1#include <string>
2
3#include <selinux/android.h>
4#include <selinux/avc.h>
5
6namespace android {
7
8class AccessControl {
9public:
10    AccessControl();
11
12    using Context = std::unique_ptr<char, decltype(&freecon)>;
13    Context getContext(pid_t sourcePid);
14
15    bool canAdd(const std::string& fqName, const Context &context, pid_t pid);
16    bool canGet(const std::string& fqName, pid_t pid);
17    bool canList(pid_t pid);
18
19private:
20
21    bool checkPermission(const Context &context, pid_t sourceAuditPid, const char *targetContext, const char *perm, const char *interface);
22    bool checkPermission(const Context &context, pid_t sourcePid, const char *perm, const char *interface);
23
24    static int auditCallback(void *data, security_class_t cls, char *buf, size_t len);
25
26    char*                  mSeContext;
27    struct selabel_handle* mSeHandle;
28    union selinux_callback mSeCallbacks;
29};
30
31} // namespace android
32