113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */ 213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* 413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * Updated: Joshua Brindle <jbrindle@tresys.com> 513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * Karl MacMillan <kmacmillan@tresys.com> 613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * Jason Tang <jtang@tresys.com> 713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * 813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * Module support 913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * 1013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com> 1113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * 1213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * Support for enhanced MLS infrastructure. 1313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * 1413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com> 1513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * 1613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * Added conditional policy language extensions 1713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * 1813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * Updated: Red Hat, Inc. James Morris <jmorris@redhat.com> 1913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * 2013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * Fine-grained netlink support 2113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * IPv6 support 2213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * Code cleanup 2313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * 2413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc. 2513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * Copyright (C) 2003 - 2004 Tresys Technology, LLC 2613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * Copyright (C) 2003 - 2004 Red Hat, Inc. 2713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * 2813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * This library is free software; you can redistribute it and/or 2913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * modify it under the terms of the GNU Lesser General Public 3013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * License as published by the Free Software Foundation; either 3113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * version 2.1 of the License, or (at your option) any later version. 3213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * 3313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * This library is distributed in the hope that it will be useful, 3413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * but WITHOUT ANY WARRANTY; without even the implied warranty of 3513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 3613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * Lesser General Public License for more details. 3713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * 3813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * You should have received a copy of the GNU Lesser General Public 3913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * License along with this library; if not, write to the Free Software 4013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA 4113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle */ 4213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 4313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* FLASK */ 4413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 4513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* 4613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * A policy database (policydb) specifies the 4713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * configuration data for the security policy. 4813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle */ 4913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 5013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#ifndef _SEPOL_POLICYDB_POLICYDB_H_ 5113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define _SEPOL_POLICYDB_POLICYDB_H_ 5213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 5313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#include <stdio.h> 5413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#include <stddef.h> 5513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 5613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#include <sepol/policydb.h> 5713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 5813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#include <sepol/policydb/flask_types.h> 5913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#include <sepol/policydb/symtab.h> 6013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#include <sepol/policydb/avtab.h> 6113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#include <sepol/policydb/context.h> 6213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#include <sepol/policydb/constraint.h> 6313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#include <sepol/policydb/sidtab.h> 64ed7a6ba24ad3241e696fa7bc9bb56bb4f373147bdcashman#include <sys/cdefs.h> 6513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 6613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define ERRMSG_LEN 1024 6713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 6813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_SUCCESS 0 6913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_ERROR -1 7013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_UNSUPPORTED -2 7113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 72ed7a6ba24ad3241e696fa7bc9bb56bb4f373147bdcashman__BEGIN_DECLS 73ed7a6ba24ad3241e696fa7bc9bb56bb4f373147bdcashman 7413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* 7513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * A datum type is defined for each kind of symbol 7613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * in the configuration data: individual permissions, 7713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * common prefixes for access vectors, classes, 7813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * users, roles, types, sensitivities, categories, etc. 7913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle */ 8013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 8113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* type set preserves data needed by modules such as *, ~ and attributes */ 8213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct type_set { 8313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle ebitmap_t types; 8413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle ebitmap_t negset; 8513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define TYPE_STAR 1 8613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define TYPE_COMP 2 8713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t flags; 8813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} type_set_t; 8913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 9013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct role_set { 9113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle ebitmap_t roles; 9213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define ROLE_STAR 1 9313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define ROLE_COMP 2 9413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t flags; 9513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} role_set_t; 9613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 9713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* Permission attributes */ 9813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct perm_datum { 9913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle symtab_datum_t s; 10013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} perm_datum_t; 10113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 10213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* Attributes of a common prefix for access vectors */ 10313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct common_datum { 10413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle symtab_datum_t s; 10513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle symtab_t permissions; /* common permissions */ 10613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} common_datum_t; 10713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 