mac_veriexec.h

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10

    1 /*
    2  * $FreeBSD$
    3  *
    4  * Copyright (c) 2011, 2012, 2013, 2015, 2016, 2019, Juniper Networks, Inc.
    5  * All rights reserved.
    6  *
    7  * Redistribution and use in source and binary forms, with or without
    8  * modification, are permitted provided that the following conditions
    9  * are met:
   10  * 1. Redistributions of source code must retain the above copyright
   11  *    notice, this list of conditions and the following disclaimer.
   12  * 2. Redistributions in binary form must reproduce the above copyright
   13  *    notice, this list of conditions and the following disclaimer in the
   14  *    documentation and/or other materials provided with the distribution.
   15  *
   16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
   18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
   19  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
   20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
   21  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
   22  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
   23  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
   24  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   26  * SUCH DAMAGE.
   27  */
   28 
   29 #ifndef _SECURITY_MAC_VERIEXEC_H
   30 #define _SECURITY_MAC_VERIEXEC_H
   31 
   32 #ifdef _KERNEL
   33 #include <sys/types.h>
   34 #include <sys/kernel.h>
   35 #include <sys/queue.h>
   36 #include <sys/module.h>
   37 #endif
   38 
   39 /**
   40  * Name of the MAC module
   41  */
   42 #define MAC_VERIEXEC_NAME       "mac_veriexec"
   43 
   44 /* MAC/veriexec syscalls */
   45 #define MAC_VERIEXEC_CHECK_FD_SYSCALL   1
   46 #define MAC_VERIEXEC_CHECK_PATH_SYSCALL 2
   47 
   48 /**
   49  * Enough room for the largest signature...
   50  */
   51 #define MAXFINGERPRINTLEN       64      /* enough room for largest signature */
   52 #define MAXLABELLEN             128
   53 
   54 /*
   55  * Types of veriexec inodes we can have
   56  */
   57 #define VERIEXEC_INDIRECT       (1<<0)  /* Only allow indirect execution */
   58 #define VERIEXEC_FILE           (1<<1)  /* Fingerprint of a plain file */
   59 #define VERIEXEC_NOTRACE        (1<<2)  /**< PTRACE not allowed */
   60 #define VERIEXEC_TRUSTED        (1<<3)  /**< Safe to write /dev/mem */
   61 #define VERIEXEC_NOFIPS         (1<<4)  /**< Not allowed in FIPS mode */
   62 #define VERIEXEC_LABEL          (1<<5)  /**< We have a label */
   63 
   64 #define VERIEXEC_STATE_INACTIVE 0       /**< Ignore */
   65 #define VERIEXEC_STATE_LOADED   (1<<0)  /**< Sigs have been loaded */
   66 #define VERIEXEC_STATE_ACTIVE   (1<<1)  /**< Pay attention to it */
   67 #define VERIEXEC_STATE_ENFORCE  (1<<2)  /**< Fail execs for files that do not
   68                                              match signature */
   69 #define VERIEXEC_STATE_LOCKED   (1<<3)  /**< Do not allow further changes */
   70 
   71 #ifdef _KERNEL
   72 /**
   73  * Version of the MAC/veriexec module
   74  */
   75 #define MAC_VERIEXEC_VERSION    2
   76 
   77 /* Valid states for the fingerprint flag - if signed exec is being used */
   78 typedef enum fingerprint_status {
   79         FINGERPRINT_INVALID,    /**< Fingerprint has not been evaluated */
   80         FINGERPRINT_VALID,      /**< Fingerprint evaluated and matches list */
   81         FINGERPRINT_INDIRECT,   /**< Fingerprint eval'd/matched but only
   82                                      indirect execs allowed */
   83         FINGERPRINT_FILE,       /**< Fingerprint evaluated/matched but
   84                                      not executable */
   85         FINGERPRINT_NOMATCH,    /**< Fingerprint evaluated but does not match */
   86         FINGERPRINT_NOENTRY,    /**< Fingerprint evaluated but no list entry */
   87         FINGERPRINT_NODEV,      /**< Fingerprint evaluated but no dev list */
   88 } fingerprint_status_t;
   89 
   90 typedef void (*mac_veriexec_fpop_init_t)(void *);
   91 typedef void (*mac_veriexec_fpop_update_t)(void *, const uint8_t *, size_t);
