8
8
9
9
/*
10
10
* Updated: Trusted Computer Solutions, Inc. <[email protected] >
11
+ * Support for enhanced MLS infrastructure.
12
+ * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
11
13
*
12
- * Support for enhanced MLS infrastructure.
13
- *
14
- * Updated: Frank Mayer <[email protected] > and Karl MacMillan <[email protected] >
15
- *
16
- * Added conditional policy language extensions
17
- *
18
- * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
19
- * Copyright (C) 2003 - 2004 Tresys Technology, LLC
14
+ * Updated: Frank Mayer <[email protected] > and
15
+ * Karl MacMillan <[email protected] >
16
+ * Added conditional policy language extensions
17
+ * Copyright (C) 2003-2004 Tresys Technology, LLC
20
18
*/
21
19
22
20
#ifndef _SS_POLICYDB_H_
39
37
40
38
/* Permission attributes */
41
39
struct perm_datum {
42
- u32 value ; /* permission bit + 1 */
40
+ u32 value ; /* permission bit + 1 */
43
41
};
44
42
45
43
/* Attributes of a common prefix for access vectors */
46
44
struct common_datum {
47
- u32 value ; /* internal common value */
48
- struct symtab permissions ; /* common permissions */
45
+ u32 value ; /* internal common value */
46
+ struct symtab permissions ; /* common permissions */
49
47
};
50
48
51
49
/* Class attributes */
52
50
struct class_datum {
53
- u32 value ; /* class value */
54
- char * comkey ; /* common name */
55
- struct common_datum * comdatum ; /* common datum */
56
- struct symtab permissions ; /* class-specific permission symbol table */
57
- struct constraint_node * constraints ; /* constraints on class permissions */
58
- struct constraint_node * validatetrans ; /* special transition rules */
51
+ u32 value ; /* class value */
52
+ char * comkey ; /* common name */
53
+ struct common_datum * comdatum ; /* common datum */
54
+ struct symtab permissions ; /* class-specific permission symbol table */
55
+ struct constraint_node * constraints ; /* constraints on class perms */
56
+ struct constraint_node * validatetrans ; /* special transition rules */
59
57
/* Options how a new object user, role, and type should be decided */
60
- #define DEFAULT_SOURCE 1
61
- #define DEFAULT_TARGET 2
58
+ #define DEFAULT_SOURCE 1
59
+ #define DEFAULT_TARGET 2
62
60
char default_user ;
63
61
char default_role ;
64
62
char default_type ;
65
63
/* Options how a new object range should be decided */
66
- #define DEFAULT_SOURCE_LOW 1
67
- #define DEFAULT_SOURCE_HIGH 2
68
- #define DEFAULT_SOURCE_LOW_HIGH 3
69
- #define DEFAULT_TARGET_LOW 4
70
- #define DEFAULT_TARGET_HIGH 5
71
- #define DEFAULT_TARGET_LOW_HIGH 6
64
+ #define DEFAULT_SOURCE_LOW 1
65
+ #define DEFAULT_SOURCE_HIGH 2
66
+ #define DEFAULT_SOURCE_LOW_HIGH 3
67
+ #define DEFAULT_TARGET_LOW 4
68
+ #define DEFAULT_TARGET_HIGH 5
69
+ #define DEFAULT_TARGET_LOW_HIGH 6
72
70
#define DEFAULT_GLBLUB 7
73
71
char default_range ;
74
72
};
75
73
76
74
/* Role attributes */
77
75
struct role_datum {
78
- u32 value ; /* internal role value */
79
- u32 bounds ; /* boundary of role */
80
- struct ebitmap dominates ; /* set of roles dominated by this role */
81
- struct ebitmap types ; /* set of authorized types for role */
76
+ u32 value ; /* internal role value */
77
+ u32 bounds ; /* boundary of role */
78
+ struct ebitmap dominates ; /* set of roles dominated by this role */