10813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* Class attributes */ 10913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct class_datum { 11013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle symtab_datum_t s; 11113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle char *comkey; /* common name */ 11213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle common_datum_t *comdatum; /* common datum */ 11313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle symtab_t permissions; /* class-specific permission symbol table */ 11413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle constraint_node_t *constraints; /* constraints on class permissions */ 11513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle constraint_node_t *validatetrans; /* special transition rules */ 11609c783c9a36cd47216df827c5d2c21ec8cd613e2Eric Paris/* Options how a new object user and role should be decided */ 11709c783c9a36cd47216df827c5d2c21ec8cd613e2Eric Paris#define DEFAULT_SOURCE 1 11809c783c9a36cd47216df827c5d2c21ec8cd613e2Eric Paris#define DEFAULT_TARGET 2 11909c783c9a36cd47216df827c5d2c21ec8cd613e2Eric Paris char default_user; 12009c783c9a36cd47216df827c5d2c21ec8cd613e2Eric Paris char default_role; 121693f5241fdd5ae7e89d4312b85443c0fc1b1a57dEric Paris char default_type; 12209c783c9a36cd47216df827c5d2c21ec8cd613e2Eric Paris/* Options how a new object range should be decided */ 12309c783c9a36cd47216df827c5d2c21ec8cd613e2Eric Paris#define DEFAULT_SOURCE_LOW 1 12409c783c9a36cd47216df827c5d2c21ec8cd613e2Eric Paris#define DEFAULT_SOURCE_HIGH 2 12509c783c9a36cd47216df827c5d2c21ec8cd613e2Eric Paris#define DEFAULT_SOURCE_LOW_HIGH 3 12609c783c9a36cd47216df827c5d2c21ec8cd613e2Eric Paris#define DEFAULT_TARGET_LOW 4 12709c783c9a36cd47216df827c5d2c21ec8cd613e2Eric Paris#define DEFAULT_TARGET_HIGH 5 12809c783c9a36cd47216df827c5d2c21ec8cd613e2Eric Paris#define DEFAULT_TARGET_LOW_HIGH 6 12909c783c9a36cd47216df827c5d2c21ec8cd613e2Eric Paris char default_range; 13013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} class_datum_t; 13113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 13213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* Role attributes */ 13313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct role_datum { 13413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle symtab_datum_t s; 13513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle ebitmap_t dominates; /* set of roles dominated by this role */ 13613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle type_set_t types; /* set of authorized types for role */ 13713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle ebitmap_t cache; /* This is an expanded set used for context validation during parsing */ 138f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle uint32_t bounds; /* bounds role, if exist */ 13916675b7f96b7a61ac64180b1824ec04984b72b3bHarry Ciao#define ROLE_ROLE 0 /* regular role in kernel policies */ 14016675b7f96b7a61ac64180b1824ec04984b72b3bHarry Ciao#define ROLE_ATTRIB 1 /* attribute */ 14116675b7f96b7a61ac64180b1824ec04984b72b3bHarry Ciao uint32_t flavor; 14216675b7f96b7a61ac64180b1824ec04984b72b3bHarry Ciao ebitmap_t roles; /* roles with this attribute */ 14313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} role_datum_t; 14413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 14513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct role_trans { 14613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t role; /* current role */ 14745b2e6ec2340d698db506dff8c3df947b6e29452Harry Ciao uint32_t type; /* program executable type, or new object type */ 14845b2e6ec2340d698db506dff8c3df947b6e29452Harry Ciao uint32_t tclass; /* process class, or new object class */ 14913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t new_role; /* new role */ 15013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct role_trans *next; 15113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} role_trans_t; 15213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 15313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct role_allow { 15413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t role; /* current role */ 15513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t new_role; /* new role */ 15613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct role_allow *next; 15713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} role_allow_t; 15813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 1596eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris/* filename_trans rules */ 1606eeb71538ea29b639ac7549831cd1aa4da32722aEric Paristypedef struct filename_trans { 1616eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris uint32_t stype; 1626eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris uint32_t ttype; 1636eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris uint32_t tclass; 1646eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris char *name; 1656eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris uint32_t otype; 1666eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris struct filename_trans *next; 1676eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris} filename_trans_t; 1686eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris 16913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* Type attributes */ 17013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct type_datum { 17113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle symtab_datum_t s; 17213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t primary; /* primary name? can be set to primary value if below is TYPE_ */ 17313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define TYPE_TYPE 0 /* regular type or alias in kernel policies */ 17413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define TYPE_ATTRIB 1 /* attribute */ 17513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define TYPE_ALIAS 2 /* alias in modular policy */ 17613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t flavor; 17713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle ebitmap_t types; /* types with this attribute */ 17813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define TYPE_FLAGS_PERMISSIVE 0x01 17913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t flags; 180f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle uint32_t bounds; /* bounds type, if exist */ 18113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} type_datum_t; 18213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 183f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle/* 184f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle * Properties of type_datum 185f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle * available on the policy version >= (MOD_)POLICYDB_VERSION_BOUNDARY 186f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle */ 187f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle#define TYPEDATUM_PROPERTY_PRIMARY 0x0001 188f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle#define TYPEDATUM_PROPERTY_ATTRIBUTE 0x0002 189f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle#define TYPEDATUM_PROPERTY_ALIAS 0x0004 /* userspace only */ 190f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle#define TYPEDATUM_PROPERTY_PERMISSIVE 0x0008 /* userspace only */ 191f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle 19213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* User attributes */ 19313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct user_datum { 19413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle symtab_datum_t s; 19513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle role_set_t roles; /* set of authorized roles for user */ 19613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle mls_semantic_range_t range; /* MLS range (min. - max.) for user */ 19713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle mls_semantic_level_t dfltlevel; /* default login MLS level for user */ 19813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle ebitmap_t cache; /* This is an expanded set used for context validation during parsing */ 19913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle mls_range_t exp_range; /* expanded range used for validation */ 20013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle mls_level_t exp_dfltlevel; /* expanded