1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24#ifndef _SS_POLICYDB_H_
25#define _SS_POLICYDB_H_
26
27#include "symtab.h"
28#include "avtab.h"
29#include "sidtab.h"
30#include "context.h"
31#include "constraint.h"
32
33
34
35
36
37
38
39
40
41struct perm_datum {
42 u32 value;
43};
44
45
46struct common_datum {
47 u32 value;
48 struct symtab permissions;
49};
50
51
52struct class_datum {
53 u32 value;
54 char *comkey;
55 struct common_datum *comdatum;
56 struct symtab permissions;
57 struct constraint_node *constraints;
58 struct constraint_node *validatetrans;
59};
60
61
62struct role_datum {
63 u32 value;
64 u32 bounds;
65 struct ebitmap dominates;
66 struct ebitmap types;
67};
68
69struct role_trans {
70 u32 role;
71 u32 type;
72 u32 new_role;
73 struct role_trans *next;
74};
75
76struct role_allow {
77 u32 role;
78 u32 new_role;
79 struct role_allow *next;
80};
81
82
83struct type_datum {
84 u32 value;
85 u32 bounds;
86 unsigned char primary;
87 unsigned char attribute;
88};
89
90
91struct user_datum {
92 u32 value;
93 u32 bounds;
94 struct ebitmap roles;
95 struct mls_range range;
96 struct mls_level dfltlevel;
97};
98
99
100
101struct level_datum {
102 struct mls_level *level;
103 unsigned char isalias;
104};
105
106
107struct cat_datum {
108 u32 value;
109 unsigned char isalias;
110};
111
112struct range_trans {
113 u32 source_type;
114 u32 target_type;
115 u32 target_class;
116 struct mls_range target_range;
117 struct range_trans *next;
118};
119
120
121struct cond_bool_datum {
122 __u32 value;
123 int state;
124};
125
126struct cond_node;
127
128
129
130
131
132
133
134
135struct ocontext {
136 union {
137 char *name;
138 struct {
139 u8 protocol;
140 u16 low_port;
141 u16 high_port;
142 } port;
143 struct {
144 u32 addr;
145 u32 mask;
146 } node;
147 struct {
148 u32 addr[4];
149 u32 mask[4];
150 } node6;
151 } u;
152 union {
153 u32 sclass;
154 u32 behavior;
155 } v;
156 struct context context[2];
157 u32 sid[2];
158 struct ocontext *next;
159};
160
161struct genfs {
162 char *fstype;
163 struct ocontext *head;
164 struct genfs *next;
165};
166
167
168#define SYM_COMMONS 0
169#define SYM_CLASSES 1
170#define SYM_ROLES 2
171#define SYM_TYPES 3
172#define SYM_USERS 4
173#define SYM_BOOLS 5
174#define SYM_LEVELS 6
175#define SYM_CATS 7
176#define SYM_NUM 8
177
178
179#define OCON_ISID 0
180#define OCON_FS 1
181#define OCON_PORT 2
182#define OCON_NETIF 3
183#define OCON_NODE 4
184#define OCON_FSUSE 5
185#define OCON_NODE6 6
186#define OCON_NUM 7
187
188
189struct policydb {
190
191 struct symtab symtab[SYM_NUM];
192#define p_commons symtab[SYM_COMMONS]
193#define p_classes symtab[SYM_CLASSES]
194#define p_roles symtab[SYM_ROLES]
195#define p_types symtab[SYM_TYPES]
196#define p_users symtab[SYM_USERS]
197#define p_bools symtab[SYM_BOOLS]
198#define p_levels symtab[SYM_LEVELS]
199#define p_cats symtab[SYM_CATS]
200
201
202 char **sym_val_to_name[SYM_NUM];
203#define p_common_val_to_name sym_val_to_name[SYM_COMMONS]
204#define p_class_val_to_name sym_val_to_name[SYM_CLASSES]
205#define p_role_val_to_name sym_val_to_name[SYM_ROLES]
206#define p_type_val_to_name sym_val_to_name[SYM_TYPES]
207#define p_user_val_to_name sym_val_to_name[SYM_USERS]
208#define p_bool_val_to_name sym_val_to_name[SYM_BOOLS]
209#define p_sens_val_to_name sym_val_to_name[SYM_LEVELS]
210#define p_cat_val_to_name sym_val_to_name[SYM_CATS]
211
212
213 struct class_datum **class_val_to_struct;
214 struct role_datum **role_val_to_struct;
215 struct user_datum **user_val_to_struct;
216 struct type_datum **type_val_to_struct;
217
218
219 struct avtab te_avtab;
220
221
222 struct role_trans *role_tr;
223
224
225 struct cond_bool_datum **bool_val_to_struct;
226
227 struct avtab te_cond_avtab;
228
229 struct cond_node *cond_list;
230
231
232 struct role_allow *role_allow;
233
234
235
236 struct ocontext *ocontexts[OCON_NUM];
237
238
239
240
241 struct genfs *genfs;
242
243
244 struct range_trans *range_tr;
245
246
247 struct ebitmap *type_attr_map;
248
249 struct ebitmap policycaps;
250
251 struct ebitmap permissive_map;
252
253 unsigned int policyvers;
254
255 unsigned int reject_unknown : 1;
256 unsigned int allow_unknown : 1;
257 u32 *undefined_perms;
258};
259
260extern void policydb_destroy(struct policydb *p);
261extern int policydb_load_isids(struct policydb *p, struct sidtab *s);
262extern int policydb_context_isvalid(struct policydb *p, struct context *c);
263extern int policydb_class_isvalid(struct policydb *p, unsigned int class);
264extern int policydb_type_isvalid(struct policydb *p, unsigned int type);
265extern int policydb_role_isvalid(struct policydb *p, unsigned int role);
266extern int policydb_read(struct policydb *p, void *fp);
267
268#define PERM_SYMTAB_SIZE 32
269
270#define POLICYDB_CONFIG_MLS 1
271
272
273#define REJECT_UNKNOWN 0x00000002
274#define ALLOW_UNKNOWN 0x00000004
275
276#define OBJECT_R "object_r"
277#define OBJECT_R_VAL 1
278
279#define POLICYDB_MAGIC SELINUX_MAGIC
280#define POLICYDB_STRING "SE Linux"
281
282struct policy_file {
283 char *data;
284 size_t len;
285};
286
287static inline int next_entry(void *buf, struct policy_file *fp, size_t bytes)
288{
289 if (bytes > fp->len)
290 return -EINVAL;
291
292 memcpy(buf, fp->data, bytes);
293 fp->data += bytes;
294 fp->len -= bytes;
295 return 0;
296}
297
298#endif
299
300