1 /* 2 * Copyright 2011 Tresys Technology, LLC. All rights reserved. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions are met: 6 * 7 * 1. Redistributions of source code must retain the above copyright notice, 8 * this list of conditions and the following disclaimer. 9 * 10 * 2. Redistributions in binary form must reproduce the above copyright notice, 11 * this list of conditions and the following disclaimer in the documentation 12 * and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY TRESYS TECHNOLOGY, LLC ``AS IS'' AND ANY EXPRESS 15 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 16 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO 17 * EVENT SHALL TRESYS TECHNOLOGY, LLC OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, 18 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 19 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 21 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE 22 * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 23 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 24 * 25 * The views and conclusions contained in the software and documentation are those 26 * of the authors and should not be interpreted as representing official policies, 27 * either expressed or implied, of Tresys Technology, LLC. 28 */ 29 30 #ifndef CIL_INTERNAL_H_ 31 #define CIL_INTERNAL_H_ 32 33 #include <stdlib.h> 34 #include <stdio.h> 35 #include <stdint.h> 36 #include <arpa/inet.h> 37 38 #include <sepol/policydb/services.h> 39 #include <sepol/policydb/policydb.h> 40 41 #include <cil/cil.h> 42 43 #include "cil_flavor.h" 44 #include "cil_tree.h" 45 #include "cil_symtab.h" 46 #include "cil_mem.h" 47 48 #define CIL_MAX_NAME_LENGTH 2048 49 50 51 enum cil_pass { 52 CIL_PASS_INIT = 0, 53 54 CIL_PASS_TIF, 55 CIL_PASS_IN, 56 CIL_PASS_BLKIN_LINK, 57 CIL_PASS_BLKIN_COPY, 58 CIL_PASS_BLKABS, 59 CIL_PASS_MACRO, 60 CIL_PASS_CALL1, 61 CIL_PASS_CALL2, 62 CIL_PASS_ALIAS1, 63 CIL_PASS_ALIAS2, 64 CIL_PASS_MISC1, 65 CIL_PASS_MLS, 66 CIL_PASS_MISC2, 67 CIL_PASS_MISC3, 68 69 CIL_PASS_NUM 70 }; 71 72 73 /* 74 Keywords 75 */ 76 char *CIL_KEY_CONS_T1; 77 char *CIL_KEY_CONS_T2; 78 char *CIL_KEY_CONS_T3; 79 char *CIL_KEY_CONS_R1; 80 char *CIL_KEY_CONS_R2; 81 char *CIL_KEY_CONS_R3; 82 char *CIL_KEY_CONS_U1; 83 char *CIL_KEY_CONS_U2; 84 char *CIL_KEY_CONS_U3; 85 char *CIL_KEY_CONS_L1; 86 char *CIL_KEY_CONS_L2; 87 char *CIL_KEY_CONS_H1; 88 char *CIL_KEY_CONS_H2; 89 char *CIL_KEY_AND; 90 char *CIL_KEY_OR; 91 char *CIL_KEY_NOT; 92 char *CIL_KEY_EQ; 93 char *CIL_KEY_NEQ; 94 char *CIL_KEY_CONS_DOM; 95 char *CIL_KEY_CONS_DOMBY; 96 char *CIL_KEY_CONS_INCOMP; 97 char *CIL_KEY_CONDTRUE; 98 char *CIL_KEY_CONDFALSE; 99 char *CIL_KEY_SELF; 100 char *CIL_KEY_OBJECT_R; 101 char *CIL_KEY_STAR; 102 char *CIL_KEY_TCP; 103 char *CIL_KEY_UDP; 104 char *CIL_KEY_AUDITALLOW; 105 char *CIL_KEY_TUNABLEIF; 106 char *CIL_KEY_ALLOW; 107 char *CIL_KEY_DONTAUDIT; 108 char *CIL_KEY_TYPETRANSITION; 109 char *CIL_KEY_TYPECHANGE; 110 char *CIL_KEY_CALL; 111 char *CIL_KEY_TUNABLE; 112 char *CIL_KEY_XOR; 113 char *CIL_KEY_ALL; 114 char *CIL_KEY_RANGE; 115 char *CIL_KEY_GLOB; 116 char *CIL_KEY_FILE; 117 char *CIL_KEY_DIR; 118 char *CIL_KEY_CHAR; 119 char *CIL_KEY_BLOCK; 120 char *CIL_KEY_SOCKET; 121 char *CIL_KEY_PIPE; 122 char *CIL_KEY_SYMLINK; 123 char *CIL_KEY_ANY; 124 char *CIL_KEY_XATTR; 125 char *CIL_KEY_TASK; 126 char *CIL_KEY_TRANS; 127 char *CIL_KEY_TYPE; 128 char *CIL_KEY_ROLE; 129 char *CIL_KEY_USER; 130 char *CIL_KEY_SENSITIVITY; 131 char *CIL_KEY_CATEGORY; 132 char *CIL_KEY_CATSET; 133 char *CIL_KEY_LEVEL; 134 char *CIL_KEY_LEVELRANGE; 135 char *CIL_KEY_CLASS; 136 char *CIL_KEY_IPADDR; 137 char *CIL_KEY_MAP_CLASS; 138 char *CIL_KEY_CLASSPERMISSION; 139 char *CIL_KEY_BOOL; 140 char *CIL_KEY_STRING; 141 char *CIL_KEY_NAME; 142 char *CIL_KEY_SOURCE; 143 char *CIL_KEY_TARGET; 144 char *CIL_KEY_LOW; 145 char *CIL_KEY_HIGH; 146 char *CIL_KEY_LOW_HIGH; 147 char *CIL_KEY_HANDLEUNKNOWN; 148 char *CIL_KEY_HANDLEUNKNOWN_ALLOW; 149 char *CIL_KEY_HANDLEUNKNOWN_DENY; 150 char *CIL_KEY_HANDLEUNKNOWN_REJECT; 151 char *CIL_KEY_MACRO; 152 char *CIL_KEY_IN; 153 char *CIL_KEY_MLS; 154 char *CIL_KEY_DEFAULTRANGE; 155 char *CIL_KEY_BLOCKINHERIT; 156 char *CIL_KEY_BLOCKABSTRACT; 157 char *CIL_KEY_CLASSORDER; 158 char *CIL_KEY_CLASSMAPPING; 159 char *CIL_KEY_CLASSPERMISSIONSET; 160 char *CIL_KEY_COMMON; 161 char *CIL_KEY_CLASSCOMMON; 162 char *CIL_KEY_SID; 163 char *CIL_KEY_SIDCONTEXT; 164 char *CIL_KEY_SIDORDER; 165 char *CIL_KEY_USERLEVEL; 166 char *CIL_KEY_USERRANGE; 167 char *CIL_KEY_USERBOUNDS; 168 char *CIL_KEY_USERPREFIX; 169 char *CIL_KEY_SELINUXUSER; 170 char *CIL_KEY_SELINUXUSERDEFAULT; 171 char *CIL_KEY_TYPEATTRIBUTE; 172 char *CIL_KEY_TYPEATTRIBUTESET; 173 char *CIL_KEY_TYPEALIAS; 174 char *CIL_KEY_TYPEALIASACTUAL; 175 char *CIL_KEY_TYPEBOUNDS; 176 char *CIL_KEY_TYPEPERMISSIVE; 177 char *CIL_KEY_RANGETRANSITION; 178 char *CIL_KEY_USERROLE; 179 char *CIL_KEY_ROLETYPE; 180 char *CIL_KEY_ROLETRANSITION; 181 char *CIL_KEY_ROLEALLOW; 182 char *CIL_KEY_ROLEATTRIBUTE; 183 char *CIL_KEY_ROLEATTRIBUTESET; 184 char *CIL_KEY_ROLEBOUNDS; 185 char *CIL_KEY_BOOLEANIF; 186 char *CIL_KEY_NEVERALLOW; 187 char *CIL_KEY_TYPEMEMBER; 188 char *CIL_KEY_SENSALIAS; 189 char *CIL_KEY_SENSALIASACTUAL; 190 char *CIL_KEY_CATALIAS; 191 char *CIL_KEY_CATALIASACTUAL; 192 char *CIL_KEY_CATORDER; 193 char *CIL_KEY_SENSITIVITYORDER; 194 char *CIL_KEY_SENSCAT; 195 char *CIL_KEY_CONSTRAIN; 196 char *CIL_KEY_MLSCONSTRAIN; 197 char *CIL_KEY_VALIDATETRANS; 198 char *CIL_KEY_MLSVALIDATETRANS; 199 char *CIL_KEY_CONTEXT; 200 char *CIL_KEY_FILECON; 201 char *CIL_KEY_PORTCON; 202 char *CIL_KEY_NODECON; 203 char *CIL_KEY_GENFSCON; 204 char *CIL_KEY_NETIFCON; 205 char *CIL_KEY_PIRQCON; 206 char *CIL_KEY_IOMEMCON; 207 char *CIL_KEY_IOPORTCON; 208 char *CIL_KEY_PCIDEVICECON; 209 char *CIL_KEY_DEVICETREECON; 210 char *CIL_KEY_FSUSE; 211 char *CIL_KEY_POLICYCAP; 212 char *CIL_KEY_OPTIONAL; 213 char *CIL_KEY_DEFAULTUSER; 214 char *CIL_KEY_DEFAULTROLE; 215 char *CIL_KEY_DEFAULTTYPE; 216 char *CIL_KEY_ROOT; 217 char *CIL_KEY_NODE; 218 char *CIL_KEY_PERM; 219 220 /* 221 Symbol Table Array Indices 222 */ 223 enum cil_sym_index { 224 CIL_SYM_BLOCKS = 0, 225 CIL_SYM_USERS, 226 CIL_SYM_ROLES, 227 CIL_SYM_TYPES, 228 CIL_SYM_COMMONS, 229 CIL_SYM_CLASSES, 230 CIL_SYM_CLASSPERMSETS, 231 CIL_SYM_BOOLS, 232 CIL_SYM_TUNABLES, 233 CIL_SYM_SENS, 234 CIL_SYM_CATS, 235 CIL_SYM_SIDS, 236 CIL_SYM_CONTEXTS, 237 CIL_SYM_LEVELS, 238 CIL_SYM_LEVELRANGES, 239 CIL_SYM_POLICYCAPS, 240 CIL_SYM_IPADDRS, 241 CIL_SYM_NAMES, 242 CIL_SYM_NUM, 243 CIL_SYM_UNKNOWN, 244 CIL_SYM_PERMS // Special case for