range used for validation */ 201f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle uint32_t bounds; /* bounds user, if exist */ 20213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} user_datum_t; 20313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 20413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* Sensitivity attributes */ 20513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct level_datum { 20613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle mls_level_t *level; /* sensitivity and associated categories */ 20713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle unsigned char isalias; /* is this sensitivity an alias for another? */ 20813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle unsigned char defined; 20913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} level_datum_t; 21013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 21113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* Category attributes */ 21213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct cat_datum { 21313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle symtab_datum_t s; 21413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle unsigned char isalias; /* is this category an alias for another? */ 21513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} cat_datum_t; 21613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 21713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct range_trans { 21813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t source_type; 21913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t target_type; 22013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t target_class; 22113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle mls_range_t target_range; 22213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct range_trans *next; 22313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} range_trans_t; 22413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 22513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* Boolean data type */ 22613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct cond_bool_datum { 22713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle symtab_datum_t s; 22813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle int state; 229f87ae538256eff759cb67c448416dc14031849a1Harry Ciao#define COND_BOOL_FLAGS_TUNABLE 0x01 /* is this a tunable? */ 230f87ae538256eff759cb67c448416dc14031849a1Harry Ciao uint32_t flags; 23113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} cond_bool_datum_t; 23213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 23313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindlestruct cond_node; 23413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 23513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct cond_node cond_list_t; 23613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindlestruct cond_av_list; 23713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 23813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct class_perm_node { 239ed7a6ba24ad3241e696fa7bc9bb56bb4f373147bdcashman uint32_t tclass; 24013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t data; /* permissions or new type */ 24113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct class_perm_node *next; 24213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} class_perm_node_t; 24313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 24480bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoeptypedef struct av_operations { 24580bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep uint8_t type; 24680bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep /* 256 bits of ioctl number permissions */ 24780bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep uint32_t perms[8]; 24880bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep} av_operations_t; 24980bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep 25013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct avrule { 25113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* these typedefs are almost exactly the same as those in avtab.h - they are 25213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * here because of the need to include neverallow and dontaudit messages */ 25380bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define AVRULE_ALLOWED 0x0001 25480bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define AVRULE_AUDITALLOW 0x0002 25580bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define AVRULE_AUDITDENY 0x0004 25680bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define AVRULE_DONTAUDIT 0x0008 25780bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define AVRULE_NEVERALLOW 0x0080 25813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define AVRULE_AV (AVRULE_ALLOWED | AVRULE_AUDITALLOW | AVRULE_AUDITDENY | AVRULE_DONTAUDIT | AVRULE_NEVERALLOW) 25980bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define AVRULE_TRANSITION 0x0010 26080bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define AVRULE_MEMBER 0x0020 26180bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define AVRULE_CHANGE 0x0040 26213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define AVRULE_TYPE (AVRULE_TRANSITION | AVRULE_MEMBER | AVRULE_CHANGE) 26380bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define AVRULE_OPNUM_ALLOWED 0x0100 26480bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define AVRULE_OPNUM_AUDITALLOW 0x0200 26580bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define AVRULE_OPNUM_DONTAUDIT 0x0400 26680bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define AVRULE_OPNUM (AVRULE_OPNUM_ALLOWED | AVRULE_OPNUM_AUDITALLOW | \ 26780bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep AVRULE_OPNUM_DONTAUDIT) 26880bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define AVRULE_OPTYPE_ALLOWED 0x1000 26980bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define AVRULE_OPTYPE_AUDITALLOW 0x2000 27080bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define AVRULE_OPTYPE_DONTAUDIT 0x4000 27180bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define AVRULE_OPTYPE (AVRULE_OPTYPE_ALLOWED | AVRULE_OPTYPE_AUDITALLOW | \ 27280bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep AVRULE_OPTYPE_DONTAUDIT) 27380bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define AVRULE_OP (AVRULE_OPNUM | AVRULE_OPTYPE) 27413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t specified; 27513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define RULE_SELF 1 27613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t flags; 27713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle type_set_t stypes; 27813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle type_set_t ttypes; 27913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle class_perm_node_t *perms; 28080bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep av_operations_t * ops; 28113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle unsigned long line; /* line number from policy.conf where 28213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * this rule originated */ 283ef24ade029329a6e9981bd1de2ba7b9ea48e1c79Stephen Smalley /* source file name and line number (e.g. .te file) */ 284ef24ade029329a6e9981bd1de2ba7b9ea48e1c79Stephen Smalley char *source_filename; 285ef24ade029329a6e9981bd1de2ba7b9ea48e1c79Stephen Smalley unsigned long source_line; 28613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct avrule *next; 28713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} avrule_t; 28813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 28913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct role_trans_rule { 29013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle role_set_t roles; /* current role */ 29145b2e6ec2340d698db506dff8c3df947b6e29452Harry Ciao type_set_t types; /* program executable type, or new object type */ 29245b2e6ec2340d698db506dff8c3df947b6e29452Harry Ciao ebitmap_t classes; /* process class, or new object class */ 29313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t new_role; /* new role */ 29413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct role_trans_rule *next; 29513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} role_trans_rule_t; 29613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 