1 /* 2 * Copyright 2011 Tresys Technology, LLC. All rights reserved. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions are met: 6 * 7 * 1. Redistributions of source code must retain the above copyright notice, 8 * this list of conditions and the following disclaimer. 9 * 10 * 2. Redistributions in binary form must reproduce the above copyright notice, 11 * this list of conditions and the following disclaimer in the documentation 12 * and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY TRESYS TECHNOLOGY, LLC ``AS IS'' AND ANY EXPRESS 15 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 16 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO 17 * EVENT SHALL TRESYS TECHNOLOGY, LLC OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, 18 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 19 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 21 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE 22 * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 23 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 24 * 25 * The views and conclusions contained in the software and documentation are those 26 * of the authors and should not be interpreted as representing official policies, 27 * either expressed or implied, of Tresys Technology, LLC. 28 */ 29 30 #ifndef CIL_INTERNAL_H_ 31 #define CIL_INTERNAL_H_ 32 33 #include <stdlib.h> 34 #include <stdio.h> 35 #include <stdint.h> 36 #include <arpa/inet.h> 37 38 #include <sepol/policydb/services.h> 39 #include <sepol/policydb/policydb.h> 40 #include <sepol/policydb/flask_types.h> 41 42 #include <cil/cil.h> 43 44 #include "cil_flavor.h" 45 #include "cil_tree.h" 46 #include "cil_symtab.h" 47 #include "cil_mem.h" 48 49 #define CIL_MAX_NAME_LENGTH 2048 50 51 52 enum cil_pass { 53 CIL_PASS_INIT = 0, 54 55 CIL_PASS_TIF, 56 CIL_PASS_IN, 57 CIL_PASS_BLKIN_LINK, 58 CIL_PASS_BLKIN_COPY, 59 CIL_PASS_BLKABS, 60 CIL_PASS_MACRO, 61 CIL_PASS_CALL1, 62 CIL_PASS_CALL2, 63 CIL_PASS_ALIAS1, 64 CIL_PASS_ALIAS2, 65 CIL_PASS_MISC1, 66 CIL_PASS_MLS, 67 CIL_PASS_MISC2, 68 CIL_PASS_MISC3, 69 70 CIL_PASS_NUM 71 }; 72 73 74 /* 75 Keywords 76 */ 77 char *CIL_KEY_CONS_T1; 78 char *CIL_KEY_CONS_T2; 79 char *CIL_KEY_CONS_T3; 80 char *CIL_KEY_CONS_R1; 81 char *CIL_KEY_CONS_R2; 82 char *CIL_KEY_CONS_R3; 83 char *CIL_KEY_CONS_U1; 84 char *CIL_KEY_CONS_U2; 85 char *CIL_KEY_CONS_U3; 86 char *CIL_KEY_CONS_L1; 87 char *CIL_KEY_CONS_L2; 88 char *CIL_KEY_CONS_H1; 89 char *CIL_KEY_CONS_H2; 90 char *CIL_KEY_AND; 91 char *CIL_KEY_OR; 92 char *CIL_KEY_NOT; 93 char *CIL_KEY_EQ; 94 char *CIL_KEY_NEQ; 95 char *CIL_KEY_CONS_DOM; 96 char *CIL_KEY_CONS_DOMBY; 97 char *CIL_KEY_CONS_INCOMP; 98 char *CIL_KEY_CONDTRUE; 99 char *CIL_KEY_CONDFALSE; 100 char *CIL_KEY_SELF; 101 char *CIL_KEY_OBJECT_R; 102 char *CIL_KEY_STAR; 103 char *CIL_KEY_TCP; 104 char *CIL_KEY_UDP; 105 char *CIL_KEY_DCCP; 106 char *CIL_KEY_SCTP; 107 char *CIL_KEY_AUDITALLOW; 108 char *CIL_KEY_TUNABLEIF; 109 char *CIL_KEY_ALLOW; 110 char *CIL_KEY_DONTAUDIT; 111 char *CIL_KEY_TYPETRANSITION; 112 char *CIL_KEY_TYPECHANGE; 113 char *CIL_KEY_CALL; 114 char *CIL_KEY_TUNABLE; 115 char *CIL_KEY_XOR; 116 char *CIL_KEY_ALL; 117 char *CIL_KEY_RANGE; 118 char *CIL_KEY_GLOB; 119 char *CIL_KEY_FILE; 120 char *CIL_KEY_DIR; 121 char *CIL_KEY_CHAR; 122 char *CIL_KEY_BLOCK; 123 char *CIL_KEY_SOCKET; 124 char *CIL_KEY_PIPE; 125 char *CIL_KEY_SYMLINK; 126 char *CIL_KEY_ANY; 127 char *CIL_KEY_XATTR; 128 char *CIL_KEY_TASK; 129 char *CIL_KEY_TRANS; 130 char *CIL_KEY_TYPE; 131 char *CIL_KEY_ROLE; 132 char *CIL_KEY_USER; 133 char *CIL_KEY_USERATTRIBUTE; 134 char *CIL_KEY_USERATTRIBUTESET; 135 char *CIL_KEY_SENSITIVITY; 136 char *CIL_KEY_CATEGORY; 