permissions. This symtab is not included in arrays 245 }; 246 247 enum cil_sym_array { 248 CIL_SYM_ARRAY_ROOT = 0, 249 CIL_SYM_ARRAY_BLOCK, 250 CIL_SYM_ARRAY_IN, 251 CIL_SYM_ARRAY_MACRO, 252 CIL_SYM_ARRAY_CONDBLOCK, 253 CIL_SYM_ARRAY_NUM 254 }; 255 256 extern int cil_sym_sizes[CIL_SYM_ARRAY_NUM][CIL_SYM_NUM]; 257 258 #define CIL_CLASS_SYM_SIZE 256 259 260 struct cil_db { 261 struct cil_tree *parse; 262 struct cil_tree *ast; 263 struct cil_type *selftype; 264 struct cil_list *sidorder; 265 struct cil_list *classorder; 266 struct cil_list *catorder; 267 struct cil_list *sensitivityorder; 268 struct cil_sort *netifcon; 269 struct cil_sort *genfscon; 270 struct cil_sort *filecon; 271 struct cil_sort *nodecon; 272 struct cil_sort *portcon; 273 struct cil_sort *pirqcon; 274 struct cil_sort *iomemcon; 275 struct cil_sort *ioportcon; 276 struct cil_sort *pcidevicecon; 277 struct cil_sort *devicetreecon; 278 struct cil_sort *fsuse; 279 struct cil_list *userprefixes; 280 struct cil_list *selinuxusers; 281 struct cil_list *names; 282 int num_cats; 283 int num_types; 284 int num_roles; 285 struct cil_type **val_to_type; 286 struct cil_role **val_to_role; 287 int disable_dontaudit; 288 int disable_neverallow; 289 int preserve_tunables; 290 int handle_unknown; 291 int mls; 292 int target_platform; 293 int policy_version; 294 }; 295 296 struct cil_root { 297 symtab_t symtab[CIL_SYM_NUM]; 298 }; 299 300 struct cil_sort { 301 enum cil_flavor flavor; 302 uint32_t count; 303 uint32_t index; 304 void **array; 305 }; 306 307 struct cil_block { 308 struct cil_symtab_datum datum; 309 symtab_t symtab[CIL_SYM_NUM]; 310 uint16_t is_abstract; 311 struct cil_list *bi_nodes; 312 }; 313 314 struct cil_blockinherit { 315 char *block_str; 316 struct cil_block *block; 317 }; 318 319 struct cil_blockabstract { 320 char *block_str; 321 }; 322 323 struct cil_in { 324 symtab_t symtab[CIL_SYM_NUM]; 325 char *block_str; 326 }; 327 328 struct cil_optional { 329 struct cil_symtab_datum datum; 330 int enabled; 331 }; 332 333 struct cil_perm { 334 struct cil_symtab_datum datum; 335 unsigned int value; 336 struct cil_list *classperms; /* Only used for map perms */ 337 }; 338 339 struct cil_class { 340 struct cil_symtab_datum datum; 341 symtab_t perms; 342 unsigned int num_perms; 343 struct cil_class *common; /* Only used for kernel class */ 344 uint32_t ordered; /* Only used for kernel class */ 345 }; 346 347 struct cil_classorder { 348 struct cil_list *class_list_str; 349 }; 350 351 struct cil_classperms_set { 352 char *set_str; 353 struct cil_classpermission *set; 354 }; 355 356 struct cil_classperms { 357 char *class_str; 358 struct cil_class *class; 359 struct cil_list *perm_strs; 360 struct cil_list *perms; 361 }; 362 363 struct cil_classpermission { 364 struct cil_symtab_datum datum; 365 struct cil_list *classperms; 366 }; 367 368 struct cil_classpermissionset { 369 char *set_str; 370 struct cil_list *classperms; 371 }; 372 373 struct cil_classmapping { 374 char *map_class_str; 375 char *map_perm_str; 376 struct cil_list *classperms; 377 }; 378 379 struct cil_classcommon { 380 char *class_str; 381 char *common_str; 382 }; 383 384 struct cil_alias { 385 struct cil_symtab_datum datum; 386 void *actual; 387 }; 388 389 struct cil_aliasactual { 390 char *alias_str; 391 char *actual_str; 392 }; 393 394 