88
99/*
1010 * Updated: Trusted Computer Solutions, Inc. <[email protected] > 11+ * Support for enhanced MLS infrastructure.
12+ * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
1113 *
12- * Support for enhanced MLS infrastructure.
13- *
14- * Updated: Frank Mayer <[email protected] > and Karl MacMillan <[email protected] > 15- *
16- * Added conditional policy language extensions
17- *
18- * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
19- * Copyright (C) 2003 - 2004 Tresys Technology, LLC
14+ * Updated: Frank Mayer <[email protected] > and 15+ * Karl MacMillan <[email protected] > 16+ * Added conditional policy language extensions
17+ * Copyright (C) 2003-2004 Tresys Technology, LLC
2018 */
2119
2220#ifndef _SS_POLICYDB_H_
3937
4038/* Permission attributes */
4139struct perm_datum {
42- u32 value ; /* permission bit + 1 */
40+ u32 value ; /* permission bit + 1 */
4341};
4442
4543/* Attributes of a common prefix for access vectors */
4644struct common_datum {
47- u32 value ; /* internal common value */
48- struct symtab permissions ; /* common permissions */
45+ u32 value ; /* internal common value */
46+ struct symtab permissions ; /* common permissions */
4947};
5048
5149/* Class attributes */
5250struct class_datum {
53- u32 value ; /* class value */
54- char * comkey ; /* common name */
55- struct common_datum * comdatum ; /* common datum */
56- struct symtab permissions ; /* class-specific permission symbol table */
57- struct constraint_node * constraints ; /* constraints on class permissions */
58- struct constraint_node * validatetrans ; /* special transition rules */
51+ u32 value ; /* class value */
52+ char * comkey ; /* common name */
53+ struct common_datum * comdatum ; /* common datum */
54+ struct symtab permissions ; /* class-specific permission symbol table */
55+ struct constraint_node * constraints ; /* constraints on class perms */
56+ struct constraint_node * validatetrans ; /* special transition rules */
5957/* Options how a new object user, role, and type should be decided */
60- #define DEFAULT_SOURCE 1
61- #define DEFAULT_TARGET 2
58+ #define DEFAULT_SOURCE 1
59+ #define DEFAULT_TARGET 2
6260 char default_user ;
6361 char default_role ;
6462 char default_type ;
6563/* Options how a new object range should be decided */
66- #define DEFAULT_SOURCE_LOW 1
67- #define DEFAULT_SOURCE_HIGH 2
68- #define DEFAULT_SOURCE_LOW_HIGH 3
69- #define DEFAULT_TARGET_LOW 4
70- #define DEFAULT_TARGET_HIGH 5
71- #define DEFAULT_TARGET_LOW_HIGH 6
64+ #define DEFAULT_SOURCE_LOW 1
65+ #define DEFAULT_SOURCE_HIGH 2
66+ #define DEFAULT_SOURCE_LOW_HIGH 3
67+ #define DEFAULT_TARGET_LOW 4
68+ #define DEFAULT_TARGET_HIGH 5
69+ #define DEFAULT_TARGET_LOW_HIGH 6
7270#define DEFAULT_GLBLUB 7
7371 char default_range ;
7472};
7573
7674/* Role attributes */
7775struct role_datum {
78- u32 value ; /* internal role value */
79- u32 bounds ; /* boundary of role */
80- struct ebitmap dominates ; /* set of roles dominated by this role */
81- struct ebitmap types ; /* set of authorized types for role */
76+ u32 value ; /* internal role value */
77+ u32 bounds ; /* boundary of role */
78+ struct ebitmap dominates ; /* set of roles dominated by this role */
79+ struct ebitmap types ; /* set of authorized types for role */
8280};
8381
8482struct role_trans_key {
85- u32 role ; /* current role */
86- u32 type ; /* program executable type, or new object type */
87- u32 tclass ; /* process class, or new object class */
83+ u32 role ; /* current role */
84+ u32 type ; /* program executable type, or new object type */
85+ u32 tclass ; /* process class, or new object class */
8886};
8987
9088struct role_trans_datum {
91- u32 new_role ; /* new role */
89+ u32 new_role ; /* new role */
9290};
9391
9492struct filename_trans_key {
95- u32 ttype ; /* parent dir context */
96- u16 tclass ; /* class of new object */
97- const char * name ; /* last path component */
93+ u32 ttype ; /* parent dir context */
94+ u16 tclass ; /* class of new object */
95+ const char * name ; /* last path component */
9896};
9997
10098struct filename_trans_datum {
101- struct ebitmap stypes ; /* bitmap of source types for this otype */
102- u32 otype ; /* resulting type of new object */
103- struct filename_trans_datum * next ; /* record for next otype*/