137 char *CIL_KEY_CATSET; 138 char *CIL_KEY_LEVEL; 139 char *CIL_KEY_LEVELRANGE; 140 char *CIL_KEY_CLASS; 141 char *CIL_KEY_IPADDR; 142 char *CIL_KEY_MAP_CLASS; 143 char *CIL_KEY_CLASSPERMISSION; 144 char *CIL_KEY_BOOL; 145 char *CIL_KEY_STRING; 146 char *CIL_KEY_NAME; 147 char *CIL_KEY_SOURCE; 148 char *CIL_KEY_TARGET; 149 char *CIL_KEY_LOW; 150 char *CIL_KEY_HIGH; 151 char *CIL_KEY_LOW_HIGH; 152 char *CIL_KEY_HANDLEUNKNOWN; 153 char *CIL_KEY_HANDLEUNKNOWN_ALLOW; 154 char *CIL_KEY_HANDLEUNKNOWN_DENY; 155 char *CIL_KEY_HANDLEUNKNOWN_REJECT; 156 char *CIL_KEY_MACRO; 157 char *CIL_KEY_IN; 158 char *CIL_KEY_MLS; 159 char *CIL_KEY_DEFAULTRANGE; 160 char *CIL_KEY_BLOCKINHERIT; 161 char *CIL_KEY_BLOCKABSTRACT; 162 char *CIL_KEY_CLASSORDER; 163 char *CIL_KEY_CLASSMAPPING; 164 char *CIL_KEY_CLASSPERMISSIONSET; 165 char *CIL_KEY_COMMON; 166 char *CIL_KEY_CLASSCOMMON; 167 char *CIL_KEY_SID; 168 char *CIL_KEY_SIDCONTEXT; 169 char *CIL_KEY_SIDORDER; 170 char *CIL_KEY_USERLEVEL; 171 char *CIL_KEY_USERRANGE; 172 char *CIL_KEY_USERBOUNDS; 173 char *CIL_KEY_USERPREFIX; 174 char *CIL_KEY_SELINUXUSER; 175 char *CIL_KEY_SELINUXUSERDEFAULT; 176 char *CIL_KEY_TYPEATTRIBUTE; 177 char *CIL_KEY_TYPEATTRIBUTESET; 178 char *CIL_KEY_EXPANDTYPEATTRIBUTE; 179 char *CIL_KEY_TYPEALIAS; 180 char *CIL_KEY_TYPEALIASACTUAL; 181 char *CIL_KEY_TYPEBOUNDS; 182 char *CIL_KEY_TYPEPERMISSIVE; 183 char *CIL_KEY_RANGETRANSITION; 184 char *CIL_KEY_USERROLE; 185 char *CIL_KEY_ROLETYPE; 186 char *CIL_KEY_ROLETRANSITION; 187 char *CIL_KEY_ROLEALLOW; 188 char *CIL_KEY_ROLEATTRIBUTE; 189 char *CIL_KEY_ROLEATTRIBUTESET; 190 char *CIL_KEY_ROLEBOUNDS; 191 char *CIL_KEY_BOOLEANIF; 192 char *CIL_KEY_NEVERALLOW; 193 char *CIL_KEY_TYPEMEMBER; 194 char *CIL_KEY_SENSALIAS; 195 char *CIL_KEY_SENSALIASACTUAL; 196 char *CIL_KEY_CATALIAS; 197 char *CIL_KEY_CATALIASACTUAL; 198 char *CIL_KEY_CATORDER; 199 char *CIL_KEY_SENSITIVITYORDER; 200 char *CIL_KEY_SENSCAT; 201 char *CIL_KEY_CONSTRAIN; 202 char *CIL_KEY_MLSCONSTRAIN; 203 char *CIL_KEY_VALIDATETRANS; 204 char *CIL_KEY_MLSVALIDATETRANS; 205 char *CIL_KEY_CONTEXT; 206 char *CIL_KEY_FILECON; 207 char *CIL_KEY_IBPKEYCON; 208 char *CIL_KEY_IBENDPORTCON; 209 char *CIL_KEY_PORTCON; 210 char *CIL_KEY_NODECON; 211 char *CIL_KEY_GENFSCON; 212 char *CIL_KEY_NETIFCON; 213 char *CIL_KEY_PIRQCON; 214 char *CIL_KEY_IOMEMCON; 215 char *CIL_KEY_IOPORTCON; 216 char *CIL_KEY_PCIDEVICECON; 217 char *CIL_KEY_DEVICETREECON; 218 char *CIL_KEY_FSUSE; 219 char *CIL_KEY_POLICYCAP; 220 char *CIL_KEY_OPTIONAL; 221 char *CIL_KEY_DEFAULTUSER; 222 char *CIL_KEY_DEFAULTROLE; 223 char *CIL_KEY_DEFAULTTYPE; 224 char *CIL_KEY_ROOT; 225 char *CIL_KEY_NODE; 226 char *CIL_KEY_PERM; 227 char *CIL_KEY_ALLOWX; 228 char *CIL_KEY_AUDITALLOWX; 229 char *CIL_KEY_DONTAUDITX; 230 char *CIL_KEY_NEVERALLOWX; 231 char *CIL_KEY_PERMISSIONX; 232 char *CIL_KEY_IOCTL; 233 char *CIL_KEY_UNORDERED; 234 char *CIL_KEY_SRC_INFO; 235 char *CIL_KEY_SRC_CIL; 236 char *CIL_KEY_SRC_HLL; 237 238 /* 239 Symbol Table Array Indices 240 */ 241 enum cil_sym_index { 242 CIL_SYM_BLOCKS = 0, 243 CIL_SYM_USERS, 244 CIL_SYM_ROLES, 245 CIL_SYM_TYPES, 246 CIL_SYM_COMMONS, 247 CIL_SYM_CLASSES, 248 CIL_SYM_CLASSPERMSETS, 249 CIL_SYM_BOOLS, 250 CIL_SYM_TUNABLES, 251 CIL_SYM_SENS, 252 CIL_SYM_CATS, 253 CIL_SYM_SIDS, 254 CIL_SYM_CONTEXTS, 255 CIL_SYM_LEVELS, 256 CIL_SYM_LEVELRANGES, 257 CIL_SYM_POLICYCAPS, 258 CIL_SYM_IPADDRS, 259 CIL_SYM_NAMES, 260 CIL_SYM_PERMX, 261 CIL_SYM_NUM, 262 CIL_SYM_UNKNOWN, 263 CIL_SYM_PERMS // Special case for permissions. This symtab is not included in arrays 264 }; 265 266 enum cil_sym_array { 267 CIL_SYM_ARRAY_ROOT = 0, 268 CIL_SYM_ARRAY_BLOCK, 269 