libsmack
1.1.0
|
#include <sys/types.h>
Go to the source code of this file.
Macros | |
#define | SMACK_LABEL_LEN 255 |
Functions | |
int | smack_accesses_new (struct smack_accesses **handle) |
void | smack_accesses_free (struct smack_accesses *handle) |
int | smack_accesses_save (struct smack_accesses *handle, int fd) |
int | smack_accesses_apply (struct smack_accesses *handle) |
int | smack_accesses_clear (struct smack_accesses *handle) |
int | smack_accesses_add (struct smack_accesses *handle, const char *subject, const char *object, const char *access_type) |
int | smack_accesses_add_modify (struct smack_accesses *handle, const char *subject, const char *object, const char *allow_access_type, const char *deny_access_type) |
int | smack_accesses_add_from_file (struct smack_accesses *handle, int fd) |
int | smack_have_access (const char *subject, const char *object, const char *access_type) |
int | smack_cipso_new (struct smack_cipso **handle) |
void | smack_cipso_free (struct smack_cipso *handle) |
int | smack_cipso_apply (struct smack_cipso *handle) |
int | smack_cipso_add_from_file (struct smack_cipso *handle, int fd) |
const char * | smack_smackfs_path (void) |
ssize_t | smack_new_label_from_self (char **label) |
ssize_t | smack_new_label_from_socket (int fd, char **label) |
ssize_t | smack_new_label_from_path (const char *path, const char *xattr, int follow, char **label) |
ssize_t | smack_new_label_from_file (int fd, const char *xattr, char **label) |
int | smack_set_label_for_path (const char *path, const char *xattr, int follow, const char *label) |
int | smack_set_label_for_file (int fd, const char *xattr, const char *label) |
int | smack_remove_label_for_path (const char *path, const char *xattr, int follow) |
int | smack_remove_label_for_file (int fd, const char *xattr) |
int | smack_set_label_for_self (const char *label) |
int | smack_revoke_subject (const char *subject) |
ssize_t | smack_label_length (const char *label) |
int | smack_load_policy (void) |
#define SMACK_LABEL_LEN 255 |
Smack user space library
Maximum length of a smack label, excluding terminating null character.
int smack_accesses_add | ( | struct smack_accesses * | handle, |
const char * | subject, | ||
const char * | object, | ||
const char * | access_type | ||
) |
Add a new rule to the given access rules.
handle | handle to a struct smack_accesses instance |
subject | subject of the rule |
object | object of the rule |
access_type | access type |
int smack_accesses_add_from_file | ( | struct smack_accesses * | handle, |
int | fd | ||
) |
Load access rules from the given file.
handle | handle to a struct smack_accesses instance |
fd | file descriptor |
int smack_accesses_add_modify | ( | struct smack_accesses * | handle, |
const char * | subject, | ||
const char * | object, | ||
const char * | allow_access_type, | ||
const char * | deny_access_type | ||
) |
Add a modification rule to the given access rules. A modification rule is written to the kernel file 'change-rule' when you apply rules with smack_accesses_apply(). It can be used to turn on and off a certain access type like write access.
When a modification rule is applied to the kernel it will turn on access types in allow_access and turn off access types in deny_access.
handle | handle to a struct smack_accesses instance |
subject | subject of the rule |
object | object of the rule |
allow_access_type | access type to be turned on |
deny_access_type | access type to be turned off |
int smack_accesses_apply | ( | struct smack_accesses * | handle | ) |
Apply access rules to the kernel. Rules are applied in the order that they were added.
handle | handle to a struct smack_accesses instance |
int smack_accesses_clear | ( | struct smack_accesses * | handle | ) |
Clear access rules from the kernel. Clears the rules by writing corresponding rules with zero access. Note that this function does not check whether the rules pre-exist or not.
handle | handle to a struct smack_accesses instance |
void smack_accesses_free | ( | struct smack_accesses * | handle | ) |
Destroys a struct smack_accesses instance.
handle | handle to a struct smack_accesses instance |
int smack_accesses_new | ( | struct smack_accesses ** | handle | ) |
Allocates memory for a new empty smack_accesses instance. The returned instance must be later freed with smack_accesses_free().
handle | output variable for the struct smack_accesses instance |
int smack_accesses_save | ( | struct smack_accesses * | handle, |
int | fd | ||
) |
Write access rules to a given file.