79
+ struct ebitmap types ; /* set of authorized types for role */
82
80
};
83
81
84
82
struct role_trans_key {
85
- u32 role ; /* current role */
86
- u32 type ; /* program executable type, or new object type */
87
- u32 tclass ; /* process class, or new object class */
83
+ u32 role ; /* current role */
84
+ u32 type ; /* program executable type, or new object type */
85
+ u32 tclass ; /* process class, or new object class */
88
86
};
89
87
90
88
struct role_trans_datum {
91
- u32 new_role ; /* new role */
89
+ u32 new_role ; /* new role */
92
90
};
93
91
94
92
struct filename_trans_key {
95
- u32 ttype ; /* parent dir context */
96
- u16 tclass ; /* class of new object */
97
- const char * name ; /* last path component */
93
+ u32 ttype ; /* parent dir context */
94
+ u16 tclass ; /* class of new object */
95
+ const char * name ; /* last path component */
98
96
};
99
97
100
98
struct filename_trans_datum {
101
- struct ebitmap stypes ; /* bitmap of source types for this otype */
102
- u32 otype ; /* resulting type of new object */
103
- struct filename_trans_datum * next ; /* record for next otype*/
99
+ struct ebitmap stypes ; /* bitmap of source types for this otype */
100
+ u32 otype ; /* resulting type of new object */
101
+ struct filename_trans_datum * next ; /* record for next otype*/
104
102
};
105
103
106
104
struct role_allow {
107
- u32 role ; /* current role */
108
- u32 new_role ; /* new role */
105
+ u32 role ; /* current role */
106
+ u32 new_role ; /* new role */
109
107
struct role_allow * next ;
110
108
};
111
109
112
110
/* Type attributes */
113
111
struct type_datum {
114
- u32 value ; /* internal type value */
115
- u32 bounds ; /* boundary of type */
116
- unsigned char primary ; /* primary name? */
117
- unsigned char attribute ;/* attribute ?*/
112
+ u32 value ; /* internal type value */
113
+ u32 bounds ; /* boundary of type */
114
+ unsigned char primary ; /* primary name? */
115
+ unsigned char attribute ; /* attribute ?*/
118
116
};
119
117
120
118
/* User attributes */
121
119
struct user_datum {
122
- u32 value ; /* internal user value */
123
- u32 bounds ; /* bounds of user */
124
- struct ebitmap roles ; /* set of authorized roles for user */
125
- struct mls_range range ; /* MLS range (min - max) for user */
126
- struct mls_level dfltlevel ; /* default login MLS level for user */
120
+ u32 value ; /* internal user value */
121
+ u32 bounds ; /* bounds of user */
122
+ struct ebitmap roles ; /* set of authorized roles for user */
123
+ struct mls_range range ; /* MLS range (min - max) for user */
124
+ struct mls_level dfltlevel ; /* default login MLS level for user */
127
125
};
128
126
129
-
130
127
/* Sensitivity attributes */
131
128
struct level_datum {
132
- struct mls_level * level ; /* sensitivity and associated categories */
133
- unsigned char isalias ; /* is this sensitivity an alias for another? */
129
+ struct mls_level * level ; /* sensitivity and associated categories */
130
+ unsigned char isalias ; /* is this sensitivity an alias for another? */
134
131
};
135
132
136
133
/* Category attributes */
137
134
struct cat_datum {
138
- u32 value ; /* internal category bit + 1 */
139
- unsigned char isalias ; /* is this category an alias for another? */
135
+ u32 value ; /* internal category bit + 1 */
