro Definition Documentation

#define SMACK_LABEL_LEN   255

Smack user space library

Maximum length of a smack label, excluding terminating null character.

Function Documentation

int smack_accesses_add ( struct smack_accesses *  handle,
const char *  subject,
const char *  object,
const char *  access_type 
)

Add a new rule to the given access rules.

Parameters
handlehandle to a struct smack_accesses instance
subjectsubject of the rule
objectobject of the rule
access_typeaccess type
Returns
Returns 0 on success and negative on failure.
int smack_accesses_add_from_file ( struct smack_accesses *  handle,
int  fd 
)

Load access rules from the given file.

Parameters
handlehandle to a struct smack_accesses instance
fdfile descriptor
Returns
Returns 0 on success and negative on failure.
int smack_accesses_add_modify ( struct smack_accesses *  handle,
const char *  subject,
const char *  object,
const char *  allow_access_type,
const char *  deny_access_type 
)

Add a modification rule to the given access rules. A modification rule is written to the kernel file 'change-rule' when you apply rules with smack_accesses_apply(). It can be used to turn on and off a certain access type like write access.

When a modification rule is applied to the kernel it will turn on access types in allow_access and turn off access types in deny_access.

Parameters
handlehandle to a struct smack_accesses instance
subjectsubject of the rule
objectobject of the rule
allow_access_typeaccess type to be turned on
deny_access_typeaccess type to be turned off
Returns
Returns 0 on success and negative on failure.
int smack_accesses_apply ( struct smack_accesses *  handle)

Apply access rules to the kernel. Rules are applied in the order that they were added.

Parameters
handlehandle to a struct smack_accesses instance
Returns
Returns 0 on success and negative on failure.
int smack_accesses_clear ( struct smack_accesses *  handle)

Clear access rules from the kernel. Clears the rules by writing corresponding rules with zero access. Note that this function does not check whether the rules pre-exist or not.

Parameters
handlehandle to a struct smack_accesses instance
Returns
Returns 0 on success and negative on failure.
void smack_accesses_free ( struct smack_accesses *  handle)

Destroys a struct smack_accesses instance.

Parameters
handlehandle to a struct smack_accesses instance
int smack_accesses_new ( struct smack_accesses **  handle)

Allocates memory for a new empty smack_accesses instance. The returned instance must be later freed with smack_accesses_free().

Parameters
handleoutput variable for the struct smack_accesses instance
Returns
Returns 0 on success and negative on failure. If the operation is succesful 'accesses' variable will contain a valid pointer.
int smack_accesses_save ( struct smack_accesses *  handle,
int  fd 
)

Write access rules to a given file.

Parameters
handlehandle to a struct smack_accesses instance
fdfile descriptor to the open file
Returns
Returns 0 on success and negative on failure.
int smack_cipso_add_from_file ( struct smack_cipso *  handle,
int  fd 
)

Add CIPSO rules from the given file.

Parameters
handlehandle to a struct smack_cipso instance
fdfile descriptor
Returns
Returns 0 on success and negative on failure.
int smack_cipso_apply ( struct smack_cipso *  handle)

Apply CIPSO rules to the kernel.

Parameters
handlehandle to a struct smack_cipso instance
Returns
Returns 0 on success and negative on failure.
void smack_cipso_free ( struct smack_cipso *  handle)

Destroys a struct smack_cipso instance.

Parameters
handlehandle to a struct smack_cipso instance
int smack_cipso_new ( struct smack_cipso **  handle)

Allocates memory for a new empty smack_cipso instance. The returned instance must be later freed with smack_cipso_free().

Parameters
handleoutput variable for the struct smack_cipso instance
Returns
Returns 0 on success and negative on failure. If the operation is succesful 'cipso' variable will contain a valid pointer.
int smack_have_access ( const char *  subject,
const char *  object,
const char *  access_type 
)

Check whether SMACK allows access for given subject, object and requested access.

Parameters
subjectsubject of the rule
objectobject of the rule
access_typerequested access type
Returns
Returns 1 if access is allowed, 0 if access is not allowed and negative on error.
ssize_t smack_label_length ( const char *  label)

Validate a SMACK label and calculate its length.

Parameters
labellabel to verify
Returns
Returns length of the label on success and negative on failure.
int smack_load_policy ( void  )

Perform the initial policy load. This function loads the Smack policy from default location and loads it to kernel. Smackfs file system must be alreadt mounted. It is designed for init process to load the policy at system startup. It also sets up CIPSO and onlycap list of labels.

Returns
Returns 0 on success and negative on failure.
ssize_t smack_new_label_from_file ( int  fd,
const char *  xattr,
char **  label 
)

Get the SMACK label that is contained in an extended attribute. Caller is responsible of freeing the returned label.