handle | handle to a struct smack_accesses instance |
fd | file descriptor to the open file |
int smack_cipso_add_from_file | ( | struct smack_cipso * | handle, |
int | fd | ||
) |
Add CIPSO rules from the given file.
handle | handle to a struct smack_cipso instance |
fd | file descriptor |
int smack_cipso_apply | ( | struct smack_cipso * | handle | ) |
Apply CIPSO rules to the kernel.
handle | handle to a struct smack_cipso instance |
void smack_cipso_free | ( | struct smack_cipso * | handle | ) |
Destroys a struct smack_cipso instance.
handle | handle to a struct smack_cipso instance |
int smack_cipso_new | ( | struct smack_cipso ** | handle | ) |
Allocates memory for a new empty smack_cipso instance. The returned instance must be later freed with smack_cipso_free().
handle | output variable for the struct smack_cipso instance |
int smack_have_access | ( | const char * | subject, |
const char * | object, | ||
const char * | access_type | ||
) |
Check whether SMACK allows access for given subject, object and requested access.
subject | subject of the rule |
object | object of the rule |
access_type | requested access type |
ssize_t smack_label_length | ( | const char * | label | ) |
Validate a SMACK label and calculate its length.
label | label to verify |
int smack_load_policy | ( | void | ) |
Perform the initial policy load. This function loads the Smack policy from default location and loads it to kernel. Smackfs file system must be alreadt mounted. It is designed for init process to load the policy at system startup.
ssize_t smack_new_label_from_file | ( | int | fd, |
const char * | xattr, | ||
char ** | label | ||
) |
Get the SMACK label that is contained in an extended attribute. Caller is responsible of freeing the returned label.
fd | opened file descriptor of the file |
xattr | the extended attribute containing the SMACK label |
label | output variable for the returned label |
ssize_t smack_new_label_from_path | ( | const char * | path, |
const char * | xattr, | ||
int | follow, | ||
char ** | label | ||
) |
Get the SMACK label that is contained in an extended attribute. Caller is responsible of freeing the returned label.
path | path of the file |
xattr | the extended attribute containing the SMACK label |
follow | whether or not to follow symbolic link |
label | output variable for the returned label |
ssize_t smack_new_label_from_self | ( | char ** | label | ) |
Get the label that is associated with the callers process. Caller is responsible of freeing the returned label.
label | output variable for the label |
ssize_t smack_new_label_from_socket | ( | int | fd, |
char ** | label | ||
) |
Get the label that is associated with a peer on the other end of a UDS socket (SO_PEERSEC). Caller is responsible of freeing the returned label.
fd | file descriptor of the socket |
label | output variable for the label |
int smack_remove_label_for_file | ( | int | fd, |
const char * | xattr | ||
) |
Remove the SMACK label in an extended attribute.
fd | opened file descriptor of the file |
xattr | the extended attribute containing the SMACK label |
int smack_remove_label_for_path | ( | const char * | path, |
const char * | xattr, | ||
int | follow | ||
) |
Remove the SMACK label in an extended attribute.
path | path of the file |
xattr | the extended attribute containing the SMACK label |
follow | whether or not to follow symbolic link |
int smack_revoke_subject | ( | const char * | subject | ) |
Revoke all rules for the given subject label.
subject | subject to revoke |
int smack_set_label_for_file | ( | int | fd, |
const char * | xattr, | ||
const char * | label | ||
) |
Set the SMACK label in an extended attribute.
fd | opened file descriptor of the file |
xattr | the extended attribute containing the SMACK label |
label | output variable for the returned label |
int smack_set_label_for_path | ( | const char * | path, |
const char * | xattr, | ||
int | follow, | ||
const char * | label | ||
) |
Set the SMACK label in an extended attribute.
path | path of the file |
xattr | the extended attribute containing the SMACK label |
follow | whether or not to follow symbolic link |
label | output variable for the returned label |
int smack_set_label_for_self | ( | const char * | label | ) |
Set the label associated with the callers process. The caller must have CAP_MAC_ADMIN POSIX capability in order to do this.
label | a string containing the new label |
const char* smack_smackfs_path | ( | void | ) |
Get pointer to a string containing path to the mounted SmackFS.