29713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct role_allow_rule { 29813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle role_set_t roles; /* current role */ 29913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle role_set_t new_roles; /* new roles */ 30013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct role_allow_rule *next; 30113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} role_allow_rule_t; 30213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 3036eeb71538ea29b639ac7549831cd1aa4da32722aEric Paristypedef struct filename_trans_rule { 3046eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris type_set_t stypes; 3056eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris type_set_t ttypes; 3066eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris uint32_t tclass; 3076eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris char *name; 3086eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris uint32_t otype; /* new type */ 3096eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris struct filename_trans_rule *next; 3106eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris} filename_trans_rule_t; 3116eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris 31213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct range_trans_rule { 31313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle type_set_t stypes; 31413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle type_set_t ttypes; 31513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle ebitmap_t tclasses; 31613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle mls_semantic_range_t trange; 31713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct range_trans_rule *next; 31813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} range_trans_rule_t; 31913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 32013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* 32113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * The configuration data includes security contexts for 32213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * initial SIDs, unlabeled file systems, TCP and UDP port numbers, 32313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * network interfaces, and nodes. This structure stores the 32413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * relevant data for one such entry. Entries of the same kind 32513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * (e.g. all initial SIDs) are linked together into a list. 32613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle */ 32713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct ocontext { 32813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle union { 32913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle char *name; /* name of initial SID, fs, netif, fstype, path */ 33013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct { 33113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint8_t protocol; 33213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint16_t low_port; 33313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint16_t high_port; 33413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle } port; /* TCP or UDP port information */ 33513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct { 33613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t addr; /* network order */ 33713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t mask; /* network order */ 33813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle } node; /* node information */ 33913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct { 34013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t addr[4]; /* network order */ 34113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t mask[4]; /* network order */ 34213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle } node6; /* IPv6 node information */ 343505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi uint32_t device; 344505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi uint16_t pirq; 345505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi struct { 34682030de5dc8d08a9417842156293c65fef9dc70cDaniel De Graaf uint64_t low_iomem; 34782030de5dc8d08a9417842156293c65fef9dc70cDaniel De Graaf uint64_t high_iomem; 348505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi } iomem; 349505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi struct { 350505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi uint32_t low_ioport; 351505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi uint32_t high_ioport; 352505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi } ioport; 35313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle } u; 35413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle union { 35513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t sclass; /* security class for genfs */ 35613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t behavior; /* labeling behavior for fs_use */ 35713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle } v; 35813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle context_struct_t context[2]; /* security context(s) */ 35913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle sepol_security_id_t sid[2]; /* SID(s) */ 36013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct ocontext *next; 36113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} ocontext_t; 36213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 36313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct genfs { 36413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle char *fstype; 36513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct ocontext *head; 36613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct genfs *next; 36713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} genfs_t; 36813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 36913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* symbol table array indices */ 37013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define SYM_COMMONS 0 37113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define SYM_CLASSES 1 37213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define SYM_ROLES 2 37313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define SYM_TYPES 3 37413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define SYM_USERS 4 37513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define SYM_BOOLS 5 37613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define SYM_LEVELS 6 37713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define SYM_CATS 7 37813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define SYM_NUM 8 37913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 38013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* object context array indices */ 38113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define OCON_ISID 0 /* initial SIDs */ 38213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define OCON_FS 1 /* unlabeled file systems */ 38313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define OCON_PORT 2 /* TCP and UDP port numbers */ 38413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define OCON_NETIF 3 /* network interfaces */ 38513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define OCON_NODE 4 /* nodes */ 38613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define OCON_FSUSE 5 /* fs_use */ 38713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define OCON_NODE6 6 /* IPv6 nodes */ 388505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi#define OCON_GENFS 7 /* needed for ocontext_supported */ 389505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi 390505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi/* object context array indices for Xen */ 391505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi#define OCON_XEN_ISID 0 /* initial SIDs */ 392505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi#define OCON_XEN_PIRQ 1 /* physical irqs */ 393505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi#define OCON_XEN_IOPORT 2 /* io ports */ 394505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi#define OCON_XEN_IOMEM 3 /* io memory */ 395505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi#define OCON_XEN_PCIDEVICE 4 /* pci devices */ 396f0290677091e7eee4a3724a2a86ede9e11f93802Daniel De Graaf#define