libsmack  1.1.0
smack.h File Reference
#include <sys/types.h>

Go to the source code of this file.

Macros

#define SMACK_LABEL_LEN   255
 

Functions

int smack_accesses_new (struct smack_accesses **handle)
 
void smack_accesses_free (struct smack_accesses *handle)
 
int smack_accesses_save (struct smack_accesses *handle, int fd)
 
int smack_accesses_apply (struct smack_accesses *handle)
 
int smack_accesses_clear (struct smack_accesses *handle)
 
int smack_accesses_add (struct smack_accesses *handle, const char *subject, const char *object, const char *access_type)
 
int smack_accesses_add_modify (struct smack_accesses *handle, const char *subject, const char *object, const char *allow_access_type, const char *deny_access_type)
 
int smack_accesses_add_from_file (struct smack_accesses *handle, int fd)
 
int smack_have_access (const char *subject, const char *object, const char *access_type)
 
int smack_cipso_new (struct smack_cipso **handle)
 
void smack_cipso_free (struct smack_cipso *handle)
 
int smack_cipso_apply (struct smack_cipso *handle)
 
int smack_cipso_add_from_file (struct smack_cipso *handle, int fd)
 
const char * smack_smackfs_path (void)
 
ssize_t smack_new_label_from_self (char **label)
 
ssize_t smack_new_label_from_socket (int fd, char **label)
 
ssize_t smack_new_label_from_path (const char *path, const char *xattr, int follow, char **label)
 
ssize_t smack_new_label_from_file (int fd, const char *xattr, char **label)
 
int smack_set_label_for_path (const char *path, const char *xattr, int follow, const char *label)
 
int smack_set_label_for_file (int fd, const char *xattr, const char *label)
 
int smack_remove_label_for_path (const char *path, const char *xattr, int follow)
 
int smack_remove_label_for_file (int fd, const char *xattr)
 
int smack_set_label_for_self (const char *label)
 
int smack_revoke_subject (const char *subject)
 
ssize_t smack_label_length (const char *label)
 
int smack_load_policy (void)
 

Macro Definition Documentation

#define SMACK_LABEL_LEN   255

Smack user space library

Maximum length of a smack label, excluding terminating null character.

Function Documentation

int smack_accesses_add ( struct smack_accesses *  handle,
const char *  subject,
const char *  object,
const char *  access_type 
)

Add a new rule to the given access rules.

Parameters
handlehandle to a struct smack_accesses instance
subjectsubject of the rule
objectobject of the rule
access_typeaccess type
Returns
Returns 0 on success and negative on failure.
int smack_accesses_add_from_file ( struct smack_accesses *  handle,
int  fd 
)

Load access rules from the given file.

Parameters
handlehandle to a struct smack_accesses instance
fdfile descriptor
Returns
Returns 0 on success and negative on failure.
int smack_accesses_add_modify ( struct smack_accesses *  handle,
const char *  subject,
const char *  object,
const char *  allow_access_type,
const char *  deny_access_type 
)

Add a modification rule to the given access rules. A modification rule is written to the kernel file 'change-rule' when you apply rules with smack_accesses_apply(). It can be used to turn on and off a certain access type like write access.

When a modification rule is applied to the kernel it will turn on access types in allow_access and turn off access types in deny_access.

Parameters
handlehandle to a struct smack_accesses instance
subjectsubject of the rule
objectobject of the rule
allow_access_typeaccess type to be turned on
deny_access_typeaccess type to be turned off
Returns
Returns 0 on success and negative on failure.
int smack_accesses_apply ( struct smack_accesses *  handle)

Apply access rules to the kernel. Rules are applied in the order that they were added.

Parameters
handlehandle to a struct smack_accesses instance
Returns
Returns 0 on success and negative on failure.
int smack_accesses_clear ( struct smack_accesses *  handle)

Clear access rules from the kernel. Clears the rules by writing corresponding rules with zero access. Note that this function does not check whether the rules pre-exist or not.

Parameters
handlehandle to a struct smack_accesses instance
Returns
Returns 0 on success and negative on failure.
void smack_accesses_free ( struct smack_accesses *  handle)

Destroys a struct smack_accesses instance.

Parameters
handlehandle to a struct smack_accesses instance
int smack_accesses_new ( struct smack_accesses **  handle)

Allocates memory for a new empty smack_accesses instance. The returned instance must be later freed with smack_accesses_free().

Parameters
handleoutput variable for the struct smack_accesses instance
Returns
Returns 0 on success and negative on failure. If the operation is succesful 'accesses' variable will contain a valid pointer.
int smack_accesses_save ( struct smack_accesses *  handle,
int  fd 
)

Write access rules to a given file.

Parameters
handlehandle to a struct smack_accesses instance
fdfile descriptor to the open file
Returns
Returns 0 on success and negative on failure.
int smack_cipso_add_from_file ( struct smack_cipso *  handle,
int  fd 
)

Add CIPSO rules from the given file.