99+ struct ebitmap stypes ; /* bitmap of source types for this otype */
100+ u32 otype ; /* resulting type of new object */
101+ struct filename_trans_datum * next ; /* record for next otype*/
104102};
105103
106104struct role_allow {
107- u32 role ; /* current role */
108- u32 new_role ; /* new role */
105+ u32 role ; /* current role */
106+ u32 new_role ; /* new role */
109107 struct role_allow * next ;
110108};
111109
112110/* Type attributes */
113111struct type_datum {
114- u32 value ; /* internal type value */
115- u32 bounds ; /* boundary of type */
116- unsigned char primary ; /* primary name? */
117- unsigned char attribute ;/* attribute ?*/
112+ u32 value ; /* internal type value */
113+ u32 bounds ; /* boundary of type */
114+ unsigned char primary ; /* primary name? */
115+ unsigned char attribute ; /* attribute ?*/
118116};
119117
120118/* User attributes */
121119struct user_datum {
122- u32 value ; /* internal user value */
123- u32 bounds ; /* bounds of user */
124- struct ebitmap roles ; /* set of authorized roles for user */
125- struct mls_range range ; /* MLS range (min - max) for user */
126- struct mls_level dfltlevel ; /* default login MLS level for user */
120+ u32 value ; /* internal user value */
121+ u32 bounds ; /* bounds of user */
122+ struct ebitmap roles ; /* set of authorized roles for user */
123+ struct mls_range range ; /* MLS range (min - max) for user */
124+ struct mls_level dfltlevel ; /* default login MLS level for user */
127125};
128126
129-
130127/* Sensitivity attributes */
131128struct level_datum {
132- struct mls_level * level ; /* sensitivity and associated categories */
133- unsigned char isalias ; /* is this sensitivity an alias for another? */
129+ struct mls_level * level ; /* sensitivity and associated categories */
130+ unsigned char isalias ; /* is this sensitivity an alias for another? */
134131};
135132
136133/* Category attributes */
137134struct cat_datum {
138- u32 value ; /* internal category bit + 1 */
139- unsigned char isalias ; /* is this category an alias for another? */
135+ u32 value ; /* internal category bit + 1 */
136+ unsigned char isalias ; /* is this category an alias for another? */
140137};
141138
142139struct range_trans {
@@ -147,7 +144,7 @@ struct range_trans {
147144
148145/* Boolean data type */
149146struct cond_bool_datum {
150- __u32 value ; /* internal type value */
147+ __u32 value ; /* internal type value */
151148 int state ;
152149};
153150
@@ -173,20 +170,20 @@ struct type_set {
173170 */
174171struct ocontext {
175172 union {
176- char * name ; /* name of initial SID, fs, netif, fstype, path */
173+ char * name ; /* name of initial SID, fs, netif, fstype, path */
177174 struct {
178175 u8 protocol ;
179176 u16 low_port ;
180177 u16 high_port ;
181- } port ; /* TCP or UDP port information */
178+ } port ; /* TCP or UDP port information */
182179 struct {
183180 u32 addr ;
184181 u32 mask ;
185- } node ; /* node information */
182+ } node ; /* node information */
186183 struct {
187184 u32 addr [4 ];
188185 u32 mask [4 ];
189- } node6 ; /* IPv6 node information */
186+ } node6 ; /* IPv6 node information */
190187 struct {
191188 u64 subnet_prefix ;
192189 u16 low_pkey ;
@@ -198,11 +195,11 @@ struct ocontext {
198195 } ibendport ;
199196 } u ;
200197 union {
201- u32 sclass ; /* security class for genfs */
202- u32 behavior ; /* labeling behavior for fs_use */
198+ u32 sclass ; /* security class for genfs */
199+ u32 behavior ; /* labeling behavior for fs_use */
203200 } v ;
204- struct context context [2 ]; /* security context(s) */
205- u32 sid [2 ]; /* SID(s) */
201+ struct context context [2 ]; /* security context(s) */
202+ u32 sid [2 ]; /* SID(s) */
206203 struct ocontext * next ;
207204};
208205
@@ -221,19 +218,19 @@ struct genfs {
221218#define SYM_BOOLS 5
222219#define SYM_LEVELS 6
223220#define SYM_CATS 7
224- #define SYM_NUM 8
221+ #define SYM_NUM 8
225222
226223/* object context array indices */
227- #define OCON_ISID 0 /* initial SIDs */
228- #define OCON_FS 1 /* unlabeled file systems (deprecated) */
229- #define OCON_PORT 2 /* TCP and UDP port numbers */
230- #define OCON_NETIF 3 /* network interfaces */
231- #define OCON_NODE 4 /* nodes */
232- #define OCON_FSUSE 5 /* fs_use */