OCON_XEN_DEVICETREE 5 /* device tree node */ 397505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi 398505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi/* OCON_NUM needs to be the largest index in any platform's ocontext array */ 39913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define OCON_NUM 7 40013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 40113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* section: module information */ 40213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 40313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* scope_index_t holds all of the symbols that are in scope in a 40413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * particular situation. The bitmaps are indices (and thus must 40513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * subtract one) into the global policydb->scope array. */ 40613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct scope_index { 40713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle ebitmap_t scope[SYM_NUM]; 40813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_classes_scope scope[SYM_CLASSES] 40913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_roles_scope scope[SYM_ROLES] 41013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_types_scope scope[SYM_TYPES] 41113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_users_scope scope[SYM_USERS] 41213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_bools_scope scope[SYM_BOOLS] 41313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_sens_scope scope[SYM_LEVELS] 41413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_cat_scope scope[SYM_CATS] 41513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 41613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* this array maps from class->value to the permissions within 41713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * scope. if bit (perm->value - 1) is set in map 41813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * class_perms_map[class->value - 1] then that permission is 41913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * enabled for this class within this decl. */ 42013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle ebitmap_t *class_perms_map; 42113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* total number of classes in class_perms_map array */ 42213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t class_perms_len; 42313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} scope_index_t; 42413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 42513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* a list of declarations for a particular avrule_decl */ 42613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 42713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* These two structs declare a block of policy that has TE and RBAC 42813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * statements and declarations. The root block (the global policy) 42913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * can never have an ELSE branch. */ 43013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct avrule_decl { 43113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t decl_id; 43213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t enabled; /* whether this block is enabled */ 43313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 43413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle cond_list_t *cond_list; 43513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle avrule_t *avrules; 43613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle role_trans_rule_t *role_tr_rules; 43713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle role_allow_rule_t *role_allow_rules; 43813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle range_trans_rule_t *range_tr_rules; 43913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle scope_index_t required; /* symbols needed to activate this block */ 44013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle scope_index_t declared; /* symbols declared within this block */ 44113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 4426eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris /* type transition rules with a 'name' component */ 4436eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris filename_trans_rule_t *filename_trans_rules; 4446eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris 44513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* for additive statements (type attribute, roles, and users) */ 44613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle symtab_t symtab[SYM_NUM]; 44713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 44813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* In a linked module this will contain the name of the module 44913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * from which this avrule_decl originated. */ 45013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle char *module_name; 45113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 45213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct avrule_decl *next; 45313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} avrule_decl_t; 45413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 45513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct avrule_block { 45613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle avrule_decl_t *branch_list; 45713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle avrule_decl_t *enabled; /* pointer to which branch is enabled. this is 45813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle used in linking and never written to disk */ 45913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define AVRULE_OPTIONAL 1 46013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t flags; /* any flags for this block, currently just optional */ 46113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct avrule_block *next; 46213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} avrule_block_t; 46313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 46413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* Every identifier has its own scope datum. The datum describes if 46513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * the item is to be included into the final policy during 46613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * expansion. */ 46713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct scope_datum { 46813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* Required for this decl */ 46913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define SCOPE_REQ 1 47013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* Declared in this decl */ 47113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define SCOPE_DECL 2 47213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t scope; 47313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t *decl_ids; 47413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t decl_ids_len; 47513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* decl_ids is a list of avrule_decl's that declare/require 47613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * this symbol. If scope==SCOPE_DECL then this is a list of 47713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * declarations. If the symbol may only be declared once 47813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * (types, bools) then decl_ids_len will be exactly 1. For 47913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * implicitly declared things (roles, users) then decl_ids_len 48013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * will be at least 1. */ 48113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} scope_datum_t; 48213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 48313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* The policy database */ 48413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct policydb { 48513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICY_KERN SEPOL_POLICY_KERN 48613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICY_BASE SEPOL_POLICY_BASE 48713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICY_MOD SEPOL_POLICY_MOD 48813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t policy_type; 48913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle char *name; 49013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle char *version; 491505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi int target_platform; 49213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 49313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* Set when the policydb is modified such that writing is unsupported */ 49413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle int unsupported_format; 49513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 49613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* Whether this policydb is mls, should always be set */ 49713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle int mls; 49813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 49913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* symbol tables */ 50013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle symtab_t symtab[SYM_NUM]; 50113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_commons symtab[SYM_COMMONS] 50213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_classes symtab[SYM_CLASSES] 50313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_roles symtab[SYM_ROLES] 50413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_types symtab[SYM_TYPES] 50513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_users symtab[SYM_USERS] 50613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_bools symtab[SYM_BOOLS] 50713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_levels symtab[SYM_LEVELS] 50813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_cats symtab[SYM_CATS] 50913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 51013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* symbol names indexed by (value - 1) */ 51113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle char **sym_val_to_name[SYM_NUM]; 51213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_common_val_to_name sym_val_to_name[SYM_COMMONS] 51313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_class_val_to_name sym_val_to_name[SYM_CLASSES] 51413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_role_val_to_name sym_val_to_name[SYM_ROLES] 51513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_type_val_to_name sym_val_to_name[SYM_TYPES] 51613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_user_val_to_name sym_val_to_name[SYM_USERS] 51713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_bool_val_to_name sym_val_to_name[SYM_BOOLS] 51813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_sens_val_to_name sym_val_to_name[SYM_LEVELS] 51913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define p_cat_val_to_name sym_val_to_name[SYM_CATS] 52013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 52113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* class, role, and user attributes indexed by (value - 1) */ 52213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle class_datum_t **class_val_to_struct; 52313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle role_datum_t **role_val_to_struct; 52413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle user_datum_t **user_val_to_struct; 52513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle type_datum_t **type_val_to_struct; 52613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 52713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* module stuff section -- used in parsing and for modules */ 52813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 52913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* keep track of the scope for every identifier. these are 53013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * hash tables, where the key is the identifier name and value 53113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * a scope_datum_t. as a convenience, one may use the 53213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle * p_*_macros (cf. struct scope_index_t declaration). */ 53313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle symtab_t scope[SYM_NUM]; 53413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 53513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* module rule storage */ 53613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle avrule_block_t *global; 53713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* avrule_decl index used for link/expand */ 53813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle avrule_decl_t **decl_val_to_struct; 53913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 54013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* compiled storage of rules - use for the kernel policy */ 54113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 54213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* type enforcement access vectors and transitions */ 54313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle avtab_t te_avtab; 54413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 54513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* bools indexed by (value - 1) */ 54613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle cond_bool_datum_t **bool_val_to_struct; 54713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* type enforcement conditional access vectors and transitions */ 54813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle avtab_t te_cond_avtab; 54913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* linked list indexing te_cond_avtab by conditional */ 55013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle cond_list_t *cond_list; 55113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 55213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* role transitions */ 55313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle role_trans_t *role_tr; 55413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 5556eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris /* type transition rules with a 'name' component */ 5566eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris filename_trans_t *filename_trans; 5576eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris 55813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* role allows */ 55913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle role_allow_t *role_allow; 56013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 56113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* security contexts of initial SIDs, unlabeled file systems, 56213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle TCP or UDP port numbers, network interfaces and nodes */ 56313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle ocontext_t *ocontexts[OCON_NUM]; 56413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 56513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* security contexts for files in filesystems that cannot support 56613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle a persistent label mapping or use another 56713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle fixed labeling behavior. */ 56813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle genfs_t *genfs; 56913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 57013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* range transitions */ 57113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle range_trans_t *range_tr; 57213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 57313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle ebitmap_t *type_attr_map; 57413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 57513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle ebitmap_t *attr_type_map; /* not saved in the binary policy */ 57613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 57713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle ebitmap_t policycaps; 57813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 57913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle /* this bitmap is referenced by type NOT the typical type-1 used in other 58013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle bitmaps. Someday the 0 bit may be used for global permissive */ 58113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle ebitmap_t permissive_map; 58213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 58313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle unsigned policyvers; 58413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 