struct cil_sid { 395 struct cil_symtab_datum datum; 396 struct cil_context *context; 397 uint32_t ordered; 398 }; 399 400 struct cil_sidcontext { 401 char *sid_str; 402 char *context_str; 403 struct cil_context *context; 404 }; 405 406 struct cil_sidorder { 407 struct cil_list *sid_list_str; 408 }; 409 410 struct cil_user { 411 struct cil_symtab_datum datum; 412 struct cil_user *bounds; 413 struct cil_list *roles; 414 struct cil_level *dftlevel; 415 struct cil_levelrange *range; 416 }; 417 418 struct cil_userrole { 419 char *user_str; 420 struct cil_user *user; 421 char *role_str; 422 void *role; 423 }; 424 425 struct cil_userlevel { 426 char *user_str; 427 char *level_str; 428 struct cil_level *level; 429 }; 430 431 struct cil_userrange { 432 char *user_str; 433 char *range_str; 434 struct cil_levelrange *range; 435 }; 436 437 struct cil_userprefix { 438 char *user_str; 439 struct cil_user *user; 440 char *prefix_str; 441 }; 442 443 struct cil_selinuxuser { 444 char *name_str; 445 char *user_str; 446 struct cil_user *user; 447 char *range_str; 448 struct cil_levelrange *range; 449 }; 450 451 struct cil_role { 452 struct cil_symtab_datum datum; 453 struct cil_role *bounds; 454 ebitmap_t *types; 455 int value; 456 }; 457 458 struct cil_roleattribute { 459 struct cil_symtab_datum datum; 460 struct cil_list *expr_list; 461 ebitmap_t *roles; 462 }; 463 464 struct cil_roleattributeset { 465 char *attr_str; 466 struct cil_list *str_expr; 467 struct cil_list *datum_expr; 468 }; 469 470 struct cil_roletype { 471 char *role_str; 472 void *role; /* role or attribute */ 473 char *type_str; 474 void *type; /* type, alias, or attribute */ 475 }; 476 477 struct cil_type { 478 struct cil_symtab_datum datum; 479 struct cil_type *bounds; 480 int value; 481 }; 482 483 struct cil_typeattribute { 484 struct cil_symtab_datum datum; 485 struct cil_list *expr_list; 486 ebitmap_t *types; 487 int used; // whether or not this typeattribute was used and should be added to the binary 488 }; 489 490 struct cil_typeattributeset { 491 char *attr_str; 492 struct cil_list *str_expr; 493 struct cil_list *datum_expr; 494 }; 495 496 struct cil_typepermissive { 497 char *type_str; 498 void *type; /* type or alias */ 499 }; 500 501 struct cil_name { 502 struct cil_symtab_datum datum; 503 char *name_str; 504 }; 505 506 struct cil_nametypetransition { 507 char *src_str; 508 void *src; /* type, alias, or attribute */ 509 char *tgt_str; 510 void *tgt; /* type, alias, or attribute */ 511 char *obj_str; 512 struct cil_class *obj; 513 char *name_str; 514 struct cil_name *name; 515 char *result_str; 516 void *result; /* type or alias */ 517 518 }; 519 520 struct cil_rangetransition { 521 char *src_str; 522 void *src; /* type, alias, or attribute */ 523 char *exec_str; 524 void *exec; /* type, alias, or attribute */ 525 char *obj_str; 526 struct cil_class *obj; 527 char *range_str; 528 struct cil_levelrange *range; 529 }; 530 531 struct cil_bool { 532 struct cil_symtab_datum datum; 533 uint16_t value; 534 }; 535 536 struct cil_tunable { 537 struct cil_symtab_datum datum; 538 uint16_t value; 539 }; 540 541 #define CIL_AVRULE_ALLOWED 1 542 #define CIL_AVRULE_AUDITALLOW 2 543 #define CIL_AVRULE_DONTAUDIT 8 544 #define CIL_AVRULE_NEVERALLOW 128 545 #define CIL_AVRULE_AV (AVRULE_ALLOWED | AVRULE_AUDITALLOW | AVRULE_DONTAUDIT | AVRULE_NEVERALLOW) 546 struct cil_avrule { 547 uint32_t rule_kind; 548 char *src_str; 549 void *src; /* type, alias, or attribute */ 550 char *tgt_str; 551 void *tgt; /* type, alias, or attribute */ 552 struct cil_list *classperms; 553 }; 554 555 #define CIL_TYPE_TRANSITION 16 556 #define CIL_TYPE_MEMBER 32 557 #define CIL_TYPE_CHANGE 64 558 #define CIL_AVRULE_TYPE (AVRULE_TRANSITION | AVRULE_MEMBER | AVRULE_CHANGE) 559 struct cil_type_rule { 560 uint32_t rule_kind; 561 char *src_str; 562 void *src; /* type, alias, or attribute */ 563 char *tgt_str; 564 void *tgt; /* type, alias, or attribute */ 565 char *obj_str; 566 struct cil_class *obj; 567 char *result_str; 568 void *result; /* type or alias */ 569 }; 570 571 struct cil_roletransition { 572 char *src_str; 573 struct cil_role *src; 574 char *tgt_str; 575 void *tgt; /* type, alias, or attribute */ 576 char *obj_str; 577 struct cil_class *obj; 578 char *result_str; 579 struct cil_role *result; 580 }; 581 582 struct cil_roleallow { 583 char *src_str; 584 void *src; /* role or attribute */ 585 char *tgt_str; 586 void *tgt; /* role or attribute */ 587 }; 588 589 struct cil_sens { 590 struct cil_symtab_datum datum; 591 struct cil_list *cats_list; 592 uint32_t ordered; 593 }; 594 595 struct cil_sensorder { 596 struct cil_list *sens_list_str; 597 }; 598 599 struct cil_cat { 600 struct cil_symtab_datum datum; 601 uint32_t ordered; 602 int value; 603 }; 604 605 struct cil_cats { 606 uint32_t evaluated; 607 struct cil_list *str_expr; 608 struct cil_list *datum_expr; 609 }; 610 611 struct cil_catset { 612 struct cil_symtab_datum datum; 613 struct cil_cats *cats; 614 }; 615 616 struct cil_catorder { 617 struct cil_list *cat_list_str; 618 }; 619 620 struct cil_senscat { 621 char *sens_str; 622 struct cil_cats *cats; 623 }; 624 625 struct cil_level { 626 struct cil_symtab_datum datum; 627 char *sens_str; 628 struct cil_sens *sens; 629 struct cil_cats *cats; 630 }; 631 632 struct cil_levelrange { 633 struct cil_symtab_datum datum; 634 char *low_str; 635 struct cil_level *low; 636 char *high_str; 637 struct cil_level *high; 638 }; 639 640 struct cil_context { 641 struct cil_symtab_datum datum; 642 char *user_str; 643 struct cil_user *user; 644 char *role_str; 645 struct cil_role *role; 646 char *type_str; 647 void *type; /* type or alias */ 648 char *range_str; 649 struct cil_levelrange *range; 650 }; 651 652 enum cil_filecon_types { 653 CIL_FILECON_FILE = 1, 654 CIL_FILECON_DIR, 655 CIL_FILECON_CHAR, 656 CIL_FILECON_BLOCK, 657 CIL_FILECON_SOCKET, 658 CIL_FILECON_PIPE, 659 CIL_FILECON_SYMLINK, 660 CIL_FILECON_ANY 661 }; 662 663 struct cil_filecon { 664 char *path_str; 665 enum cil_filecon_types type; 666 char *context_str; 667 struct cil_context *context; 668 }; 669 670 enum cil_protocol { 671 CIL_PROTOCOL_UDP = 1, 672 CIL_PROTOCOL_TCP 673 }; 674 675 struct cil_portcon { 676 enum cil_protocol proto; 677 uint32_t port_low; 678 uint32_t port_high; 679 char *context_str; 680 struct cil_context *context; 681 }; 682 683 struct cil_nodecon { 684 char *addr_str; 685 struct cil_ipaddr *addr; 686 char *mask_str; 687 struct cil_ipaddr *mask; 688 char *context_str; 689 struct cil_context *context; 690 }; 691 692 struct cil_ipaddr { 693 struct cil_symtab_datum datum; 694 int family; 695 union { 696 struct