233- #define OCON_NODE6 6 /* IPv6 nodes */
234- #define OCON_IBPKEY 7 /* Infiniband PKeys */
235- #define OCON_IBENDPORT 8 /* Infiniband end ports */
236- #define OCON_NUM 9
224+ #define OCON_ISID 0 /* initial SIDs */
225+ #define OCON_FS 1 /* unlabeled file systems (deprecated) */
226+ #define OCON_PORT 2 /* TCP and UDP port numbers */
227+ #define OCON_NETIF 3 /* network interfaces */
228+ #define OCON_NODE 4 /* nodes */
229+ #define OCON_FSUSE 5 /* fs_use */
230+ #define OCON_NODE6 6 /* IPv6 nodes */
231+ #define OCON_IBPKEY 7 /* Infiniband PKeys */
232+ #define OCON_IBENDPORT 8 /* Infiniband end ports */
233+ #define OCON_NUM 9
237234
238235/* The policy database */
239236struct policydb {
@@ -243,15 +240,15 @@ struct policydb {
243240 struct symtab symtab [SYM_NUM ];
244241#define p_commons symtab[SYM_COMMONS]
245242#define p_classes symtab[SYM_CLASSES]
246- #define p_roles symtab[SYM_ROLES]
247- #define p_types symtab[SYM_TYPES]
248- #define p_users symtab[SYM_USERS]
249- #define p_bools symtab[SYM_BOOLS]
250- #define p_levels symtab[SYM_LEVELS]
251- #define p_cats symtab[SYM_CATS]
243+ #define p_roles symtab[SYM_ROLES]
244+ #define p_types symtab[SYM_TYPES]
245+ #define p_users symtab[SYM_USERS]
246+ #define p_bools symtab[SYM_BOOLS]
247+ #define p_levels symtab[SYM_LEVELS]
248+ #define p_cats symtab[SYM_CATS]
252249
253250 /* symbol names indexed by (value - 1) */
254- char * * sym_val_to_name [SYM_NUM ];
251+ char * * sym_val_to_name [SYM_NUM ];
255252
256253 /* class, role, and user attributes indexed by (value - 1) */
257254 struct class_datum * * class_val_to_struct ;
@@ -324,25 +321,25 @@ extern int policydb_role_isvalid(struct policydb *p, unsigned int role);
324321extern int policydb_read (struct policydb * p , void * fp );
325322extern int policydb_write (struct policydb * p , void * fp );
326323
327- extern struct filename_trans_datum * policydb_filenametr_search (
328- struct policydb * p , struct filename_trans_key * key );
324+ extern struct filename_trans_datum *
325+ policydb_filenametr_search ( struct policydb * p , struct filename_trans_key * key );
329326
330- extern struct mls_range * policydb_rangetr_search (
331- struct policydb * p , struct range_trans * key );
327+ extern struct mls_range * policydb_rangetr_search (struct policydb * p ,
328+ struct range_trans * key );
332329
333- extern struct role_trans_datum * policydb_roletr_search (
334- struct policydb * p , struct role_trans_key * key );
330+ extern struct role_trans_datum *
331+ policydb_roletr_search ( struct policydb * p , struct role_trans_key * key );
335332
336- #define POLICYDB_CONFIG_MLS 1
333+ #define POLICYDB_CONFIG_MLS 1
337334
338335/* the config flags related to unknown classes/perms are bits 2 and 3 */
339- #define REJECT_UNKNOWN 0x00000002
340- #define ALLOW_UNKNOWN 0x00000004
336+ #define REJECT_UNKNOWN 0x00000002
337+ #define ALLOW_UNKNOWN 0x00000004
341338
342- #define OBJECT_R "object_r"
339+ #define OBJECT_R "object_r"
343340#define OBJECT_R_VAL 1
344341
345- #define POLICYDB_MAGIC SELINUX_MAGIC
342+ #define POLICYDB_MAGIC SELINUX_MAGIC
346343#define POLICYDB_STRING "SE Linux"
347344
348345struct policy_file {
@@ -366,7 +363,8 @@ static inline int next_entry(void *buf, struct policy_file *fp, size_t bytes)
366363 return 0 ;
367364}
368365
369- static inline int put_entry (const void * buf , size_t bytes , size_t num , struct policy_file * fp )
366+ static inline int put_entry (const void * buf , size_t bytes , size_t num ,
367+ struct policy_file * fp )
370368{
371369 size_t len ;
372370
@@ -382,13 +380,13 @@ static inline int put_entry(const void *buf, size_t bytes, size_t num, struct po
382380 return 0 ;
383381}
384382
385- static inline char * sym_name (struct policydb * p , unsigned int sym_num , unsigned int element_nr )
383+ static inline char * sym_name (struct policydb * p , unsigned int sym_num ,
384+ unsigned int element_nr )
386385{
387386 return p -> sym_val_to_name [sym_num ][element_nr ];
388387}
389388
390389extern u16 string_to_security_class (struct policydb * p , const char * name );
391390extern u32 string_to_av_perm (struct policydb * p , u16 tclass , const char * name );
392391
393- #endif /* _SS_POLICYDB_H_ */
394-
392+ #endif /* _SS_POLICYDB_H_ */
0 commit comments