Home | History | Annotate | Download | only in policydb
      1 /* Author : Stephen Smalley, <sds (at) epoch.ncsc.mil> */
      2 
      3 /* FLASK */
      4 
      5 /*
      6  * A constraint is a condition that must be satisfied in
      7  * order for one or more permissions to be granted.
      8  * Constraints are used to impose additional restrictions
      9  * beyond the type-based rules in `te' or the role-based
     10  * transition rules in `rbac'.  Constraints are typically
     11  * used to prevent a process from transitioning to a new user
     12  * identity or role unless it is in a privileged type.
     13  * Constraints are likewise typically used to prevent a
     14  * process from labeling an object with a different user
     15  * identity.
     16  */
     17 
     18 #ifndef _SEPOL_POLICYDB_CONSTRAINT_H_
     19 #define _SEPOL_POLICYDB_CONSTRAINT_H_
     20 
     21 #include <sepol/policydb/policydb.h>
     22 #include <sepol/policydb/ebitmap.h>
     23 #include <sepol/policydb/flask_types.h>
     24 
     25 __BEGIN_DECLS
     26 
     27 #define CEXPR_MAXDEPTH 5
     28 
     29 struct type_set;
     30 
     31 typedef struct constraint_expr {
     32 #define CEXPR_NOT		1	/* not expr */
     33 #define CEXPR_AND		2	/* expr and expr */
     34 #define CEXPR_OR		3	/* expr or expr */
     35 #define CEXPR_ATTR		4	/* attr op attr */
     36 #define CEXPR_NAMES		5	/* attr op names */
     37 	uint32_t expr_type;	/* expression type */
     38 
     39 #define CEXPR_USER 1		/* user */
     40 #define CEXPR_ROLE 2		/* role */
     41 #define CEXPR_TYPE 4		/* type */
     42 #define CEXPR_TARGET 8		/* target if set, source otherwise */
     43 #define CEXPR_XTARGET 16	/* special 3rd target for validatetrans rule */
     44 #define CEXPR_L1L2 32		/* low level 1 vs. low level 2 */
     45 #define CEXPR_L1H2 64		/* low level 1 vs. high level 2 */
     46 #define CEXPR_H1L2 128		/* high level 1 vs. low level 2 */
     47 #define CEXPR_H1H2 256		/* high level 1 vs. high level 2 */
     48 #define CEXPR_L1H1 512		/* low level 1 vs. high level 1 */
     49 #define CEXPR_L2H2 1024		/* low level 2 vs. high level 2 */
     50 	uint32_t attr;		/* attribute */
     51 
     52 #define CEXPR_EQ     1		/* == or eq */
     53 #define CEXPR_NEQ    2		/* != */
     54 #define CEXPR_DOM    3		/* dom */
     55 #define CEXPR_DOMBY  4		/* domby  */
     56 #define CEXPR_INCOMP 5		/* incomp */
     57 	uint32_t op;		/* operator */
     58 
     59 	ebitmap_t names;	/* names */
     60 	struct type_set *type_names;
     61 
     62 	struct constraint_expr *next;	/* next expression */
     63 } constraint_expr_t;
     64 
     65 typedef struct constraint_node {
     66 	sepol_access_vector_t permissions;	/* constrained permissions */
     67 	constraint_expr_t *expr;	/* constraint on permissions */
     68 	struct constraint_node *next;	/* next constraint */
     69 } constraint_node_t;
     70 
     71 struct policydb;
     72 
     73 extern int constraint_expr_init(constraint_expr_t * expr);
     74 extern void constraint_expr_destroy(constraint_expr_t * expr);
     75 
     76 __END_DECLS
     77 #endif				/* _CONSTRAINT_H_ */
     78 
     79 /* FLASK */
     80