CIL_SYM_ARRAY_IN, 270 CIL_SYM_ARRAY_MACRO, 271 CIL_SYM_ARRAY_CONDBLOCK, 272 CIL_SYM_ARRAY_NUM 273 }; 274 275 extern int cil_sym_sizes[CIL_SYM_ARRAY_NUM][CIL_SYM_NUM]; 276 277 #define CIL_CLASS_SYM_SIZE 256 278 #define CIL_PERMS_PER_CLASS (sizeof(sepol_access_vector_t) * 8) 279 280 struct cil_db { 281 struct cil_tree *parse; 282 struct cil_tree *ast; 283 struct cil_type *selftype; 284 struct cil_list *sidorder; 285 struct cil_list *classorder; 286 struct cil_list *catorder; 287 struct cil_list *sensitivityorder; 288 struct cil_sort *netifcon; 289 struct cil_sort *genfscon; 290 struct cil_sort *filecon; 291 struct cil_sort *nodecon; 292 struct cil_sort *ibpkeycon; 293 struct cil_sort *ibendportcon; 294 struct cil_sort *portcon; 295 struct cil_sort *pirqcon; 296 struct cil_sort *iomemcon; 297 struct cil_sort *ioportcon; 298 struct cil_sort *pcidevicecon; 299 struct cil_sort *devicetreecon; 300 struct cil_sort *fsuse; 301 struct cil_list *userprefixes; 302 struct cil_list *selinuxusers; 303 struct cil_list *names; 304 int num_types_and_attrs; 305 int num_classes; 306 int num_cats; 307 int num_types; 308 int num_roles; 309 int num_users; 310 struct cil_type **val_to_type; 311 struct cil_role **val_to_role; 312 struct cil_user **val_to_user; 313 int disable_dontaudit; 314 int disable_neverallow; 315 int attrs_expand_generated; 316 unsigned attrs_expand_size; 317 int preserve_tunables; 318 int handle_unknown; 319 int mls; 320 int multiple_decls; 321 int target_platform; 322 int policy_version; 323 }; 324 325 struct cil_root { 326 symtab_t symtab[CIL_SYM_NUM]; 327 }; 328 329 struct cil_sort { 330 enum cil_flavor flavor; 331 uint32_t count; 332 uint32_t index; 333 void **array; 334 }; 335 336 struct cil_block { 337 struct cil_symtab_datum datum; 338 symtab_t symtab[CIL_SYM_NUM]; 339 uint16_t is_abstract; 340 struct cil_list *bi_nodes; 341 }; 342 343 struct cil_blockinherit { 344 char *block_str; 345 struct cil_block *block; 346 }; 347 348 struct cil_blockabstract { 349 char *block_str; 350 }; 351 352 struct cil_in { 353 symtab_t symtab[CIL_SYM_NUM]; 354 char *block_str; 355 }; 356 357 struct cil_optional { 358 struct cil_symtab_datum datum; 359 int enabled; 360 }; 361 362 struct cil_perm { 363 struct cil_symtab_datum datum; 364 unsigned int value; 365 struct cil_list *classperms; /* Only used for map perms */ 366 }; 367 368 struct cil_class { 369 struct cil_symtab_datum datum; 370 symtab_t perms; 371 unsigned int num_perms; 372 struct cil_class *common; /* Only used for kernel class */ 373 uint32_t ordered; /* Only used for kernel class */ 374 }; 375 376 struct cil_classorder { 377 struct cil_list *class_list_str; 378 }; 379 380 struct cil_classperms_set { 381 char *set_str; 382 struct cil_classpermission *set; 383 }; 384 385 struct cil_classperms { 386 char *class_str; 387 struct cil_class *class; 388 struct cil_list *perm_strs; 389 struct cil_list *perms; 390 }; 391 392 struct cil_classpermission { 393 struct cil_symtab_datum datum; 394 struct cil_list *classperms; 395 }; 396 397 struct cil_classpermissionset { 398 char *set_str; 399 struct cil_list *classperms; 400 }; 401 402 struct cil_classmapping { 403 char *map_class_str; 404 char *map_perm_str; 405 struct cil_list *classperms; 406 }; 407 408 struct cil_classcommon { 409 char *class_str; 410 char *common_str; 411 }; 412 413 struct cil_alias { 414 struct cil_symtab_datum datum; 415 void *actual; 416 }; 417 418 struct cil_aliasactual { 419 char *alias_str; 420 char *actual_str; 421 }; 422 423 struct cil_sid { 424 struct cil_symtab_datum datum; 425 struct cil_context *context; 426 uint32_t ordered; 427 }; 428 429 struct cil_sidcontext { 430 char *sid_str; 