in_addr v4; 697 struct in6_addr v6; 698 } ip; 699 }; 700 701 struct cil_genfscon { 702 char *fs_str; 703 char *path_str; 704 char *context_str; 705 struct cil_context *context; 706 }; 707 708 struct cil_netifcon { 709 char *interface_str; 710 char *if_context_str; 711 struct cil_context *if_context; 712 char *packet_context_str; 713 struct cil_context *packet_context; 714 char *context_str; 715 }; 716 717 struct cil_pirqcon { 718 uint32_t pirq; 719 char *context_str; 720 struct cil_context *context; 721 }; 722 723 struct cil_iomemcon { 724 uint64_t iomem_low; 725 uint64_t iomem_high; 726 char *context_str; 727 struct cil_context *context; 728 }; 729 730 struct cil_ioportcon { 731 uint32_t ioport_low; 732 uint32_t ioport_high; 733 char *context_str; 734 struct cil_context *context; 735 }; 736 737 struct cil_pcidevicecon { 738 uint32_t dev; 739 char *context_str; 740 struct cil_context *context; 741 }; 742 743 struct cil_devicetreecon { 744 char *path; 745 char *context_str; 746 struct cil_context *context; 747 }; 748 749 750 /* Ensure that CIL uses the same values as sepol services.h */ 751 enum cil_fsuse_types { 752 CIL_FSUSE_XATTR = SECURITY_FS_USE_XATTR, 753 CIL_FSUSE_TASK = SECURITY_FS_USE_TASK, 754 CIL_FSUSE_TRANS = SECURITY_FS_USE_TRANS 755 }; 756 757 struct cil_fsuse { 758 enum cil_fsuse_types type; 759 char *fs_str; 760 char *context_str; 761 struct cil_context *context; 762 }; 763 764 #define CIL_MLS_LEVELS "l1 l2 h1 h2" 765 #define CIL_CONSTRAIN_KEYS "t1 t2 r1 r2 u1 u2" 766 #define CIL_MLSCONSTRAIN_KEYS CIL_MLS_LEVELS CIL_CONSTRAIN_KEYS 767 #define CIL_CONSTRAIN_OPER "== != eq dom domby incomp not and or" 768 struct cil_constrain { 769 struct cil_list *classperms; 770 struct cil_list *str_expr; 771 struct cil_list *datum_expr; 772 }; 773 774 struct cil_validatetrans { 775 char *class_str; 776 struct cil_class *class; 777 struct cil_list *str_expr; 778 struct cil_list *datum_expr; 779 }; 780 781 struct cil_param { 782 char *str; 783 enum cil_flavor flavor; 784 }; 785 786 struct cil_macro { 787 struct cil_symtab_datum datum; 788 symtab_t symtab[CIL_SYM_NUM]; 789 struct cil_list *params; 790 }; 791 792 struct cil_args { 793 char *arg_str; 794 struct cil_symtab_datum *arg; 795 char *param_str; 796 enum cil_flavor flavor; 797 }; 798 799 struct cil_call { 800 char *macro_str; 801 struct cil_macro *macro; 802 struct cil_tree *args_tree; 803 struct cil_list *args; 804 int copied; 805 }; 806 807 #define CIL_TRUE 1 808 #define CIL_FALSE 0 809 810 struct cil_condblock { 811 enum cil_flavor flavor; 812 symtab_t symtab[CIL_SYM_NUM]; 813 }; 814 815 struct cil_booleanif { 816 struct cil_list *str_expr; 817 struct cil_list *datum_expr; 818 int preserved_tunable; 819 }; 820 821 struct cil_tunableif { 822 struct cil_list *str_expr; 823 struct cil_list *datum_expr; 824 }; 825 826 struct cil_policycap { 827 struct cil_symtab_datum datum; 828 }; 829 830 struct cil_bounds { 831 char *parent_str; 832 char *child_str; 833 }; 834 835 /* Ensure that CIL uses the same values as sepol policydb.h */ 836 enum cil_default_object { 837 CIL_DEFAULT_SOURCE = DEFAULT_SOURCE, 838 CIL_DEFAULT_TARGET = DEFAULT_TARGET, 839 }; 840 841 /* Default labeling behavior for users, roles, and types */ 842 struct cil_default { 843 enum cil_flavor flavor; 844 struct cil_list *class_strs; 845 