label.h revision 35b01083fe5e34cbd318a78ef9b1a13432ae24d9 
1/*
2 * Labeling interface for userspace object managers and others.
3 *
4 * Author : Eamon Walsh <ewalsh@tycho.nsa.gov>
5 */
6#ifndef _SELABEL_H_
7#define _SELABEL_H_
8
9#include <sys/types.h>
10#include <selinux/selinux.h>
11
12#ifdef __cplusplus
13extern "C" {
14#endif
15
16/*
17 * Opaque type used for all label handles.
18 */
19
20struct selabel_handle;
21
22/*
23 * Available backends.
24 */
25
26/* file contexts */
27#define SELABEL_CTX_FILE	0
28/* media contexts */
29#define SELABEL_CTX_MEDIA	1
30/* x contexts */
31#define SELABEL_CTX_X		2
32/* db objects */
33#define SELABEL_CTX_DB		3
34/* Android property service contexts */
35#define SELABEL_CTX_ANDROID_PROP 4
36
37/*
38 * Available options
39 */
40
41/* no-op option, useful for unused slots in an array of options */
42#define SELABEL_OPT_UNUSED	0
43/* validate contexts before returning them (boolean value) */
44#define SELABEL_OPT_VALIDATE	1
45/* don't use local customizations to backend data (boolean value) */
46#define SELABEL_OPT_BASEONLY	2
47/* specify an alternate path to use when loading backend data */
48#define SELABEL_OPT_PATH	3
49/* select a subset of the search space as an optimization (file backend) */
50#define SELABEL_OPT_SUBSET	4
51/* total number of options */
52#define SELABEL_NOPT		5
53
54/*
55 * Label operations
56 */
57
58/**
59 * selabel_open - Create a labeling handle.
60 * @backend: one of the constants specifying a supported labeling backend.
61 * @opts: array of selabel_opt structures specifying label options or NULL.
62 * @nopts: number of elements in opts array or zero for no options.
63 *
64 * Open a labeling backend for use.  The available backend identifiers are
65 * listed above.  Options may be provided via the opts parameter; available
66 * options are listed above.  Not all options may be supported by every
67 * backend.  Return value is the created handle on success or NULL with
68 * @errno set on failure.
69 */
70struct selabel_handle *selabel_open(unsigned int backend,
71				    struct selinux_opt *opts, unsigned nopts);
72
73/**
74 * selabel_close - Close a labeling handle.
75 * @handle: specifies handle to close
76 *
77 * Destroy the specified handle, closing files, freeing allocated memory,
78 * etc.  The handle may not be further used after it has been closed.
79 */
80void selabel_close(struct selabel_handle *handle);
81
82/**
83 * selabel_lookup - Perform labeling lookup operation.
84 * @handle: specifies backend instance to query
85 * @con: returns the appropriate context with which to label the object
86 * @key: string input to lookup operation
87 * @type: numeric input to the lookup operation
88 *
89 * Perform a labeling lookup operation.  Return %0 on success, -%1 with
90 * @errno set on failure.  The key and type arguments are the inputs to the
91 * lookup operation; appropriate values are dictated by the backend in use.
92 * The result is returned in the memory pointed to by @con and must be freed
93 * by the user with freecon().
94 */
95int selabel_lookup(struct selabel_handle *handle, security_context_t *con,
96		   const char *key, int type);
97int selabel_lookup_raw(struct selabel_handle *handle, security_context_t *con,
98		       const char *key, int type);
99
100/**
101 * selabel_stats - log labeling operation statistics.
102 * @handle: specifies backend instance to query
103 *
104 * Log a message with information about the number of queries performed,
105 * number of unused matching entries, or other operational statistics.
106 * Message is backend-specific, some backends may not output a message.
107 */
108void selabel_stats(struct selabel_handle *handle);
109
110/*
111 * Type codes used by specific backends
112 */
113
114/* X backend */
115#define SELABEL_X_PROP		1
116#define SELABEL_X_EXT		2
117#define SELABEL_X_CLIENT	3
118#define SELABEL_X_EVENT		4
119#define SELABEL_X_SELN		5
120#define SELABEL_X_POLYPROP	6
121#define SELABEL_X_POLYSELN	7
122
123/* DB backend */
124#define SELABEL_DB_DATABASE	1
125#define SELABEL_DB_SCHEMA	2
126#define SELABEL_DB_TABLE	3
127#define SELABEL_DB_COLUMN	4
128#define SELABEL_DB_SEQUENCE	5
129#define SELABEL_DB_VIEW		6
130#define SELABEL_DB_PROCEDURE	7
131#define SELABEL_DB_BLOB		8
132#define SELABEL_DB_TUPLE	9
133#define SELABEL_DB_LANGUAGE	10
134
135#ifdef __cplusplus
136}
137#endif
138#endif	/* _SELABEL_H_ */
139