431 char *context_str; 432 struct cil_context *context; 433 }; 434 435 struct cil_sidorder { 436 struct cil_list *sid_list_str; 437 }; 438 439 struct cil_user { 440 struct cil_symtab_datum datum; 441 struct cil_user *bounds; 442 ebitmap_t *roles; 443 struct cil_level *dftlevel; 444 struct cil_levelrange *range; 445 int value; 446 }; 447 448 struct cil_userattribute { 449 struct cil_symtab_datum datum; 450 struct cil_list *expr_list; 451 ebitmap_t *users; 452 }; 453 454 struct cil_userattributeset { 455 char *attr_str; 456 struct cil_list *str_expr; 457 struct cil_list *datum_expr; 458 }; 459 460 struct cil_userrole { 461 char *user_str; 462 void *user; 463 char *role_str; 464 void *role; 465 }; 466 467 struct cil_userlevel { 468 char *user_str; 469 char *level_str; 470 struct cil_level *level; 471 }; 472 473 struct cil_userrange { 474 char *user_str; 475 char *range_str; 476 struct cil_levelrange *range; 477 }; 478 479 struct cil_userprefix { 480 char *user_str; 481 struct cil_user *user; 482 char *prefix_str; 483 }; 484 485 struct cil_selinuxuser { 486 char *name_str; 487 char *user_str; 488 struct cil_user *user; 489 char *range_str; 490 struct cil_levelrange *range; 491 }; 492 493 struct cil_role { 494 struct cil_symtab_datum datum; 495 struct cil_role *bounds; 496 ebitmap_t *types; 497 int value; 498 }; 499 500 struct cil_roleattribute { 501 struct cil_symtab_datum datum; 502 struct cil_list *expr_list; 503 ebitmap_t *roles; 504 }; 505 506 struct cil_roleattributeset { 507 char *attr_str; 508 struct cil_list *str_expr; 509 struct cil_list *datum_expr; 510 }; 511 512 struct cil_roletype { 513 char *role_str; 514 void *role; /* role or attribute */ 515 char *type_str; 516 void *type; /* type, alias, or attribute */ 517 }; 518 519 struct cil_type { 520 struct cil_symtab_datum datum; 521 struct cil_type *bounds; 522 int value; 523 }; 524 525 #define CIL_ATTR_AVRULE (1 << 0) 526 #define CIL_ATTR_NEVERALLOW (1 << 1) 527 #define CIL_ATTR_CONSTRAINT (1 << 2) 528 #define CIL_ATTR_EXPAND_TRUE (1 << 3) 529 #define CIL_ATTR_EXPAND_FALSE (1 << 4) 530 struct cil_typeattribute { 531 struct cil_symtab_datum datum; 532 struct cil_list *expr_list; 533 ebitmap_t *types; 534 int used; // whether or not this attribute was used in a binary policy rule 535 int keep; 536 }; 537 538 struct cil_typeattributeset { 539 char *attr_str; 540 struct cil_list *str_expr; 541 struct cil_list *datum_expr; 542 }; 543 544 struct cil_expandtypeattribute { 545 struct cil_list *attr_strs; 546 struct cil_list *attr_datums; 547 int expand; 548 }; 549 550 struct cil_typepermissive { 551 char *type_str; 552 void *type; /* type or alias */ 553 }; 554 555 struct cil_name { 556 struct cil_symtab_datum datum; 557 char *name_str; 558 }; 559 560 struct cil_nametypetransition { 561 char *src_str; 562 void *src; /* type, alias, or attribute */ 563 char *tgt_str; 564 void *tgt; /* type, alias, or attribute */ 565 char *obj_str; 566 struct cil_class *obj; 567 char *name_str; 568 struct cil_name *name; 569 char *result_str; 570 void *result; /* type or alias */ 571 572 }; 573 574 struct cil_rangetransition { 575 char *src_str; 576 void *src; /* type, alias, or attribute */ 577 char *exec_str; 578 void *exec; /* type, alias, or attribute */ 579 char *obj_str; 580 struct cil_class *obj; 581 char *range_str; 582 struct cil_levelrange *range; 583 }; 584 585 struct cil_bool { 586 struct cil_symtab_datum datum; 587 uint16_t value; 588 }; 589 590 struct cil_tunable { 591 struct cil_symtab_datum datum; 592 uint16_t value; 593 }; 594 595 #define CIL_AVRULE_ALLOWED 1 596 #define CIL_AVRULE_AUDITALLOW 2 597 #define CIL_AVRULE_DONTAUDIT 8 598 #define