Home | History | Annotate | Download | only in policydb
      1 
      2 /* Author : Stephen Smalley, <sds (at) epoch.ncsc.mil> */
      3 
      4 /*
      5  * Updated: Yuichi Nakamura <ynakam (at) hitachisoft.jp>
      6  * 	Tuned number of hash slots for avtab to reduce memory usage
      7  */
      8 
      9 /* Updated: Frank Mayer <mayerf (at) tresys.com> and Karl MacMillan <kmacmillan (at) tresys.com>
     10  *
     11  * 	Added conditional policy language extensions
     12  *
     13  * Copyright (C) 2003 Tresys Technology, LLC
     14  *
     15  *  This library is free software; you can redistribute it and/or
     16  *  modify it under the terms of the GNU Lesser General Public
     17  *  License as published by the Free Software Foundation; either
     18  *  version 2.1 of the License, or (at your option) any later version.
     19  *
     20  *  This library is distributed in the hope that it will be useful,
     21  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
     22  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     23  *  Lesser General Public License for more details.
     24  *
     25  *  You should have received a copy of the GNU Lesser General Public
     26  *  License along with this library; if not, write to the Free Software
     27  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
     28  */
     29 
     30 /* FLASK */
     31 
     32 /*
     33  * An access vector table (avtab) is a hash table
     34  * of access vectors and transition types indexed
     35  * by a type pair and a class.  An access vector
     36  * table is used to represent the type enforcement
     37  * tables.
     38  */
     39 
     40 #ifndef _SEPOL_POLICYDB_AVTAB_H_
     41 #define _SEPOL_POLICYDB_AVTAB_H_
     42 
     43 #include <sys/cdefs.h>
     44 #include <sys/types.h>
     45 #include <stdint.h>
     46 
     47 __BEGIN_DECLS
     48 
     49 typedef struct avtab_key {
     50 	uint16_t source_type;
     51 	uint16_t target_type;
     52 	uint16_t target_class;
     53 #define AVTAB_ALLOWED		0x0001
     54 #define AVTAB_AUDITALLOW	0x0002
     55 #define AVTAB_AUDITDENY		0x0004
     56 #define AVTAB_NEVERALLOW	0x0080
     57 #define AVTAB_AV		(AVTAB_ALLOWED | AVTAB_AUDITALLOW | AVTAB_AUDITDENY)
     58 #define AVTAB_TRANSITION	0x0010
     59 #define AVTAB_MEMBER		0x0020
     60 #define AVTAB_CHANGE		0x0040
     61 #define AVTAB_TYPE		(AVTAB_TRANSITION | AVTAB_MEMBER | AVTAB_CHANGE)
     62 #define AVTAB_XPERMS_ALLOWED	0x0100
     63 #define AVTAB_XPERMS_AUDITALLOW	0x0200
     64 #define AVTAB_XPERMS_DONTAUDIT	0x0400
     65 #define AVTAB_XPERMS_NEVERALLOW	0x0800
     66 #define AVTAB_XPERMS		(AVTAB_XPERMS_ALLOWED | AVTAB_XPERMS_AUDITALLOW | AVTAB_XPERMS_DONTAUDIT)
     67 #define AVTAB_ENABLED_OLD	0x80000000
     68 #define AVTAB_ENABLED		0x8000	/* reserved for used in cond_avtab */
     69 	uint16_t specified;	/* what fields are specified */
     70 } avtab_key_t;
     71 
     72 typedef struct avtab_extended_perms {
     73 
     74 #define AVTAB_XPERMS_IOCTLFUNCTION	0x01
     75 #define AVTAB_XPERMS_IOCTLDRIVER	0x02
     76 	/* extension of the avtab_key specified */
     77 	uint8_t specified;
     78 	uint8_t driver;
     79 	uint32_t perms[8];
     80 } avtab_extended_perms_t;
     81 
     82 typedef struct avtab_datum {
     83 	uint32_t data;		/* access vector or type */
     84 	avtab_extended_perms_t *xperms;
     85 } avtab_datum_t;
     86 
     87 typedef struct avtab_node *avtab_ptr_t;
     88 
     89 struct avtab_node {
     90 	avtab_key_t key;
     91 	avtab_datum_t datum;
     92 	avtab_ptr_t next;
     93 	void *parse_context;	/* generic context pointer used by parser;
     94 				 * not saved in binary policy */
     95 	unsigned merged;	/* flag for avtab_write only;
     96 				   not saved in binary policy */
     97 };
     98 
     99 typedef struct avtab {
    100 	avtab_ptr_t *htable;
    101 	uint32_t nel;		/* number of elements */
    102 	uint32_t nslot;         /* number of hash slots */
    103 	uint32_t mask;          /* mask to compute hash func */
    104 } avtab_t;
    105 
    106 extern int avtab_init(avtab_t *);
    107 extern int avtab_alloc(avtab_t *, uint32_t);
    108 extern int avtab_insert(avtab_t * h, avtab_key_t * k, avtab_datum_t * d);
    109 
    110 extern avtab_datum_t *avtab_search(avtab_t * h, avtab_key_t * k);
    111 
    112 extern void avtab_destroy(avtab_t * h);
    113 
    114 extern int avtab_map(avtab_t * h,
    115 		     int (*apply) (avtab_key_t * k,
    116 				   avtab_datum_t * d, void *args), void *args);
    117 
    118 extern void avtab_hash_eval(avtab_t * h, char *tag);
    119 
    120 struct policy_file;
    121 extern int avtab_read_item(struct policy_file *fp, uint32_t vers, avtab_t * a,
    122 			   int (*insert) (avtab_t * a, avtab_key_t * k,
    123 					  avtab_datum_t * d, void *p), void *p);
    124 
    125 extern int avtab_read(avtab_t * a, struct policy_file *fp, uint32_t vers);
    126 
    127 extern avtab_ptr_t avtab_insert_nonunique(avtab_t * h, avtab_key_t * key,
    128 					  avtab_datum_t * datum);
    129 
    130 extern avtab_ptr_t avtab_insert_with_parse_context(avtab_t * h,
    131 						   avtab_key_t * key,
    132 						   avtab_datum_t * datum,
    133 						   void *parse_context);
    134 
    135 extern avtab_ptr_t avtab_search_node(avtab_t * h, avtab_key_t * key);
    136 
    137 extern avtab_ptr_t avtab_search_node_next(avtab_ptr_t node, int specified);
    138 
    139 #define MAX_AVTAB_HASH_BITS 20
    140 #define MAX_AVTAB_HASH_BUCKETS (1 << MAX_AVTAB_HASH_BITS)
    141 #define MAX_AVTAB_HASH_MASK (MAX_AVTAB_HASH_BUCKETS-1)
    142 /* avtab_alloc uses one bucket per 2-4 elements, so adjust to get maximum buckets */
    143 #define MAX_AVTAB_SIZE (MAX_AVTAB_HASH_BUCKETS << 1)
    144 
    145 __END_DECLS
    146 #endif				/* _AVTAB_H_ */
    147 
    148 /* FLASK */
    149