136
+ unsigned char isalias ; /* is this category an alias for another? */
140
137
};
141
138
142
139
struct range_trans {
@@ -147,7 +144,7 @@ struct range_trans {
147
144
148
145
/* Boolean data type */
149
146
struct cond_bool_datum {
150
- __u32 value ; /* internal type value */
147
+ __u32 value ; /* internal type value */
151
148
int state ;
152
149
};
153
150
@@ -173,20 +170,20 @@ struct type_set {
173
170
*/
174
171
struct ocontext {
175
172
union {
176
- char * name ; /* name of initial SID, fs, netif, fstype, path */
173
+ char * name ; /* name of initial SID, fs, netif, fstype, path */
177
174
struct {
178
175
u8 protocol ;
179
176
u16 low_port ;
180
177
u16 high_port ;
181
- } port ; /* TCP or UDP port information */
178
+ } port ; /* TCP or UDP port information */
182
179
struct {
183
180
u32 addr ;
184
181
u32 mask ;
185
- } node ; /* node information */
182
+ } node ; /* node information */
186
183
struct {
187
184
u32 addr [4 ];
188
185
u32 mask [4 ];
189
- } node6 ; /* IPv6 node information */
186
+ } node6 ; /* IPv6 node information */
190
187
struct {
191
188
u64 subnet_prefix ;
192
189
u16 low_pkey ;
@@ -198,11 +195,11 @@ struct ocontext {
198
195
} ibendport ;
199
196
} u ;
200
197
union {
201
- u32 sclass ; /* security class for genfs */
202
- u32 behavior ; /* labeling behavior for fs_use */
198
+ u32 sclass ; /* security class for genfs */
199
+ u32 behavior ; /* labeling behavior for fs_use */
203
200
} v ;
204
- struct context context [2 ]; /* security context(s) */
205
- u32 sid [2 ]; /* SID(s) */
201
+ struct context context [2 ]; /* security context(s) */
202
+ u32 sid [2 ]; /* SID(s) */
206
203
struct ocontext * next ;
207
204
};
208
205
@@ -221,19 +218,19 @@ struct genfs {
221
218
#define SYM_BOOLS 5
222
219
#define SYM_LEVELS 6
223
220
#define SYM_CATS 7
224
- #define SYM_NUM 8
221
+ #define SYM_NUM 8
225
222
226
223
/* object context array indices */
227
- #define OCON_ISID 0 /* initial SIDs */
228
- #define OCON_FS 1 /* unlabeled file systems (deprecated) */
229
- #define OCON_PORT 2 /* TCP and UDP port numbers */
230
- #define OCON_NETIF 3 /* network interfaces */
231
- #define OCON_NODE 4 /* nodes */
232
- #define OCON_FSUSE 5 /* fs_use */
233
- #define OCON_NODE6 6 /* IPv6 nodes */
234
- #define OCON_IBPKEY 7 /* Infiniband PKeys */
235
- #define OCON_IBENDPORT 8 /* Infiniband end ports */
236
- #define OCON_NUM 9
224
+ #define OCON_ISID 0 /* initial SIDs */
225
+ #define OCON_FS 1 /* unlabeled file systems (deprecated) */
226
+ #define OCON_PORT 2 /* TCP and UDP port numbers */
227
+ #define OCON_NETIF 3 /* network interfaces */
228
+ #define OCON_NODE 4 /* nodes */
229
+ #define OCON_FSUSE 5 /* fs_use */
230
+ #define OCON_NODE6 6 /* IPv6 nodes */
231
+ #define OCON_IBPKEY 7 /* Infiniband PKeys */
232
+ #define OCON_IBENDPORT 8 /* Infiniband end ports */
233
+ #define OCON_NUM 9
237
234
238
235
/* The policy database */
239
236
struct policydb {
@@ -243,15 +240,15 @@ struct policydb {
243
240
struct symtab symtab [SYM_NUM ];
244
241
#define p_commons symtab[SYM_COMMONS]
245
242
#define p_classes symtab[SYM_CLASSES]
246
- #define p_roles symtab[SYM_ROLES]
247
- #define p_types symtab[SYM_TYPES]
248
- #define p_users symtab[SYM_USERS]
249
- #define p_bools symtab[SYM_BOOLS]
250
- #define p_levels symtab[SYM_LEVELS]