Parameters
fdopened file descriptor of the file
xattrthe extended attribute containing the SMACK label
labeloutput variable for the returned label
Returns
Returns length of the label on success and negative value on failure.
ssize_t smack_new_label_from_path ( const char *  path,
const char *  xattr,
int  follow,
char **  label 
)

Get the SMACK label that is contained in an extended attribute. Caller is responsible of freeing the returned label.

Parameters
pathpath of the file
xattrthe extended attribute containing the SMACK label
followwhether or not to follow symbolic link
labeloutput variable for the returned label
Returns
Returns length of the label on success and negative value on failure.
ssize_t smack_new_label_from_process ( pid_t  pid,
char **  label 
)

Get the label that is associated with the given process. Caller is responsible of freeing the returned label.

Parameters
pidprocess descriptor to get the label for
labeloutput variable for the label
Returns
Returns length of the label on success and negative value on failure.
ssize_t smack_new_label_from_self ( char **  label)

Get the label that is associated with the callers process. Caller is responsible of freeing the returned label.

Parameters
labeloutput variable for the label
Returns
Returns length of the label on success and negative value on failure.
ssize_t smack_new_label_from_socket ( int  fd,
char **  label 
)

Get the label that is associated with a peer on the other end of a UDS socket (SO_PEERSEC). Caller is responsible of freeing the returned label.

Parameters
fdfile descriptor of the socket
labeloutput variable for the label
Returns
Returns length of the label on success and negative value on failure.
int smack_remove_label_for_file ( int  fd,
const char *  xattr 
)

Remove the SMACK label in an extended attribute.

Parameters
fdopened file descriptor of the file
xattrthe extended attribute containing the SMACK label
Returns
Returns 0 on success and negative on failure.
int smack_remove_label_for_path ( const char *  path,
const char *  xattr,
int  follow 
)

Remove the SMACK label in an extended attribute.

Parameters
pathpath of the file
xattrthe extended attribute containing the SMACK label
followwhether or not to follow symbolic link
Returns
Returns 0 on success and negative on failure.
int smack_revoke_subject ( const char *  subject)

Revoke all rules for the given subject label.

Parameters
subjectsubject to revoke
Returns
Returns 0 on success and negative on failure.
int smack_set_label_for_file ( int  fd,
const char *  xattr,
const char *  label 
)

Set the SMACK label in an extended attribute.

Parameters
fdopened file descriptor of the file
xattrthe extended attribute containing the SMACK label
labeloutput variable for the returned label
Returns
Returns 0 on success and negative value on failure.
int smack_set_label_for_path ( const char *  path,
const char *  xattr,
int  follow,
const char *  label 
)

Set the SMACK label in an extended attribute.

Parameters
pathpath of the file
xattrthe extended attribute containing the SMACK label
followwhether or not to follow symbolic link
labeloutput variable for the returned label
Returns
Returns 0 on success and negative value on failure.
int smack_set_label_for_self ( const char *  label)

Set the label associated with the callers process. The caller must have CAP_MAC_ADMIN POSIX capability in order to do this.

Parameters
labela string containing the new label
Returns
Returns 0 on success and negative on failure.
int smack_set_onlycap ( const char **  labels,
int  cnt 
)

Set the list of labels that will be allowed to have effective CAP_MAC_ADMIN and CAP_MAC_OVERRIDE. This set of labels will be applied (written) to the kernel interface "onlycap". Setting empty list causes CAP_MAC_ADMIN & CAP_MAC_OVERRIDE to be unconstrained by any specific Smack label. Empty list of onlycap Smack labels is the default kernel configuration. The caller must have CAP_MAC_ADMIN capability. Caller may effectively loose the capability after successful return from the function if its Smack label is not on the list of labels.

Parameters
labelslist of labels (NULL for empty list)
cntnumber of labels (0 for empty list)
Returns
Returns 0 on success and negative value on failure
int smack_set_onlycap_from_file ( int  fd)

Set the list of labels that will be allowed to have effective CAP_MAC_ADMIN and CAP_MAC_OVERRIDE. This function reads list of labels from file path passed as argument and calls smack_set_onlycap afterwards.

Parameters
fdfile descriptor to the file containing list of onlycap Smack labels
Returns
Returns 0 on success and negative value on failure
int smack_set_relabel_self ( const char **  labels,
int  cnt 
)

Update list of labels to which the current process will be allowed to switch. The caller must have CAP_MAC_ADMIN POSIX capability in order to do this. Later, if the caller drops capabilities, it will be permitted to change its label (e.g. by smack_set_label_for_self()) only to one of labels permitted here.

Parameters
labelslist of permitted labels
cntnumber of labels
Returns
Returns 0 on success and negative on failure.
const char* smack_smackfs_path ( void  )

Get pointer to a string containing path to the mounted SmackFS.

Returns
Returns a string contain path to the mount SmackFS if SMACK is enabled and SmackFS is mounted. Otherwise, NULL is returned.