Home | History | Annotate | Download | only in selinux
      1 /*
      2  * Labeling interface for userspace object managers and others.
      3  *
      4  * Author : Eamon Walsh <ewalsh (at) tycho.nsa.gov>
      5  */
      6 #ifndef _SELABEL_H_
      7 #define _SELABEL_H_
      8 
      9 #include <sys/types.h>
     10 #include <selinux/selinux.h>
     11 
     12 #ifdef __cplusplus
     13 extern "C" {
     14 #endif
     15 
     16 /*
     17  * Opaque type used for all label handles.
     18  */
     19 
     20 struct selabel_handle;
     21 
     22 /*
     23  * Available backends.
     24  */
     25 
     26 /* file contexts */
     27 #define SELABEL_CTX_FILE	0
     28 /* media contexts */
     29 #define SELABEL_CTX_MEDIA	1
     30 /* x contexts */
     31 #define SELABEL_CTX_X		2
     32 /* db objects */
     33 #define SELABEL_CTX_DB		3
     34 /* Android property service contexts */
     35 #define SELABEL_CTX_ANDROID_PROP 4
     36 
     37 /*
     38  * Available options
     39  */
     40 
     41 /* no-op option, useful for unused slots in an array of options */
     42 #define SELABEL_OPT_UNUSED	0
     43 /* validate contexts before returning them (boolean value) */
     44 #define SELABEL_OPT_VALIDATE	1
     45 /* don't use local customizations to backend data (boolean value) */
     46 #define SELABEL_OPT_BASEONLY	2
     47 /* specify an alternate path to use when loading backend data */
     48 #define SELABEL_OPT_PATH	3
     49 /* select a subset of the search space as an optimization (file backend) */
     50 #define SELABEL_OPT_SUBSET	4
     51 /* total number of options */
     52 #define SELABEL_NOPT		5
     53 
     54 /*
     55  * Label operations
     56  */
     57 
     58 /**
     59  * selabel_open - Create a labeling handle.
     60  * @backend: one of the constants specifying a supported labeling backend.
     61  * @opts: array of selabel_opt structures specifying label options or NULL.
     62  * @nopts: number of elements in opts array or zero for no options.
     63  *
     64  * Open a labeling backend for use.  The available backend identifiers are
     65  * listed above.  Options may be provided via the opts parameter; available
     66  * options are listed above.  Not all options may be supported by every
     67  * backend.  Return value is the created handle on success or NULL with
     68  * @errno set on failure.
     69  */
     70 struct selabel_handle *selabel_open(unsigned int backend,
     71 				    const struct selinux_opt *opts,
     72 				    unsigned nopts);
     73 
     74 /**
     75  * selabel_close - Close a labeling handle.
     76  * @handle: specifies handle to close
     77  *
     78  * Destroy the specified handle, closing files, freeing allocated memory,
     79  * etc.  The handle may not be further used after it has been closed.
     80  */
     81 void selabel_close(struct selabel_handle *handle);
     82 
     83 /**
     84  * selabel_lookup - Perform labeling lookup operation.
     85  * @handle: specifies backend instance to query
     86  * @con: returns the appropriate context with which to label the object
     87  * @key: string input to lookup operation
     88  * @type: numeric input to the lookup operation
     89  *
     90  * Perform a labeling lookup operation.  Return %0 on success, -%1 with
     91  * @errno set on failure.  The key and type arguments are the inputs to the
     92  * lookup operation; appropriate values are dictated by the backend in use.
     93  * The result is returned in the memory pointed to by @con and must be freed
     94  * by the user with freecon().
     95  */
     96 int selabel_lookup(struct selabel_handle *handle, security_context_t *con,
     97 		   const char *key, int type);
     98 int selabel_lookup_raw(struct selabel_handle *handle, security_context_t *con,
     99 		       const char *key, int type);
    100 
    101 /**
    102  * selabel_stats - log labeling operation statistics.
    103  * @handle: specifies backend instance to query
    104  *
    105  * Log a message with information about the number of queries performed,
    106  * number of unused matching entries, or other operational statistics.
    107  * Message is backend-specific, some backends may not output a message.
    108  */
    109 void selabel_stats(struct selabel_handle *handle);
    110 
    111 /*
    112  * Type codes used by specific backends
    113  */
    114 
    115 /* X backend */
    116 #define SELABEL_X_PROP		1
    117 #define SELABEL_X_EXT		2
    118 #define SELABEL_X_CLIENT	3
    119 #define SELABEL_X_EVENT		4
    120 #define SELABEL_X_SELN		5
    121 #define SELABEL_X_POLYPROP	6
    122 #define SELABEL_X_POLYSELN	7
    123 
    124 /* DB backend */
    125 #define SELABEL_DB_DATABASE	1
    126 #define SELABEL_DB_SCHEMA	2
    127 #define SELABEL_DB_TABLE	3
    128 #define SELABEL_DB_COLUMN	4
    129 #define SELABEL_DB_SEQUENCE	5
    130 #define SELABEL_DB_VIEW		6
    131 #define SELABEL_DB_PROCEDURE	7
    132 #define SELABEL_DB_BLOB		8
    133 #define SELABEL_DB_TUPLE	9
    134 #define SELABEL_DB_LANGUAGE	10
    135 
    136 #ifdef __cplusplus
    137 }
    138 #endif
    139 #endif	/* _SELABEL_H_ */
    140