58513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle unsigned handle_unknown; 58613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} policydb_t; 58713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 58813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindlestruct sepol_policydb { 58913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct policydb p; 59013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle}; 59113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 59213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern int policydb_init(policydb_t * p); 59313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 59413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern int policydb_from_image(sepol_handle_t * handle, 59513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle void *data, size_t len, policydb_t * policydb); 59613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 59713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern int policydb_to_image(sepol_handle_t * handle, 59813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle policydb_t * policydb, void **newdata, 59913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle size_t * newlen); 60013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 60113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern int policydb_index_classes(policydb_t * p); 60213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 60313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern int policydb_index_bools(policydb_t * p); 60413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 60513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern int policydb_index_others(sepol_handle_t * handle, policydb_t * p, 60613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle unsigned int verbose); 60713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 60813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern int policydb_reindex_users(policydb_t * p); 60913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 61013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void policydb_destroy(policydb_t * p); 61113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 61213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern int policydb_load_isids(policydb_t * p, sidtab_t * s); 61313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 61413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* Deprecated */ 61513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern int policydb_context_isvalid(const policydb_t * p, 61613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle const context_struct_t * c); 61713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 61813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void symtabs_destroy(symtab_t * symtab); 61913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern int scope_destroy(hashtab_key_t key, hashtab_datum_t datum, void *p); 62013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef void (*hashtab_destroy_func_t) (hashtab_key_t k, hashtab_datum_t d, 62113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle void *args); 62213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern hashtab_destroy_func_t get_symtab_destroy_func(int sym_num); 62313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 62413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void class_perm_node_init(class_perm_node_t * x); 62513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void type_set_init(type_set_t * x); 62613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void type_set_destroy(type_set_t * x); 62713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern int type_set_cpy(type_set_t * dst, type_set_t * src); 62813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern int type_set_or_eq(type_set_t * dst, type_set_t * other); 62913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void role_set_init(role_set_t * x); 63013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void role_set_destroy(role_set_t * x); 63113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void avrule_init(avrule_t * x); 63213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void avrule_destroy(avrule_t * x); 63313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void avrule_list_destroy(avrule_t * x); 63413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void role_trans_rule_init(role_trans_rule_t * x); 63513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void role_trans_rule_list_destroy(role_trans_rule_t * x); 6366eeb71538ea29b639ac7549831cd1aa4da32722aEric Parisextern void filename_trans_rule_init(filename_trans_rule_t * x); 6376eeb71538ea29b639ac7549831cd1aa4da32722aEric Parisextern void filename_trans_rule_list_destroy(filename_trans_rule_t * x); 63813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 63913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void role_datum_init(role_datum_t * x); 64013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void role_datum_destroy(role_datum_t * x); 64113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void role_allow_rule_init(role_allow_rule_t * x); 64213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void role_allow_rule_destroy(role_allow_rule_t * x); 64313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void role_allow_rule_list_destroy(role_allow_rule_t * x); 64413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void range_trans_rule_init(range_trans_rule_t *x); 64513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void range_trans_rule_destroy(range_trans_rule_t *x); 64613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void range_trans_rule_list_destroy(range_trans_rule_t *x); 64713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void type_datum_init(type_datum_t * x); 64813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void type_datum_destroy(type_datum_t * x); 64913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void user_datum_init(user_datum_t * x); 65013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void user_datum_destroy(user_datum_t * x); 65113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void level_datum_init(level_datum_t * x); 65213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void level_datum_destroy(level_datum_t * x); 65313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void cat_datum_init(cat_datum_t * x); 65413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void cat_datum_destroy(cat_datum_t * x); 65513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 65613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern int check_assertions(sepol_handle_t * handle, 65713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle policydb_t * p, avrule_t * avrules); 65813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 65913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern int symtab_insert(policydb_t * x, uint32_t sym, 66013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle hashtab_key_t key, hashtab_datum_t datum, 66113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t scope, uint32_t avrule_decl_id, 66213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle uint32_t * value); 66313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 66413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* A policy "file" may be a memory region referenced by a (data, len) pair 66513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle or a file referenced by a FILE pointer. */ 66613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindletypedef struct policy_file { 66713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define PF_USE_MEMORY 0 66813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define PF_USE_STDIO 1 66913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define PF_LEN 2 /* total up length in len field */ 67013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle unsigned type; 67113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle char *data; 67213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle size_t len; 67313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle size_t size; 67413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle FILE *fp; 67513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct sepol_handle *handle; 67613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle} policy_file_t; 