   92 typedef void (*mac_veriexec_fpop_final_t)(uint8_t *, void *);
   93 
   94 struct mac_veriexec_fpops {
   95         const char *type;
   96         size_t digest_len;
   97         size_t context_size;
   98         mac_veriexec_fpop_init_t init;
   99         mac_veriexec_fpop_update_t update;
  100         mac_veriexec_fpop_final_t final;
  101         LIST_ENTRY(mac_veriexec_fpops) entries;
  102 };
  103 
  104 /**
  105  * Verified execution subsystem debugging level
  106  */
  107 extern int      mac_veriexec_debug;
  108 
  109 /**
  110  * @brief Define a fingerprint module.
  111  *
  112  * @param _name         Name of the fingerprint module
  113  * @param _digest_len   Length of the digest string, in number of characters
  114  * @param _context_size Size of the context structure, in bytes
  115  * @param _init         Initialization function of type
  116  *                      mac_veriexec_fpop_init_t
  117  * @param _update       Update function of type mac_veriexec_fpop_update_t
  118  * @param _final        Finalize function of type mac_veriexec_fpop_final_t
  119  * @param _vers         Module version
  120  */
  121 #define MAC_VERIEXEC_FPMOD(_name, _digest_len, _context_size, _init,    \
  122             _update, _final, _vers)                                     \
  123         static struct mac_veriexec_fpops                                \
  124             mac_veriexec_##_name##_fpops = {                            \
  125                 .type = #_name,                                         \
  126                 .digest_len = _digest_len,                              \
  127                 .context_size = _context_size,                          \
  128                 .init = _init,                                          \
  129                 .update = _update,                                      \
  130                 .final = _final,                                        \
  131         };                                                              \
  132         static moduledata_t mac_veriexec_##_name##_mod = {              \
  133                 "mac_veriexec/" #_name,                                 \
  134                 mac_veriexec_fingerprint_modevent,                      \
  135                 &(mac_veriexec_##_name##_fpops)                         \
  136         };                                                              \
  137         MODULE_VERSION(mac_veriexec_##_name, _vers);                    \
  138         DECLARE_MODULE(mac_veriexec_##_name,                            \
  139             mac_veriexec_##_name##_mod, SI_SUB_MAC_POLICY,              \
  140             SI_ORDER_ANY);                                              \
  141         MODULE_DEPEND(mac_veriexec_##_name, mac_veriexec,               \
  142             MAC_VERIEXEC_VERSION, MAC_VERIEXEC_VERSION,                 \
  143             MAC_VERIEXEC_VERSION)
  144 
  145 /*
  146  * The following function should not be called directly. The prototype is
  147  * included here to satisfy the compiler when using the macro above.
  148  */
  149 int     mac_veriexec_fingerprint_modevent(module_t mod, int type, void *data);
  150 
  151 /*
  152  * Public functions
  153  */
  154 int     mac_veriexec_metadata_add_file(int file_dev, dev_t fsid, long fileid, 
  155             unsigned long gen, unsigned char fingerprint[MAXFINGERPRINTLEN], 
  156             char *label, size_t labellen, int flags, const char *fp_type,
  157             int override);
  158 int     mac_veriexec_metadata_has_file(dev_t fsid, long fileid, 
  159             unsigned long gen);
  160 int     mac_veriexec_proc_is_trusted(struct ucred *cred, struct proc *p);
  161 #endif
  162 
  163 #endif  /* _SECURITY_MAC_VERIEXEC_H */

Cache object: 1066af09535e332f8727f0b23622ff7a

[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.

FreeBSD/Linux Kernel Cross Reference sys/security/mac_veriexec/mac_veriexec.h

FreeBSD/Linux Kernel Cross Reference
sys/security/mac_veriexec/mac_veriexec.h