RSBAC_GET_ATTR(2)

NAME
rsbac_get_attr - get RSBAC attribute value

SYNOPSIS
#include <rsbac/types.h>

#include <rsbac/syscalls.h>

int rsbac_get_attr(enum rsbac_target_t target, union rsbac_target_id_t * tid, enum rsbac_attribute_t attr, union rsbac_attibute_value_t * value, int inherit);

DESCRIPTION
rsbac_get_attr requests from the kernel to get the attribute value of attr for target type target and target id tid. (Recursively) use parent dir value, if value is 'inherit' and parameter inherit is not 0. Valid targets are IPC, SCD, USER, PROCESS. The data structures are defined as follows:

    typedef uid_t rsbac_uid_t; /* Same as user in Linux */
    typedef pid_t rsbac_pid_t; /* Same as pid in Linux  */
    enum    rsbac_ipc_type_t {I_sem, I_msg, I_shm, I_sock,
                              I_sockid, I_none};
    enum    rsbac_scd_type_t {ST_time_strucs, ST_clock, ST_host_id,
                              ST_net_id, ST_ioports, ST_rlimit,
                              ST_swap, ST_syslog, ST_rsbac};
    union   rsbac_ipc_id_t
      {
        u_long id_nr;
      };
    struct rsbac_ipc_t
        {
          enum  rsbac_ipc_type_t     type;
          union rsbac_ipc_id_t       id;
        };
    typedef u_char rsbac_ff_flags_t;
    #define FF_read_only 1
    #define FF_execute_only 2
    #define FF_search_only 4
    enum    rsbac_ms_trusted_t {MT_not_trusted, MT_read, MT_full, MT_none};
    enum   rsbac_target_t {T_FILE, T_DIR, T_DEV, T_IPC, T_SCD,
                           T_USER, T_PROCESS, T_NONE};
    union  rsbac_target_id_t
           {
              struct rsbac_ipc_t       ipc;
              enum rsbac_scd_type_t    scd;
              rsbac_uid_t              user;
              rsbac_pid_t              process;
              int                      dummy;
           };
    enum   rsbac_attribute_t {
               A_security_level, A_object_category,
               A_data_type, A_system_role, A_integrity_role,
               A_pm_role,
               A_process_type, A_pm_process_type, A_pm_current_task,
               A_pm_object_class, A_pm_ipc_purpose,
               A_pm_object_type, A_program_type, A_pm_program_type,
               A_pm_tp, A_pm_task_set, A_owner, A_pseudo,
               A_current_sec_level, A_min_write_open,
               A_max_read_open, A_mac_auto, A_mac_trusted,
               A_mac_trusted_for_user, A_mac_check,
               A_cwi_rel_id,
               A_ms_scanned, A_ms_trusted,
               A_ms_backbuf, A_ms_buflen, A_ms_str_nr,
               A_ms_str_offset,
               A_ms_sock_trusted_tcp, A_ms_sock_trusted_udp,
               A_ff_flags,
               A_log_array_low, A_log_array_high,
               A_none};
    union  rsbac_attribute_value_t
           {
              enum rsbac_security_level_t   security_level;
              enum rsbac_object_category_t  object_category;
              enum rsbac_data_type_t        data_type;
              enum rsbac_system_role_t      system_role;
              enum rsbac_integrity_role_t   integrity_role;
              enum rsbac_pm_role_t          pm_role;
              enum rsbac_process_type_t     process_type;
              enum rsbac_pm_process_type_t  pm_process_type;
              rsbac_pm_task_id_t            pm_current_task;
              rsbac_pm_object_class_id_t    pm_object_class;
              rsbac_pm_purpose_id_t         pm_ipc_purpose;
              enum rsbac_pm_object_type_t   pm_object_type;
              rsbac_program_type_t          program_type;
              rsbac_pm_program_type_t       pm_program_type;
              rsbac_pm_tp_id_t              pm_tp;
              rsbac_pm_task_set_id_t        pm_task_set;
              rsbac_uid_t                   owner; /* process owner */
              rsbac_pseudo_t                pseudo;
              enum rsbac_security_level_t   current_sec_level;
              enum rsbac_security_level_t   min_write_open;
              enum rsbac_security_level_t   max_read_open;
              boolean                       mac_auto;
              boolean                       mac_trusted;
              rsbac_uid_t                   mac_trusted_for_user;
              boolean                       mac_check;
              rsbac_cwi_relation_id_t       cwi_rel_id;
              rsbac_ms_scanned_t            ms_scanned;
              rsbac_ms_trusted_t            ms_trusted;
              char                        * ms_backbuf;
              int                           ms_buflen;
              int                           ms_str_nr;
              int                           ms_str_offset;
              enum rsbac_ms_sock_trusted_t  ms_sock_trusted_tcp;
              enum rsbac_ms_sock_trusted_t  ms_sock_trusted_udp;
              rsbac_ff_flags_t              ff_flags;
              rsbac_log_array_t             log_array_low;
              rsbac_log_array_t             log_array_high;
              int                           dummy;
              long                          long_dummy;
           };

RETURN VALUE
rsbac_get_attr returns 0 on success and an error code otherwise.

ERRORS

EPERM
    The decision component denied attribute read for this user/process.

RSBAC_EINVALIDTARGET
    The target is invalid, e.g. FILE, DEV or DIR.

RSBAC_EINVALIDVALUE
    Value is NULL.

RSBAC_EINVALIDATTR
    The attribute is invalid for this target.

RSBAC_ENOTINITIALIZED
    The RSBAC system is not initialized, so no attributes are available.

SEE ALSO
rsbac_get_attr_n(2),rsbac_set_attr(2),rsbac_set_attr_n(2),rsbac_remove_target(2),rsbac_remove_target_n(2).

AUTHOR
Amon Ott <ao@compuniverse.com>