1 2 /* Author : Stephen Smalley, <sds (at) epoch.ncsc.mil> */ 3 4 /* 5 * Updated: Yuichi Nakamura <ynakam (at) hitachisoft.jp> 6 * Tuned number of hash slots for avtab to reduce memory usage 7 */ 8 9 /* Updated: Frank Mayer <mayerf (at) tresys.com> and Karl MacMillan <kmacmillan (at) tresys.com> 10 * 11 * Added conditional policy language extensions 12 * 13 * Copyright (C) 2003 Tresys Technology, LLC 14 * 15 * This library is free software; you can redistribute it and/or 16 * modify it under the terms of the GNU Lesser General Public 17 * License as published by the Free Software Foundation; either 18 * version 2.1 of the License, or (at your option) any later version. 19 * 20 * This library is distributed in the hope that it will be useful, 21 * but WITHOUT ANY WARRANTY; without even the implied warranty of 22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 23 * Lesser General Public License for more details. 24 * 25 * You should have received a copy of the GNU Lesser General Public 26 * License along with this library; if not, write to the Free Software 27 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA 28 */ 29 30 /* FLASK */ 31 32 /* 33 * An access vector table (avtab) is a hash table 34 * of access vectors and transition types indexed 35 * by a type pair and a class. An access vector 36 * table is used to represent the type enforcement 37 * tables. 38 */ 39 40 #ifndef _SEPOL_POLICYDB_AVTAB_H_ 41 #define _SEPOL_POLICYDB_AVTAB_H_ 42 43 #include <sys/cdefs.h> 44 #include <sys/types.h> 45 #include <stdint.h> 46 47 __BEGIN_DECLS 48 49 typedef struct avtab_key { 50 uint16_t source_type; 51 uint16_t target_type; 52 uint16_t target_class; 53 #define AVTAB_ALLOWED 0x0001 54 #define AVTAB_AUDITALLOW 0x0002 55 #define AVTAB_AUDITDENY 0x0004 56 #define AVTAB_NEVERALLOW 0x0080 57 #define AVTAB_AV (AVTAB_ALLOWED | AVTAB_AUDITALLOW | AVTAB_AUDITDENY) 58 #define AVTAB_TRANSITION 0x0010 59 #define AVTAB_MEMBER 0x0020 60 #define AVTAB_CHANGE 0x0040 61 #define AVTAB_TYPE (AVTAB_TRANSITION | AVTAB_MEMBER | AVTAB_CHANGE) 62 #define AVTAB_XPERMS_ALLOWED 0x0100 63 #define AVTAB_XPERMS_AUDITALLOW 0x0200 64 #define AVTAB_XPERMS_DONTAUDIT 0x0400 65 #define AVTAB_XPERMS_NEVERALLOW 0x0800 66 #define AVTAB_XPERMS (AVTAB_XPERMS_ALLOWED | AVTAB_XPERMS_AUDITALLOW | AVTAB_XPERMS_DONTAUDIT) 67 #define AVTAB_ENABLED_OLD 0x80000000 68 #define AVTAB_ENABLED 0x8000 /* reserved for used in cond_avtab */ 69 uint16_t specified; /* what fields are specified */ 70 } avtab_key_t; 71 72 typedef struct avtab_extended_perms { 73 74 #define AVTAB_XPERMS_IOCTLFUNCTION 0x01 75 #define AVTAB_XPERMS_IOCTLDRIVER 0x02 76 /* extension of the avtab_key specified */ 77 uint8_t specified; 78 uint8_t driver; 79 uint32_t perms[8]; 80 } avtab_extended_perms_t; 81 82 typedef struct avtab_datum { 83 uint32_t data; /* access vector or type */ 84 avtab_extended_perms_t *xperms; 85 } avtab_datum_t; 86 87 typedef struct avtab_node *avtab_ptr_t; 88 89 struct avtab_node { 90 avtab_key_t key; 91 avtab_datum_t datum; 92 avtab_ptr_t next; 93 void *parse_context; /* generic context pointer used by parser; 94 * not saved in binary policy */ 95 unsigned merged; /* flag for avtab_write only; 96 not saved in binary policy */ 97 }; 98 99 typedef struct avtab { 100 avtab_ptr_t *htable; 101 uint32_t nel; /* number of elements */ 102 uint32_t nslot; /* number of hash slots */ 103 uint32_t mask; /* mask to compute hash func */ 104 } avtab_t; 105 106 extern int avtab_init(avtab_t *); 107 extern int avtab_alloc(avtab_t *, uint32_t); 108 extern int avtab_insert(avtab_t * h, avtab_key_t * k, avtab_datum_t * d); 109 110 extern avtab_datum_t *avtab_search(avtab_t * h, avtab_key_t * k); 111 112 extern void avtab_destroy(avtab_t * h); 113 114 extern int avtab_map(avtab_t * h, 115 int (*apply) (avtab_key_t * k, 116 avtab_datum_t * d, void *args), void *args); 117 118 extern void avtab_hash_eval(avtab_t * h, char *tag); 119 120 struct policy_file; 121 extern int avtab_read_item(struct policy_file *fp, uint32_t vers, avtab_t * a, 122 int (*insert) (avtab_t * a, avtab_key_t * k, 123 avtab_datum_t * d, void *p), void *p); 124 125 extern int avtab_read(avtab_t * a, struct policy_file *fp, uint32_t vers); 126 127 extern avtab_ptr_t avtab_insert_nonunique(avtab_t * h, avtab_key_t * key, 128 avtab_datum_t * datum); 129 130 extern avtab_ptr_t avtab_insert_with_parse_context(avtab_t * h, 131 avtab_key_t * key, 132 avtab_datum_t * datum, 133 void *parse_context); 134 135 extern avtab_ptr_t avtab_search_node(avtab_t * h, avtab_key_t * key); 136 137 extern avtab_ptr_t avtab_search_node_next(avtab_ptr_t node, int specified); 138 139 #define MAX_AVTAB_HASH_BITS 20 140 #define MAX_AVTAB_HASH_BUCKETS (1 << MAX_AVTAB_HASH_BITS) 141 #define MAX_AVTAB_HASH_MASK (MAX_AVTAB_HASH_BUCKETS-1) 142 /* avtab_alloc uses one bucket per 2-4 elements, so adjust to get maximum buckets */ 143 #define MAX_AVTAB_SIZE (MAX_AVTAB_HASH_BUCKETS << 1) 144 145 __END_DECLS 146 #endif /* _AVTAB_H_ */ 147 148 /* FLASK */ 149