struct cil_list *class_datums; 846 enum cil_default_object object; 847 }; 848 849 /* Ensure that CIL uses the same values as sepol policydb.h */ 850 enum cil_default_object_range { 851 CIL_DEFAULT_SOURCE_LOW = DEFAULT_SOURCE_LOW, 852 CIL_DEFAULT_SOURCE_HIGH = DEFAULT_SOURCE_HIGH, 853 CIL_DEFAULT_SOURCE_LOW_HIGH = DEFAULT_SOURCE_LOW_HIGH, 854 CIL_DEFAULT_TARGET_LOW = DEFAULT_TARGET_LOW, 855 CIL_DEFAULT_TARGET_HIGH = DEFAULT_TARGET_HIGH, 856 CIL_DEFAULT_TARGET_LOW_HIGH = DEFAULT_TARGET_LOW_HIGH, 857 }; 858 859 /* Default labeling behavior for range */ 860 struct cil_defaultrange { 861 struct cil_list *class_strs; 862 struct cil_list *class_datums; 863 enum cil_default_object_range object_range; 864 }; 865 866 struct cil_handleunknown { 867 int handle_unknown; 868 }; 869 870 struct cil_mls { 871 int value; 872 }; 873 874 void cil_db_init(struct cil_db **db); 875 void cil_db_destroy(struct cil_db **db); 876 877 void cil_root_init(struct cil_root **root); 878 void cil_root_destroy(struct cil_root *root); 879 880 void cil_destroy_data(void **data, enum cil_flavor flavor); 881 882 int cil_flavor_to_symtab_index(enum cil_flavor flavor, enum cil_sym_index *index); 883 const char * cil_node_to_string(struct cil_tree_node *node); 884 885 int cil_userprefixes_to_string(struct cil_db *db, char **out, size_t *size); 886 int cil_selinuxusers_to_string(struct cil_db *db, char **out, size_t *size); 887 int cil_filecons_to_string(struct cil_db *db, char **out, size_t *size); 888 889 void cil_symtab_array_init(symtab_t symtab[], int symtab_sizes[CIL_SYM_NUM]); 890 void cil_symtab_array_destroy(symtab_t symtab[]); 891 void cil_destroy_ast_symtabs(struct cil_tree_node *root); 892 int cil_get_symtab(struct cil_tree_node *ast_node, symtab_t **symtab, enum cil_sym_index sym_index); 893 894 void cil_sort_init(struct cil_sort **sort); 895 void cil_sort_destroy(struct cil_sort **sort); 896 void cil_netifcon_init(struct cil_netifcon **netifcon); 897 void cil_context_init(struct cil_context **context); 898 void cil_level_init(struct cil_level **level); 899 void cil_levelrange_init(struct cil_levelrange **lvlrange); 900 void cil_sens_init(struct cil_sens **sens); 901 void cil_block_init(struct cil_block **block); 902 void cil_blockinherit_init(struct cil_blockinherit **inherit); 903 void cil_blockabstract_init(struct cil_blockabstract **abstract); 904 void cil_in_init(struct cil_in **in); 905 void cil_class_init(struct cil_class **class); 906 void cil_classorder_init(struct cil_classorder **classorder); 907 void cil_classcommon_init(struct cil_classcommon **classcommon); 908 void cil_sid_init(struct cil_sid **sid); 909 void cil_sidcontext_init(struct cil_sidcontext **sidcontext); 910 void cil_sidorder_init(struct cil_sidorder **sidorder); 911 void cil_userrole_init(struct cil_userrole **userrole); 912 void cil_userprefix_init(struct cil_userprefix **userprefix); 913 void cil_selinuxuser_init(struct cil_selinuxuser **selinuxuser); 914 void cil_roleattribute_init(struct cil_roleattribute **attribute); 915 void cil_roleattributeset_init(struct cil_roleattributeset **attrset); 916 void cil_roletype_init(struct cil_roletype **roletype); 917 void cil_typeattribute_init(struct cil_typeattribute **attribute); 918 void cil_typeattributeset_init(struct cil_typeattributeset **attrset); 919 void