CIL_AVRULE_NEVERALLOW 128 599 #define CIL_AVRULE_AV (AVRULE_ALLOWED | AVRULE_AUDITALLOW | AVRULE_DONTAUDIT | AVRULE_NEVERALLOW) 600 struct cil_avrule { 601 int is_extended; 602 uint32_t rule_kind; 603 char *src_str; 604 void *src; /* type, alias, or attribute */ 605 char *tgt_str; 606 void *tgt; /* type, alias, or attribute */ 607 union { 608 struct cil_list *classperms; 609 struct { 610 char *permx_str; 611 struct cil_permissionx *permx; 612 } x; 613 } perms; 614 }; 615 616 #define CIL_PERMX_KIND_IOCTL 1 617 struct cil_permissionx { 618 struct cil_symtab_datum datum; 619 uint32_t kind; 620 char *obj_str; 621 struct cil_class *obj; 622 struct cil_list *expr_str; 623 ebitmap_t *perms; 624 }; 625 626 #define CIL_TYPE_TRANSITION 16 627 #define CIL_TYPE_MEMBER 32 628 #define CIL_TYPE_CHANGE 64 629 #define CIL_AVRULE_TYPE (AVRULE_TRANSITION | AVRULE_MEMBER | AVRULE_CHANGE) 630 struct cil_type_rule { 631 uint32_t rule_kind; 632 char *src_str; 633 void *src; /* type, alias, or attribute */ 634 char *tgt_str; 635 void *tgt; /* type, alias, or attribute */ 636 char *obj_str; 637 struct cil_class *obj; 638 char *result_str; 639 void *result; /* type or alias */ 640 }; 641 642 struct cil_roletransition { 643 char *src_str; 644 struct cil_role *src; 645 char *tgt_str; 646 void *tgt; /* type, alias, or attribute */ 647 char *obj_str; 648 struct cil_class *obj; 649 char *result_str; 650 struct cil_role *result; 651 }; 652 653 struct cil_roleallow { 654 char *src_str; 655 void *src; /* role or attribute */ 656 char *tgt_str; 657 void *tgt; /* role or attribute */ 658 }; 659 660 struct cil_sens { 661 struct cil_symtab_datum datum; 662 struct cil_list *cats_list; 663 uint32_t ordered; 664 }; 665 666 struct cil_sensorder { 667 struct cil_list *sens_list_str; 668 }; 669 670 struct cil_cat { 671 struct cil_symtab_datum datum; 672 uint32_t ordered; 673 int value; 674 }; 675 676 struct cil_cats { 677 uint32_t evaluated; 678 struct cil_list *str_expr; 679 struct cil_list *datum_expr; 680 }; 681 682 struct cil_catset { 683 struct cil_symtab_datum datum; 684 struct cil_cats *cats; 685 }; 686 687 struct cil_catorder { 688 struct cil_list *cat_list_str; 689 }; 690 691 struct cil_senscat { 692 char *sens_str; 693 struct cil_cats *cats; 694 }; 695 696 struct cil_level { 697 struct cil_symtab_datum datum; 698 char *sens_str; 699 struct cil_sens *sens; 700 struct cil_cats *cats; 701 }; 702 703 struct cil_levelrange { 704 struct cil_symtab_datum datum; 705 char *low_str; 706 struct cil_level *low; 707 char *high_str; 708 struct cil_level *high; 709 }; 710 711 struct cil_context { 712 struct cil_symtab_datum datum; 713 char *user_str; 714 struct cil_user *user; 715 char *role_str; 716 struct cil_role *role; 717 char *type_str; 718 void *type; /* type or alias */ 719 char *range_str; 720 struct cil_levelrange *range; 721 }; 722 723 enum cil_filecon_types { 724 CIL_FILECON_FILE = 1, 725 CIL_FILECON_DIR, 726 CIL_FILECON_CHAR, 727 CIL_FILECON_BLOCK, 728 CIL_FILECON_SOCKET, 729 CIL_FILECON_PIPE, 730 CIL_FILECON_SYMLINK, 731 CIL_FILECON_ANY 732 }; 733 734 struct cil_filecon { 735 char *path_str; 736 enum cil_filecon_types type; 737 char *context_str; 738 struct cil_context *context; 739 }; 740 741 enum cil_protocol { 742 CIL_PROTOCOL_UDP = 1, 743 CIL_PROTOCOL_TCP, 744 CIL_PROTOCOL_DCCP, 745 CIL_PROTOCOL_SCTP 746 }; 747 748 struct cil_ibpkeycon { 749 char *subnet_prefix_str; 750 uint32_t pkey_low; 751 uint32_t pkey_high; 752 char *context_str; 753 struct cil_context *context; 754 }; 755 756 struct cil_portcon { 757 enum cil_protocol proto; 758 uint32_t port_low; 759 uint32_t port_high; 760 char *context_str; 761 struct cil_context *context; 762 }; 