67713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 67813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindlestruct sepol_policy_file { 67913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct policy_file pf; 68013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle}; 68113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 68213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern void policy_file_init(policy_file_t * x); 68313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 68413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern int policydb_read(policydb_t * p, struct policy_file *fp, 68513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle unsigned int verbose); 68613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern int avrule_read_list(policydb_t * p, avrule_t ** avrules, 68713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle struct policy_file *fp); 68813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 68913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindleextern int policydb_write(struct policydb *p, struct policy_file *pf); 690505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzziextern int policydb_set_target_platform(policydb_t *p, int platform); 69113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 69213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define PERM_SYMTAB_SIZE 32 69313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 69413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* Identify specific policy version changes */ 69513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_VERSION_BASE 15 69613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_VERSION_BOOL 16 69713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_VERSION_IPV6 17 69813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_VERSION_NLCLASS 18 69913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_VERSION_VALIDATETRANS 19 70013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_VERSION_MLS 19 70113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_VERSION_AVTAB 20 70213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_VERSION_RANGETRANS 21 70313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_VERSION_POLCAP 22 70413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_VERSION_PERMISSIVE 23 705f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle#define POLICYDB_VERSION_BOUNDARY 24 7066eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris#define POLICYDB_VERSION_FILENAME_TRANS 25 70745b2e6ec2340d698db506dff8c3df947b6e29452Harry Ciao#define POLICYDB_VERSION_ROLETRANS 26 70809c783c9a36cd47216df827c5d2c21ec8cd613e2Eric Paris#define POLICYDB_VERSION_NEW_OBJECT_DEFAULTS 27 709693f5241fdd5ae7e89d4312b85443c0fc1b1a57dEric Paris#define POLICYDB_VERSION_DEFAULT_TYPE 28 7109eefe11b3a94307a3f5432316a59d1f8e3268429Richard Haines#define POLICYDB_VERSION_CONSTRAINT_NAMES 29 71180bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define POLICYDB_VERSION_XEN_DEVICETREE 30 /* Xen-specific */ 71280bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define POLICYDB_VERSION_IOCTL_OPERATIONS 30 /* Linux-specific */ 71313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 71413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* Range of policy versions we understand*/ 71513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_VERSION_MIN POLICYDB_VERSION_BASE 71680bc7ee8faaddfa7a650994fa82a57f41a9e7475Jeff Vander Stoep#define POLICYDB_VERSION_MAX POLICYDB_VERSION_IOCTL_OPERATIONS 71713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 71813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* Module versions and specific changes*/ 719f7917ea9cf6af752de98a1e742152d813028c669Caleb Case#define MOD_POLICYDB_VERSION_BASE 4 720f7917ea9cf6af752de98a1e742152d813028c669Caleb Case#define MOD_POLICYDB_VERSION_VALIDATETRANS 5 721f7917ea9cf6af752de98a1e742152d813028c669Caleb Case#define MOD_POLICYDB_VERSION_MLS 5 722f7917ea9cf6af752de98a1e742152d813028c669Caleb Case#define MOD_POLICYDB_VERSION_RANGETRANS 6 723f7917ea9cf6af752de98a1e742152d813028c669Caleb Case#define MOD_POLICYDB_VERSION_MLS_USERS 6 724f7917ea9cf6af752de98a1e742152d813028c669Caleb Case#define MOD_POLICYDB_VERSION_POLCAP 7 725f7917ea9cf6af752de98a1e742152d813028c669Caleb Case#define MOD_POLICYDB_VERSION_PERMISSIVE 8 726f7917ea9cf6af752de98a1e742152d813028c669Caleb Case#define MOD_POLICYDB_VERSION_BOUNDARY 9 727f7917ea9cf6af752de98a1e742152d813028c669Caleb Case#define MOD_POLICYDB_VERSION_BOUNDARY_ALIAS 10 7286eeb71538ea29b639ac7549831cd1aa4da32722aEric Paris#define MOD_POLICYDB_VERSION_FILENAME_TRANS 11 72945b2e6ec2340d698db506dff8c3df947b6e29452Harry Ciao#define MOD_POLICYDB_VERSION_ROLETRANS 12 7308072dba146b213a3f12a394596537e73f1b9339cHarry Ciao#define MOD_POLICYDB_VERSION_ROLEATTRIB 13 731f87ae538256eff759cb67c448416dc14031849a1Harry Ciao#define MOD_POLICYDB_VERSION_TUNABLE_SEP 14 73209c783c9a36cd47216df827c5d2c21ec8cd613e2Eric Paris#define MOD_POLICYDB_VERSION_NEW_OBJECT_DEFAULTS 15 733693f5241fdd5ae7e89d4312b85443c0fc1b1a57dEric Paris#define MOD_POLICYDB_VERSION_DEFAULT_TYPE 16 7344bc2cd49d4bb5cfb54c8133a9e9881e8f18f45cdDan Walsh#define MOD_POLICYDB_VERSION_CONSTRAINT_NAMES 17 73513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 73613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define MOD_POLICYDB_VERSION_MIN MOD_POLICYDB_VERSION_BASE 7374bc2cd49d4bb5cfb54c8133a9e9881e8f18f45cdDan Walsh#define MOD_POLICYDB_VERSION_MAX MOD_POLICYDB_VERSION_CONSTRAINT_NAMES 73813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 73913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_CONFIG_MLS 1 74013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 741f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle/* macros to check policy feature */ 742f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle 743f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle/* TODO: add other features here */ 744f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle 745f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle#define policydb_has_boundary_feature(p) \ 746f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle (((p)->policy_type == POLICY_KERN \ 747f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle && p->policyvers >= POLICYDB_VERSION_BOUNDARY) || \ 748f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle ((p)->policy_type != POLICY_KERN \ 749f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle && p->policyvers >= MOD_POLICYDB_VERSION_BOUNDARY)) 750f470207454f5f6ce539aa543e5168a07d667254bJoshua Brindle 75113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* the config flags related to unknown classes/perms are bits 2 and 3 */ 75213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define DENY_UNKNOWN SEPOL_DENY_UNKNOWN 75313cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define REJECT_UNKNOWN SEPOL_REJECT_UNKNOWN 75413cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define ALLOW_UNKNOWN SEPOL_ALLOW_UNKNOWN 75513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 75613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_CONFIG_UNKNOWN_MASK (DENY_UNKNOWN | REJECT_UNKNOWN | ALLOW_UNKNOWN) 75713cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 75813cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define OBJECT_R "object_r" 75913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define OBJECT_R_VAL 1 76013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 76113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_MAGIC SELINUX_MAGIC 76213cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_STRING "SE Linux" 763505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi#define POLICYDB_XEN_STRING "XenFlask" 764505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi#define POLICYDB_STRING_MAX_LENGTH 32 76513cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_MOD_MAGIC SELINUX_MOD_MAGIC 76613cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#define POLICYDB_MOD_STRING "SE Linux Module" 767505c75aad7f16e0db9ccfeb04eaa70f242e6b060Paul Nuzzi 768ed7a6ba24ad3241e696fa7bc9bb56bb4f373147bdcashman__END_DECLS 76913cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle#endif /* _POLICYDB_H_ */ 77013cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle 77113cd4c8960688af11ad23b4c946149015c80d54Joshua Brindle/* FLASK */ 772