cil_alias_init(struct cil_alias **alias); 920 void cil_aliasactual_init(struct cil_aliasactual **aliasactual); 921 void cil_typepermissive_init(struct cil_typepermissive **typeperm); 922 void cil_name_init(struct cil_name **name); 923 void cil_nametypetransition_init(struct cil_nametypetransition **nametypetrans); 924 void cil_rangetransition_init(struct cil_rangetransition **rangetrans); 925 void cil_bool_init(struct cil_bool **cilbool); 926 void cil_boolif_init(struct cil_booleanif **bif); 927 void cil_condblock_init(struct cil_condblock **cb); 928 void cil_tunable_init(struct cil_tunable **ciltun); 929 void cil_tunif_init(struct cil_tunableif **tif); 930 void cil_avrule_init(struct cil_avrule **avrule); 931 void cil_type_rule_init(struct cil_type_rule **type_rule); 932 void cil_roletransition_init(struct cil_roletransition **roletrans); 933 void cil_roleallow_init(struct cil_roleallow **role_allow); 934 void cil_catset_init(struct cil_catset **catset); 935 void cil_cats_init(struct cil_cats **cats); 936 void cil_senscat_init(struct cil_senscat **senscat); 937 void cil_filecon_init(struct cil_filecon **filecon); 938 void cil_portcon_init(struct cil_portcon **portcon); 939 void cil_nodecon_init(struct cil_nodecon **nodecon); 940 void cil_genfscon_init(struct cil_genfscon **genfscon); 941 void cil_pirqcon_init(struct cil_pirqcon **pirqcon); 942 void cil_iomemcon_init(struct cil_iomemcon **iomemcon); 943 void cil_ioportcon_init(struct cil_ioportcon **ioportcon); 944 void cil_pcidevicecon_init(struct cil_pcidevicecon **pcidevicecon); 945 void cil_devicetreecon_init(struct cil_devicetreecon **devicetreecon); 946 void cil_fsuse_init(struct cil_fsuse **fsuse); 947 void cil_constrain_init(struct cil_constrain **constrain); 948 void cil_validatetrans_init(struct cil_validatetrans **validtrans); 949 void cil_ipaddr_init(struct cil_ipaddr **ipaddr); 950 void cil_perm_init(struct cil_perm **perm); 951 void cil_classpermission_init(struct cil_classpermission **cp); 952 void cil_classpermissionset_init(struct cil_classpermissionset **cps); 953 void cil_classperms_set_init(struct cil_classperms_set **cp_set); 954 void cil_classperms_init(struct cil_classperms **cp); 955 void cil_classmapping_init(struct cil_classmapping **mapping); 956 void cil_user_init(struct cil_user **user); 957 void cil_userlevel_init(struct cil_userlevel **usrlvl); 958 void cil_userrange_init(struct cil_userrange **userrange); 959 void cil_role_init(struct cil_role **role); 960 void cil_type_init(struct cil_type **type); 961 void cil_cat_init(struct cil_cat **cat); 962 void cil_catorder_init(struct cil_catorder **catorder); 963 void cil_sensorder_init(struct cil_sensorder **sensorder); 964 void cil_args_init(struct cil_args **args); 965 void cil_call_init(struct cil_call **call); 966 void cil_optional_init(struct cil_optional **optional); 967 void cil_param_init(struct cil_param **param); 968 void cil_macro_init(struct cil_macro **macro); 969 void cil_policycap_init(struct cil_policycap **policycap); 970 void cil_bounds_init(struct cil_bounds **bounds); 971 void cil_default_init(struct cil_default **def); 972 void cil_defaultrange_init(struct cil_defaultrange **def); 973 void cil_handleunknown_init(struct cil_handleunknown **unk); 974 void cil_mls_init(struct cil_mls **mls); 975 976 #endif 977
