1
2/* -*- linux-c -*- */
3
4/*
5 * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
6 */
7
8#ifndef _SEPOL_POLICYDB_SERVICES_H_
9#define _SEPOL_POLICYDB_SERVICES_H_
10
11/*
12 * Security server interface.
13 */
14
15#include <sepol/policydb/flask_types.h>
16#include <sepol/policydb/policydb.h>
17#include <stddef.h>
18#include <sys/cdefs.h>
19
20__BEGIN_DECLS
21
22/* Set the policydb and sidtab structures to be used by
23   the service functions.  If not set, then these default
24   to private structures within libsepol that can only be
25   initialized and accessed via the service functions themselves.
26   Setting the structures explicitly allows a program to directly
27   manipulate them, e.g. checkpolicy populates the structures directly
28   from a source policy rather than from a binary policy. */
29extern int sepol_set_policydb(policydb_t * p);
30extern int sepol_set_sidtab(sidtab_t * s);
31
32/* Modify a policydb for boolean settings. */
33int sepol_genbools_policydb(policydb_t * policydb, const char *booleans);
34
35/* Modify a policydb for user settings. */
36int sepol_genusers_policydb(policydb_t * policydb, const char *usersdir);
37
38/* Load the security policy. This initializes the policydb
39   and sidtab based on the provided binary policy. */
40extern int sepol_load_policy(void *data, size_t len);
41
42/*
43 * Compute access vectors based on a SID pair for
44 * the permissions in a particular class.
45 */
46extern int sepol_compute_av(sepol_security_id_t ssid,	/* IN */
47			    sepol_security_id_t tsid,	/* IN */
48			    sepol_security_class_t tclass,	/* IN */
49			    sepol_access_vector_t requested,	/* IN */
50			    struct sepol_av_decision *avd);	/* OUT */
51
52/* Same as above, but also return the reason(s) for any
53   denials of the requested permissions. */
54#define SEPOL_COMPUTEAV_TE   1
55#define SEPOL_COMPUTEAV_CONS 2
56#define SEPOL_COMPUTEAV_RBAC 4
57extern int sepol_compute_av_reason(sepol_security_id_t ssid,
58				   sepol_security_id_t tsid,
59				   sepol_security_class_t tclass,
60				   sepol_access_vector_t requested,
61				   struct sepol_av_decision *avd,
62				   unsigned int *reason);
63
64/*
65 * Same as above, but also returns the constraint expression calculations
66 * whether allowed or denied in a buffer. This buffer is allocated by
67 * this call and must be free'd by the caller using free(3). The contraint
68 * buffer will contain any constraints in infix notation.
69 * If the SHOW_GRANTED flag is set it will show granted and denied
70 * constraints. The default is to show only denied constraints.
71 */
72#define SHOW_GRANTED 1
73extern int sepol_compute_av_reason_buffer(sepol_security_id_t ssid,
74				   sepol_security_id_t tsid,
75				   sepol_security_class_t tclass,
76				   sepol_access_vector_t requested,
77				   struct sepol_av_decision *avd,
78				   unsigned int *reason,
79				   char **reason_buf,
80				   unsigned int flags);
81
82/*
83 * Returns the mls/validatetrans constraint expression calculations in
84 * a buffer that must be free'd by the caller using free(3).
85 * If the SHOW_GRANTED flag is set it will show granted and denied
86 * mls/validatetrans (the default is to show only those denied).
87 */
88extern int sepol_validate_transition_reason_buffer(sepol_security_id_t oldsid,
89					sepol_security_id_t newsid,
90					sepol_security_id_t tasksid,
91					sepol_security_class_t tclass,
92					char **reason_buf,
93					unsigned int flags);
94
95/*
96 * Return a class ID associated with the class string representation
97 * specified by `class_name'.
98 */
99extern int sepol_string_to_security_class(const char *class_name,
100					sepol_security_class_t  *tclass);
101
102/*
103 * Return a permission av bit associated with tclass and the string
104 * representation of the `perm_name'.
105 */
106extern int sepol_string_to_av_perm(sepol_security_class_t tclass,
107					const char *perm_name,
108					sepol_access_vector_t *av);
109
110/*
111 * Compute a SID to use for labeling a new object in the
112 * class `tclass' based on a SID pair.
113 */
114extern int sepol_transition_sid(sepol_security_id_t ssid,	/* IN */
115				sepol_security_id_t tsid,	/* IN */
116				sepol_security_class_t tclass,	/* IN */
117				sepol_security_id_t * out_sid);	/* OUT */
118
119/*
120 * Compute a SID to use when selecting a member of a
121 * polyinstantiated object of class `tclass' based on
122 * a SID pair.
