1/* Authors: Joshua Brindle  <jbrindle@tresys.com>
2 *	    Jason Tang	    <jtang@tresys.com>
3 *
4 * Copyright (C) 2005 Tresys Technology, LLC
5 *
6 *  This library is free software; you can redistribute it and/or
7 *  modify it under the terms of the GNU Lesser General Public
8 *  License as published by the Free Software Foundation; either
9 *  version 2.1 of the License, or (at your option) any later version.
10 *
11 *  This library is distributed in the hope that it will be useful,
12 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14 *  Lesser General Public License for more details.
15 *
16 *  You should have received a copy of the GNU Lesser General Public
17 *  License along with this library; if not, write to the Free Software
18 *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
19 */
20
21#ifndef _SEMANAGE_HANDLE_H_
22#define _SEMANAGE_HANDLE_H_
23
24#include <stdint.h>
25
26/* All accesses with semanage are through a "semanage_handle".  The
27 * handle may ultimately reference local config files,
28 * the binary policy file, a module store, or a policy management server.
29 */
30struct semanage_handle;
31typedef struct semanage_handle semanage_handle_t;
32
33/* Create and return a semanage handle.
34   The handle is initially in the disconnected state. */
35semanage_handle_t *semanage_handle_create(void);
36
37/* Deallocate all space associated with a semanage_handle_t, including
38 * the pointer itself.	CAUTION: this function does not disconnect
39 * from the backend; be sure that a semanage_disconnect() was
40 * previously called if the handle was connected. */
41void semanage_handle_destroy(semanage_handle_t *);
42
43/* This is the type of connection to the store, for now only
44 * direct is supported */
45enum semanage_connect_type {
46	SEMANAGE_CON_INVALID = 0, SEMANAGE_CON_DIRECT,
47	SEMANAGE_CON_POLSERV_LOCAL, SEMANAGE_CON_POLSERV_REMOTE
48};
49
50/* This function allows you to specify the store to  connect to.
51 * It must be called after semanage_handle_create but before
52 * semanage_connect. The argument should be the full path to the store.
53 */
54void semanage_select_store(semanage_handle_t * handle, char *path,
55			   enum semanage_connect_type storetype);
56
57/* Just reload the policy */
58int semanage_reload_policy(semanage_handle_t * handle);
59
60/* set whether to reload the policy or not after a commit,
61 * 1 for yes (default), 0 for no */
62void semanage_set_reload(semanage_handle_t * handle, int do_reload);
63
64/* set whether to rebuild the policy on commit, even if no
65 * changes were performed.
66 * 1 for yes, 0 for no (default) */
67void semanage_set_rebuild(semanage_handle_t * handle, int do_rebuild);
68
69/* Fills *compiler_path with the location of the hll compiler sh->conf->compiler_directory_path
70 * corresponding to lang_ext.
71 * Upon success returns 0, -1 on error. */
72int semanage_get_hll_compiler_path(semanage_handle_t *sh, char *lang_ext, char **compiler_path);
73
74/* create the store if it does not exist, this only has an effect on
75 * direct connections and must be called before semanage_connect
76 * 1 for yes, 0 for no (default) */
77void semanage_set_create_store(semanage_handle_t * handle, int create_store);
78
79/*Get whether or not dontaudits will be disabled upon commit */
80int semanage_get_disable_dontaudit(semanage_handle_t * handle);
81
82/* Set whether or not to disable dontaudits upon commit */
83void semanage_set_disable_dontaudit(semanage_handle_t * handle, int disable_dontaudit);
84
85/* Set whether or not to execute setfiles to check file contexts upon commit */
86void semanage_set_check_contexts(semanage_handle_t * sh, int do_check_contexts);
87
88/* Get the default priority. */
89uint16_t semanage_get_default_priority(semanage_handle_t *sh);
90
91/* Set the default priority. */
92int semanage_set_default_priority(semanage_handle_t *sh, uint16_t priority);
93
94/* Check whether policy is managed via libsemanage on this system.
95 * Must be called prior to trying to connect.
96 * Return 1 if policy is managed via libsemanage on this system,
97 * 0 if policy is not managed, or -1 on error.
98 */
99int semanage_is_managed(semanage_handle_t *);
100
101/* "Connect" to a manager based on the configuration and
102 * associate the provided handle with the connection.
103 * If the connect fails then this function returns a negative value,
104 * else it returns zero.
105 */
106int semanage_connect(semanage_handle_t *);
107
108/* Disconnect from the manager given by the handle.  If already
109 * disconnected then this function does nothing.  Return 0 if
110 * disconnected properly or already disconnected, negative value on
111 * error. */
112int semanage_disconnect(semanage_handle_t *);
113
114/* Attempt to obtain a transaction lock on the manager.	 If another
115 * process has the lock then this function may block, depending upon
116 * the timeout value in the handle.
117 *
118 * Note that if the semanage_handle has not yet obtained a transaction
119 * lock whenever a writer function is called, there will be an
120 * implicit call to this function. */
121int semanage_begin_transaction(semanage_handle_t *);
122
123/* Attempt to commit all changes since this transaction began.	If the
124 * commit is successful then increment the "policy sequence number"
125 * and then release the transaction lock.  Return that policy number
126 * afterwards, or -1 on error.
127 */
128int semanage_commit(semanage_handle_t *);
129
130#define SEMANAGE_CAN_READ 1
131#define SEMANAGE_CAN_WRITE 2
132/* returns SEMANAGE_CAN_READ or SEMANAGE_CAN_WRITE if the store is readable
133 * or writable, respectively. <0 if an error occured */
134int semanage_access_check(semanage_handle_t * sh);
135
136/* returns 0 if not connected, 1 if connected */
137int semanage_is_connected(semanage_handle_t * sh);
138
139/* returns 1 if policy is MLS, 0 otherwise. */
140int semanage_mls_enabled(semanage_handle_t *sh);
141
142/* Change to alternate semanage root path */
143int semanage_set_root(const char *path);
144
145/* Get the current semanage root path */
146const char * semanage_root(void);
147
148/* Get whether or not needless unused branch of tunables would be preserved */
149int semanage_get_preserve_tunables(semanage_handle_t * handle);
150
151/* Set whether or not to preserve the needless unused branch of tunables */
152void semanage_set_preserve_tunables(semanage_handle_t * handle, int preserve_tunables);
153
154/* Get the flag value for whether or not caching is ignored for compiled CIL modules from HLL files */
155int semanage_get_ignore_module_cache(semanage_handle_t *handle);
156
157/* Set semanage_handle flag for whether or not to ignore caching of compiled CIL modules from HLL files */
158void semanage_set_ignore_module_cache(semanage_handle_t *handle, int ignore_module_cache);
159
160/* set the store root path for semanage output files */
161void semanage_set_store_root(semanage_handle_t *sh, const char *store_root);
162
163/* META NOTES
164 *
165 * For all functions a non-negative number indicates success. For some
166 * functions a >=0 returned value is the "policy sequence number".  This
167 * number keeps tracks of policy revisions and is used to detect if
168 * one semanage client has committed policy changes while another is
169 * still connected.
170 */
171
172#endif
173