251
- #define p_cats symtab[SYM_CATS]
243
+ #define p_roles symtab[SYM_ROLES]
244
+ #define p_types symtab[SYM_TYPES]
245
+ #define p_users symtab[SYM_USERS]
246
+ #define p_bools symtab[SYM_BOOLS]
247
+ #define p_levels symtab[SYM_LEVELS]
248
+ #define p_cats symtab[SYM_CATS]
252
249
253
250
/* symbol names indexed by (value - 1) */
254
- char * * sym_val_to_name [SYM_NUM ];
251
+ char * * sym_val_to_name [SYM_NUM ];
255
252
256
253
/* class, role, and user attributes indexed by (value - 1) */
257
254
struct class_datum * * class_val_to_struct ;
@@ -324,25 +321,25 @@ extern int policydb_role_isvalid(struct policydb *p, unsigned int role);
324
321
extern int policydb_read (struct policydb * p , void * fp );
325
322
extern int policydb_write (struct policydb * p , void * fp );
326
323
327
- extern struct filename_trans_datum * policydb_filenametr_search (
328
- struct policydb * p , struct filename_trans_key * key );
324
+ extern struct filename_trans_datum *
325
+ policydb_filenametr_search ( struct policydb * p , struct filename_trans_key * key );
329
326
330
- extern struct mls_range * policydb_rangetr_search (
331
- struct policydb * p , struct range_trans * key );
327
+ extern struct mls_range * policydb_rangetr_search (struct policydb * p ,
328
+ struct range_trans * key );
332
329
333
- extern struct role_trans_datum * policydb_roletr_search (
334
- struct policydb * p , struct role_trans_key * key );
330
+ extern struct role_trans_datum *
331
+ policydb_roletr_search ( struct policydb * p , struct role_trans_key * key );
335
332
336
- #define POLICYDB_CONFIG_MLS 1
333
+ #define POLICYDB_CONFIG_MLS 1
337
334
338
335
/* the config flags related to unknown classes/perms are bits 2 and 3 */
339
- #define REJECT_UNKNOWN 0x00000002
340
- #define ALLOW_UNKNOWN 0x00000004
336
+ #define REJECT_UNKNOWN 0x00000002
337
+ #define ALLOW_UNKNOWN 0x00000004
341
338
342
- #define OBJECT_R "object_r"
339
+ #define OBJECT_R "object_r"
343
340
#define OBJECT_R_VAL 1
344
341
345
- #define POLICYDB_MAGIC SELINUX_MAGIC
342
+ #define POLICYDB_MAGIC SELINUX_MAGIC
346
343
#define POLICYDB_STRING "SE Linux"
347
344
348
345
struct policy_file {
@@ -366,7 +363,8 @@ static inline int next_entry(void *buf, struct policy_file *fp, size_t bytes)
366
363
return 0 ;
367
364
}
368
365
369
- static inline int put_entry (const void * buf , size_t bytes , size_t num , struct policy_file * fp )
366
+ static inline int put_entry (const void * buf , size_t bytes , size_t num ,
367
+ struct policy_file * fp )
370
368
{
371
369
size_t len ;
372
370
@@ -382,13 +380,13 @@ static inline int put_entry(const void *buf, size_t bytes, size_t num, struct po
382
380
return 0 ;
383
381
}
384
382
385
- static inline char * sym_name (struct policydb * p , unsigned int sym_num , unsigned int element_nr )
383
+ static inline char * sym_name (struct policydb * p , unsigned int sym_num ,
384
+ unsigned int element_nr )
386
385
{
387
386
return p -> sym_val_to_name [sym_num ][element_nr ];
388
387
}
389
388
390
389
extern u16 string_to_security_class (struct policydb * p , const char * name );
391
390
extern u32 string_to_av_perm (struct policydb * p , u16 tclass , const char * name );
392
391
393
- #endif /* _SS_POLICYDB_H_ */
394
-
392
+ #endif /* _SS_POLICYDB_H_ */
0 commit comments