Subject: [PATCH] Smack: mmap controls for library containment

[pandora-kernel.git] / security / smack / smack.h

diff --git a/security/smack/smack.h b/security/smack/smack.h
index 43ae747..e365d45 100644 (file)
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -51,11 +51,21 @@ struct socket_smack {
  */
 struct inode_smack {
        char            *smk_inode;     /* label of the fso */
+       char            *smk_task;      /* label of the task */
+       char            *smk_mmap;      /* label of the mmap domain */
        struct mutex    smk_lock;       /* initialization lock */
        int             smk_flags;      /* smack inode flags */
 };
 
+struct task_smack {
+       char                    *smk_task;      /* label for access control */
+       char                    *smk_forked;    /* label when forked */
+       struct list_head        smk_rules;      /* per task access rules */
+       struct mutex            smk_rules_lock; /* lock for the rules */
+};
+
 #define        SMK_INODE_INSTANT       0x01    /* inode is instantiated */
+#define        SMK_INODE_TRANSMUTE     0x02    /* directory is transmuting */
 
 /*
  * A label access rule.
@@ -160,6 +170,10 @@ struct smack_known {
 #define SMACK_CIPSO_MAXLEVEL            255     /* CIPSO 2.2 standard */
 #define SMACK_CIPSO_MAXCATNUM           239     /* CIPSO 2.2 standard */
 
+/*
+ * Flag for transmute access
+ */
+#define MAY_TRANSMUTE  64
 /*
  * Just to make the common cases easier to deal with
  */
@@ -191,6 +205,7 @@ struct inode_smack *new_inode_smack(char *);
 /*
  * These functions are in smack_access.c
  */
+int smk_access_entry(char *, char *, struct list_head *);
 int smk_access(char *, char *, int, struct smk_audit_info *);
 int smk_curacc(char *, u32, struct smk_audit_info *);
 int smack_to_cipso(const char *, struct smack_cipso *);
@@ -233,6 +248,15 @@ static inline void smack_catset_bit(int cat, char *catsetp)
        catsetp[(cat - 1) / 8] |= 0x80 >> ((cat - 1) % 8);
 }
 
+/*
+ * Is the directory transmuting?
+ */
+static inline int smk_inode_transmutable(const struct inode *isp)
+{
+       struct inode_smack *sip = isp->i_security;
+       return (sip->smk_flags & SMK_INODE_TRANSMUTE) != 0;
+}
+
 /*
  * Present a pointer to the smack label in an inode blob.
  */
@@ -242,6 +266,30 @@ static inline char *smk_of_inode(const struct inode *isp)
        return sip->smk_inode;
 }
 
+/*
+ * Present a pointer to the smack label in an task blob.
+ */
+static inline char *smk_of_task(const struct task_smack *tsp)
+{
+       return tsp->smk_task;
+}
+
+/*
+ * Present a pointer to the forked smack label in an task blob.
+ */
+static inline char *smk_of_forked(const struct task_smack *tsp)
+{
+       return tsp->smk_forked;
+}
+
+/*
+ * Present a pointer to the smack label in the current task blob.
+ */
+static inline char *smk_of_current(void)
+{
+       return smk_of_task(current_security());
+}
+
 /*
  * logging functions
  */