123 */
124extern int sepol_member_sid(sepol_security_id_t ssid,	/* IN */
125			    sepol_security_id_t tsid,	/* IN */
126			    sepol_security_class_t tclass,	/* IN */
127			    sepol_security_id_t * out_sid);	/* OUT */
128
129/*
130 * Compute a SID to use for relabeling an object in the
131 * class `tclass' based on a SID pair.
132 */
133extern int sepol_change_sid(sepol_security_id_t ssid,	/* IN */
134			    sepol_security_id_t tsid,	/* IN */
135			    sepol_security_class_t tclass,	/* IN */
136			    sepol_security_id_t * out_sid);	/* OUT */
137
138/*
139 * Write the security context string representation of
140 * the context associated with `sid' into a dynamically
141 * allocated string of the correct size.  Set `*scontext'
142 * to point to this string and set `*scontext_len' to
143 * the length of the string.
144 */
145extern int sepol_sid_to_context(sepol_security_id_t sid,	/* IN */
146				sepol_security_context_t * scontext,	/* OUT */
147				size_t * scontext_len);	/* OUT */
148
149/*
150 * Return a SID associated with the security context that
151 * has the string representation specified by `scontext'.
152 */
153extern int sepol_context_to_sid(const sepol_security_context_t scontext,	/* IN */
154				size_t scontext_len,	/* IN */
155				sepol_security_id_t * out_sid);	/* OUT */
156
157/*
158 * Generate the set of SIDs for legal security contexts
159 * for a given user that can be reached by `fromsid'.
160 * Set `*sids' to point to a dynamically allocated
161 * array containing the set of SIDs.  Set `*nel' to the
162 * number of elements in the array.
163 */
164extern int sepol_get_user_sids(sepol_security_id_t callsid,
165			       char *username,
166			       sepol_security_id_t ** sids, uint32_t * nel);
167
168/*
169 * Return the SIDs to use for an unlabeled file system
170 * that is being mounted from the device with the
171 * the kdevname `name'.  The `fs_sid' SID is returned for
172 * the file system and the `file_sid' SID is returned
173 * for all files within that file system.
174 */
175extern int sepol_fs_sid(char *dev,	/* IN */
176			sepol_security_id_t * fs_sid,	/* OUT  */
177			sepol_security_id_t * file_sid);	/* OUT */
178
179/*
180 * Return the SID of the port specified by
181 * `domain', `type', `protocol', and `port'.
182 */
183extern int sepol_port_sid(uint16_t domain,
184			  uint16_t type,
185			  uint8_t protocol,
186			  uint16_t port, sepol_security_id_t * out_sid);
187
188/*
189 * Return the SIDs to use for a network interface
190 * with the name `name'.  The `if_sid' SID is returned for
191 * the interface and the `msg_sid' SID is returned as
192 * the default SID for messages received on the
193 * interface.
194 */
195extern int sepol_netif_sid(char *name,
196			   sepol_security_id_t * if_sid,
197			   sepol_security_id_t * msg_sid);
198
199/*
200 * Return the SID of the node specified by the address
201 * `addr' where `addrlen' is the length of the address
202 * in bytes and `domain' is the communications domain or
203 * address family in which the address should be interpreted.
204 */
205extern int sepol_node_sid(uint16_t domain,
206			  void *addr,
207			  size_t addrlen, sepol_security_id_t * out_sid);
208
209/*
210 * Return a value indicating how to handle labeling for the
211 * the specified filesystem type, and optionally return a SID
212 * for the filesystem object.
213 */
214#define SECURITY_FS_USE_XATTR 1	/* use xattr */
215#define SECURITY_FS_USE_TRANS 2	/* use transition SIDs, e.g. devpts/tmpfs */
216#define SECURITY_FS_USE_TASK  3	/* use task SIDs, e.g. pipefs/sockfs */
217#define SECURITY_FS_USE_GENFS 4	/* use the genfs support */
218#define SECURITY_FS_USE_NONE  5	/* no labeling support */
219extern int sepol_fs_use(const char *fstype,	/* IN */
220			unsigned int *behavior,	/* OUT */
221			sepol_security_id_t * sid);	/* OUT  */
222
223/*
224 * Return the SID to use for a file in a filesystem
225 * that cannot support a persistent label mapping or use another
226 * fixed labeling behavior like transition SIDs or task SIDs.
227 */
228extern int sepol_genfs_sid(const char *fstype,	/* IN */
229			   const char *name,	/* IN */
230			   sepol_security_class_t sclass,	/* IN */
231			   sepol_security_id_t * sid);	/* OUT  */
232
233__END_DECLS
234#endif
235