763 764 struct cil_nodecon { 765 char *addr_str; 766 struct cil_ipaddr *addr; 767 char *mask_str; 768 struct cil_ipaddr *mask; 769 char *context_str; 770 struct cil_context *context; 771 }; 772 773 struct cil_ipaddr { 774 struct cil_symtab_datum datum; 775 int family; 776 union { 777 struct in_addr v4; 778 struct in6_addr v6; 779 } ip; 780 }; 781 782 struct cil_genfscon { 783 char *fs_str; 784 char *path_str; 785 char *context_str; 786 struct cil_context *context; 787 }; 788 789 struct cil_netifcon { 790 char *interface_str; 791 char *if_context_str; 792 struct cil_context *if_context; 793 char *packet_context_str; 794 struct cil_context *packet_context; 795 char *context_str; 796 }; 797 798 struct cil_ibendportcon { 799 char *dev_name_str; 800 uint32_t port; 801 char *context_str; 802 struct cil_context *context; 803 }; 804 struct cil_pirqcon { 805 uint32_t pirq; 806 char *context_str; 807 struct cil_context *context; 808 }; 809 810 struct cil_iomemcon { 811 uint64_t iomem_low; 812 uint64_t iomem_high; 813 char *context_str; 814 struct cil_context *context; 815 }; 816 817 struct cil_ioportcon { 818 uint32_t ioport_low; 819 uint32_t ioport_high; 820 char *context_str; 821 struct cil_context *context; 822 }; 823 824 struct cil_pcidevicecon { 825 uint32_t dev; 826 char *context_str; 827 struct cil_context *context; 828 }; 829 830 struct cil_devicetreecon { 831 char *path; 832 char *context_str; 833 struct cil_context *context; 834 }; 835 836 837 /* Ensure that CIL uses the same values as sepol services.h */ 838 enum cil_fsuse_types { 839 CIL_FSUSE_XATTR = SECURITY_FS_USE_XATTR, 840 CIL_FSUSE_TASK = SECURITY_FS_USE_TASK, 841 CIL_FSUSE_TRANS = SECURITY_FS_USE_TRANS 842 }; 843 844 struct cil_fsuse { 845 enum cil_fsuse_types type; 846 char *fs_str; 847 char *context_str; 848 struct cil_context *context; 849 }; 850 851 #define CIL_MLS_LEVELS "l1 l2 h1 h2" 852 #define CIL_CONSTRAIN_KEYS "t1 t2 r1 r2 u1 u2" 853 #define CIL_MLSCONSTRAIN_KEYS CIL_MLS_LEVELS CIL_CONSTRAIN_KEYS 854 #define CIL_CONSTRAIN_OPER "== != eq dom domby incomp not and or" 855 struct cil_constrain { 856 struct cil_list *classperms; 857 struct cil_list *str_expr; 858 struct cil_list *datum_expr; 859 }; 860 861 struct cil_validatetrans { 862 char *class_str; 863 struct cil_class *class; 864 struct cil_list *str_expr; 865 struct cil_list *datum_expr; 866 }; 867 868 struct cil_param { 869 char *str; 870 enum cil_flavor flavor; 871 }; 872 873 struct cil_macro { 874 struct cil_symtab_datum datum; 875 symtab_t symtab[CIL_SYM_NUM]; 876 struct cil_list *params; 877 }; 878 879 struct cil_args { 880 char *arg_str; 881 struct cil_symtab_datum *arg; 882 char *param_str; 883 enum cil_flavor flavor; 884 }; 885 886 struct cil_call { 887 char *macro_str; 888 struct cil_macro *macro; 889 struct cil_tree *args_tree; 890 struct cil_list *args; 891 int copied; 892 }; 893 894 #define CIL_TRUE 1 895 #define CIL_FALSE 0 896 897 struct cil_condblock { 898 enum cil_flavor flavor; 899 symtab_t symtab[CIL_SYM_NUM]; 900 }; 901 902 struct cil_booleanif { 903 struct cil_list *str_expr; 904 struct cil_list *datum_expr; 905 int preserved_tunable; 906 }; 907 908 struct cil_tunableif { 909 struct cil_list *str_expr; 910 struct cil_list *datum_expr; 911 }; 912 913 struct cil_policycap { 914 struct cil_symtab_datum datum; 915 }; 916 917 struct cil_bounds { 918 char *parent_str; 919 char *child_str; 920 }; 921 922 /* Ensure that CIL uses the same values as sepol policydb.h */ 923 enum cil_default_object { 924 CIL_DEFAULT_SOURCE = DEFAULT_SOURCE, 925 CIL_DEFAULT_TARGET = DEFAULT_TARGET, 926 }; 927 928 /* Default labeling behavior for users, roles, and types */ 929 struct