TargetsRSBAC restricts access by subjects to objects. The subjects are always processes, acting on behalf of a user with certain attributes, like system_role etc. Objects in RSBAC are called (Access) Targets. They are grouped in Target Types. The following types are defined:
| FILE | Files, including device special files. Identified by device and inode number. |
| DIR | Directories, identified by device and inode number. |
| DEV | Devices, identified by type (char or block), major and minor number |
| IPC | InterProcess Communication: Semaphores (sem), Messages (msg), Shared Memory (shm), Sockets (sock) and FiFo (fifo). |
| SCD | System Control Data: Objects affecting the whole system. This target type is the only one with a fixed number of objects, identified by number (see below). |
| USER | Users as objects, mostly for access control information (ACI). |
| PROCESS | Processes as objects. |
| NONE | No object associated with this request. In some models (RC, ACL) this is internally changed into SCD target "other". |
| FD | (Only in user space): Let the command line tool decide between types FILE and DIR |
System Control Data (SCD) targets are these:
| time_strucs | System timer |
| clock | System time and date |
| host_id | Host name |
| net_id | Domain name |
| ioports | Access Control for direct hardware access |
| rlimit | Setting process ressource limits |
| swap | Control of swapping |
| syslog | System log |
| rsbac | RSBAC data in /proc |
| rsbaclog | RSBAC own log |
| kmem | Direct access to kernel memory via proc or device |
| other | (only internal in RC and ACL): Substitute for target NONE |
| auth_administration | (only in RC and ACL): AUTH model administration |
Before access to a target is granted, a request call to the Access Control Decision facility (ADF) is performed. Based on the request type and the target, access can be granted or denied. RSBAC defines the following requests:
| Request | Description | Valid Target Types |
|---|---|---|
| ADD_TO_KERNEL | Add a kernel module | NONE |
| ALTER | Change IPC control information | IPC |
| APPEND_OPEN | Open to append | FILE, DEV, IPC |
| CHANGE_GROUP | Change active group | FILE, DIR, IPC, USER, PROCESS, NONE |
| CHANGE_OWNER | Change owner | FILE, DIR, IPC, PROCESS, NONE |
| CHDIR | Change working directory | DIR |
| CLONE | Fork/clone a process | PROCESS |
| CLOSE | Close opened file etc. Should always be granted. | FILE, DIR, DEV, IPC |
| CREATE | Create object | DIR (where), IPC |
| DELETE | Delete object | FILE, DIR, IPC |
| EXECUTE | Execute a file, library code from a file or other code | FILE, NONE |
| GET_PERMISSIONS_DATA | Read Unix permissions (mode) | FILE, DIR, IPC, SCD |
| GET_STATUS_DATA | Get status (stat() etc.) | FILE, DIR, IPC, SCD |
| LINK_HARD | Hard link | FILE |
| MODIFY_ACCESS_DATA | Change access information, e.g. time, date | FILE, DIR |
| MODIFY_ATTRIBUTE | Change an RSBAC attribute value | All target types |
| MODIFY_PERMISSIONS_DATA | Change Unix permissions | FILE, DIR, IPC, SCD |
| MODIFY_SYSTEM_DATA | Change system settings | SCD |
| MOUNT | Mount a filesystem | DIR, DEV |
| READ | Read from DIR (or socket, MS only) | DIR, IPC |
| READ_ATTRIBUTE | Read RSBAC attribute value | All target types |
| READ_OPEN | Open for read | FILE, DEV, IPC |
| READ_WRITE_OPEN | Open for read and write | FILE, DEV, IPC |
| REMOVE_FROM_KERNEL | Remove kernel module | NONE |
| RENAME | Rename | FILE, DIR |
| SEARCH | Lookup in dir from inside kernel for access with full path | DIR |
| SEND_SIGNAL | Send a signal | PROCESS |
| SHUTDOWN | Shutdown/reboot system | NONE |
| SWITCH_LOG | Change RSBAC log settings | NONE |
| SWITCH_MODULE | Switch decision module on/off | NONE |
| TERMINATE | End a process. Should always be granted. | PROCESS |
| TRACE | Trace a process | PROCESS |
| TRUNCATE | Truncate | FILE |
| UMOUNT | Umount a filesystem | DIR, DEV, NONE |
| WRITE | Write to a dir. Used for object moving to target dir. | DIR, SCD |
| WRITE_OPEN | Open for write | FILE, DEV, IPC |
Please remember that some models (RC, ACL) internally change NONE targets to SCD target "other" for access control.
30-Nov-00, -ao