Parameters
handlehandle to a struct smack_cipso instance
fdfile descriptor
Returns
Returns 0 on success and negative on failure.
int smack_cipso_apply ( struct smack_cipso *  handle)

Apply CIPSO rules to the kernel.

Parameters
handlehandle to a struct smack_cipso instance
Returns
Returns 0 on success and negative on failure.
void smack_cipso_free ( struct smack_cipso *  handle)

Destroys a struct smack_cipso instance.

Parameters
handlehandle to a struct smack_cipso instance
int smack_cipso_new ( struct smack_cipso **  handle)

Allocates memory for a new empty smack_cipso instance. The returned instance must be later freed with smack_cipso_free().

Parameters
handleoutput variable for the struct smack_cipso instance
Returns
Returns 0 on success and negative on failure. If the operation is succesful 'cipso' variable will contain a valid pointer.
int smack_have_access ( const char *  subject,
const char *  object,
const char *  access_type 
)

Check whether SMACK allows access for given subject, object and requested access.

Parameters
subjectsubject of the rule
objectobject of the rule
access_typerequested access type
Returns
Returns 1 if access is allowed, 0 if access is not allowed and negative on error.
ssize_t smack_label_length ( const char *  label)

Validate a SMACK label and calculate its length.

Parameters
labellabel to verify
Returns
Returns length of the label on success and negative on failure.
int smack_load_policy ( void  )

Perform the initial policy load. This function loads the Smack policy from default location and loads it to kernel. Smackfs file system must be alreadt mounted. It is designed for init process to load the policy at system startup.

Returns
Returns 0 on success and negative on failure.
ssize_t smack_new_label_from_file ( int  fd,
const char *  xattr,
char **  label 
)

Get the SMACK label that is contained in an extended attribute. Caller is responsible of freeing the returned label.

Parameters
fdopened file descriptor of the file
xattrthe extended attribute containing the SMACK label
labeloutput variable for the returned label
Returns
Returns length of the label on success and negative value on failure.
ssize_t smack_new_label_from_path ( const char *  path,
const char *  xattr,
int  follow,
char **  label 
)

Get the SMACK label that is contained in an extended attribute. Caller is responsible of freeing the returned label.

Parameters
pathpath of the file
xattrthe extended attribute containing the SMACK label
followwhether or not to follow symbolic link
labeloutput variable for the returned label
Returns
Returns length of the label on success and negative value on failure.
ssize_t smack_new_label_from_self ( char **  label)

Get the label that is associated with the callers process. Caller is responsible of freeing the returned label.

Parameters
labeloutput variable for the label
Returns
Returns length of the label on success and negative value on failure.
ssize_t smack_new_label_from_socket ( int  fd,
char **  label 
)

Get the label that is associated with a peer on the other end of a UDS socket (SO_PEERSEC). Caller is responsible of freeing the returned label.

Parameters
fdfile descriptor of the socket
labeloutput variable for the label
Returns
Returns length of the label on success and negative value on failure.
int smack_remove_label_for_file ( int  fd,
const char *  xattr 
)

Remove the SMACK label in an extended attribute.

Parameters
fdopened file descriptor of the file
xattrthe extended attribute containing the SMACK label
Returns
Returns 0 on success and negative on failure.
int smack_remove_label_for_path ( const char *  path,
const char *  xattr,
int  follow 
)

Remove the SMACK label in an extended attribute.

Parameters
pathpath of the file
xattrthe extended attribute containing the SMACK label
followwhether or not to follow symbolic link
Returns
Returns 0 on success and negative on failure.
int smack_revoke_subject ( const char *  subject)

Revoke all rules for the given subject label.

Parameters
subjectsubject to revoke
Returns
Returns 0 on success and negative on failure.
int smack_set_label_for_file ( int  fd,
const char *  xattr,
const char *  label 
)

Set the SMACK label in an extended attribute.

Parameters
fdopened file descriptor of the file
xattrthe extended attribute containing the SMACK label
labeloutput variable for the returned label
Returns
Returns length of the label on success and negative value on failure.
int smack_set_label_for_path ( const char *  path,
const char *  xattr,
int  follow,
const char *  label 
)

Set the SMACK label in an extended attribute.

Parameters
pathpath of the file
xattrthe extended attribute containing the SMACK label
followwhether or not to follow symbolic link
labeloutput variable for the returned label
Returns
Returns length of the label on success and negative value on failure.
int smack_set_label_for_self ( const char *  label)

Set the label associated with the callers process. The caller must have CAP_MAC_ADMIN POSIX capability in order to do this.

Parameters
labela string containing the new label
Returns
Returns 0 on success and negative on failure.
const char* smack_smackfs_path ( void  )

Get pointer to a string containing path to the mounted SmackFS.

Returns
Returns a string contain path to the mount SmackFS if SMACK is enabled and SmackFS is mounted. Otherwise, NULL is returned.