cil_default { 930 enum cil_flavor flavor; 931 struct cil_list *class_strs; 932 struct cil_list *class_datums; 933 enum cil_default_object object; 934 }; 935 936 /* Ensure that CIL uses the same values as sepol policydb.h */ 937 enum cil_default_object_range { 938 CIL_DEFAULT_SOURCE_LOW = DEFAULT_SOURCE_LOW, 939 CIL_DEFAULT_SOURCE_HIGH = DEFAULT_SOURCE_HIGH, 940 CIL_DEFAULT_SOURCE_LOW_HIGH = DEFAULT_SOURCE_LOW_HIGH, 941 CIL_DEFAULT_TARGET_LOW = DEFAULT_TARGET_LOW, 942 CIL_DEFAULT_TARGET_HIGH = DEFAULT_TARGET_HIGH, 943 CIL_DEFAULT_TARGET_LOW_HIGH = DEFAULT_TARGET_LOW_HIGH, 944 }; 945 946 /* Default labeling behavior for range */ 947 struct cil_defaultrange { 948 struct cil_list *class_strs; 949 struct cil_list *class_datums; 950 enum cil_default_object_range object_range; 951 }; 952 953 struct cil_handleunknown { 954 int handle_unknown; 955 }; 956 957 struct cil_mls { 958 int value; 959 }; 960 961 struct cil_src_info { 962 int is_cil; 963 char *path; 964 }; 965 966 void cil_db_init(struct cil_db **db); 967 void cil_db_destroy(struct cil_db **db); 968 969 void cil_root_init(struct cil_root **root); 970 void cil_root_destroy(struct cil_root *root); 971 972 void cil_destroy_data(void **data, enum cil_flavor flavor); 973 974 int cil_flavor_to_symtab_index(enum cil_flavor flavor, enum cil_sym_index *index); 975 const char * cil_node_to_string(struct cil_tree_node *node); 976 977 int cil_userprefixes_to_string(struct cil_db *db, char **out, size_t *size); 978 int cil_selinuxusers_to_string(struct cil_db *db, char **out, size_t *size); 979 int cil_filecons_to_string(struct cil_db *db, char **out, size_t *size); 980 981 void cil_symtab_array_init(symtab_t symtab[], int symtab_sizes[CIL_SYM_NUM]); 982 void cil_symtab_array_destroy(symtab_t symtab[]); 983 void cil_destroy_ast_symtabs(struct cil_tree_node *root); 984 int cil_get_symtab(struct cil_tree_node *ast_node, symtab_t **symtab, enum cil_sym_index sym_index); 985 986 void cil_sort_init(struct cil_sort **sort); 987 void cil_sort_destroy(struct cil_sort **sort); 988 void cil_netifcon_init(struct cil_netifcon **netifcon); 989 void cil_ibendportcon_init(struct cil_ibendportcon **ibendportcon); 990 void cil_context_init(struct cil_context **context); 991 void cil_level_init(struct cil_level **level); 992 void cil_levelrange_init(struct cil_levelrange **lvlrange); 993 void cil_sens_init(struct cil_sens **sens); 994 void cil_block_init(struct cil_block **block); 995 void cil_blockinherit_init(struct cil_blockinherit **inherit); 996 void cil_blockabstract_init(struct cil_blockabstract **abstract); 997 void cil_in_init(struct cil_in **in); 998 void cil_class_init(struct cil_class **class); 999 void cil_classorder_init(struct cil_classorder **classorder); 1000 void cil_classcommon_init(struct cil_classcommon **classcommon); 1001 void cil_sid_init(struct cil_sid **sid); 1002 void cil_sidcontext_init(struct cil_sidcontext **sidcontext); 1003 void cil_sidorder_init(struct cil_sidorder **sidorder); 1004 void cil_userrole_init(struct cil_userrole **userrole); 1005 void cil_userprefix_init(struct cil_userprefix **userprefix); 1006 void cil_selinuxuser_init(struct cil_selinuxuser **selinuxuser); 1007 void cil_roleattribute_init(struct cil_roleattribute **attribute); 1008 void cil_roleattributeset_init(struct cil_roleattributeset **attrset); 1009 void cil_roletype_init(struct cil_roletype **roletype); 1010 void cil_typeattribute_init(struct cil_typeattribute **attribute); 1011 void cil_typeattributeset_init(struct cil_typeattributeset **attrset); 1012 void cil_expandtypeattribute_init(struct cil_expandtypeattribute **expandattr); 1013 void cil_alias_init(struct cil_alias **alias); 1014 void cil_aliasactual_init(struct cil_aliasactual **aliasactual); 1015 void cil_typepermissive_init(struct cil_typepermissive **typeperm); 1016 void cil_name_init(struct cil_name **name); 1017 void cil_nametypetransition_init(struct cil_nametypetransition **nametypetrans); 1018 void cil_rangetransition_init(struct cil_rangetransition **rangetrans); 1019 void cil_bool_init(struct cil_bool **cilbool); 1020 void cil_boolif_init(struct cil_booleanif **bif); 1021 void cil_condblock_init(struct cil_condblock **cb); 1022 void cil_tunable_init(struct cil_tunable **ciltun); 1023 void cil_tunif_init(struct cil_tunableif **tif); 1024 void cil_avrule_init(struct cil_avrule **avrule); 1025 void cil_permissionx_init(struct cil_permissionx **permx); 1026 void cil_type_rule_init(struct cil_type_rule **type_rule); 1027 void cil_roletransition_init(struct cil_roletransition **roletrans); 1028 void cil_roleallow_init(struct cil_roleallow **role_allow); 1029 void cil_catset_init(struct cil_catset **catset); 1030 void cil_cats_init(struct cil_cats **cats); 1031 void cil_senscat_init(struct cil_senscat **senscat); 1032 void cil_filecon_init(struct cil_filecon **filecon); 1033 void cil_ibpkeycon_init(struct cil_ibpkeycon **ibpkeycon); 1034 void cil_portcon_init(struct cil_portcon **portcon); 1035 void cil_nodecon_init(struct cil_nodecon **nodecon); 1036 void cil_genfscon_init(struct cil_genfscon **genfscon); 1037 void cil_pirqcon_init(struct cil_pirqcon **pirqcon); 1038 void cil_iomemcon_init(struct cil_iomemcon **iomemcon); 1039 void cil_ioportcon_init(struct cil_ioportcon **ioportcon); 1040 void cil_pcidevicecon_init(struct cil_pcidevicecon **pcidevicecon); 1041 void cil_devicetreecon_init(struct cil_devicetreecon **devicetreecon); 1042 void cil_fsuse_init(struct cil_fsuse **fsuse); 1043 void cil_constrain_init(struct cil_constrain **constrain); 1044 void cil_validatetrans_init(struct cil_validatetrans **validtrans); 1045 void cil_ipaddr_init(struct cil_ipaddr **ipaddr); 1046 void cil_perm_init(struct cil_perm **perm); 1047 void cil_classpermission_init(struct cil_classpermission **cp); 1048 void cil_classpermissionset_init(struct cil_classpermissionset **cps); 1049 void cil_classperms_set_init(struct cil_classperms_set **cp_set); 1050 void cil_classperms_init(struct cil_classperms **cp); 1051 void cil_classmapping_init(struct cil_classmapping **mapping); 1052 void cil_user_init(struct cil_user **user); 1053 void cil_userlevel_init(struct cil_userlevel **usrlvl); 1054 void cil_userrange_init(struct cil_userrange **userrange); 1055 void cil_role_init(struct cil_role **role); 1056 void cil_type_init(struct cil_type **type); 1057 void cil_cat_init(struct cil_cat **cat); 1058 void cil_catorder_init(struct cil_catorder **catorder); 1059 void cil_sensorder_init(struct cil_sensorder **sensorder); 1060 void cil_args_init(struct cil_args **args); 1061 void cil_call_init(struct cil_call **call); 1062 void cil_optional_init(struct cil_optional **optional); 1063 void cil_param_init(struct cil_param **param); 1064 void cil_macro_init(struct cil_macro **macro); 1065 void cil_policycap_init(struct cil_policycap **policycap); 1066 void cil_bounds_init(struct cil_bounds **bounds); 1067 void cil_default_init(struct cil_default **def); 1068 void cil_defaultrange_init(struct cil_defaultrange **def); 1069 void cil_handleunknown_init(struct cil_handleunknown **unk); 1070 void cil_mls_init(struct cil_mls **mls); 1071 void cil_src_info_init(struct cil_src_info **info); 1072 void cil_userattribute_init(struct cil_userattribute **attribute); 1073 void cil_userattributeset_init(struct cil_userattributeset **attrset); 1074 1075 #endif 1076
