Home | History | Annotate | Download | only in policydb
      1 /* Author : Stephen Smalley, <sds (at) tycho.nsa.gov> */
      2 
      3 /*
      4  * Updated: Joshua Brindle <jbrindle (at) tresys.com>
      5  *	    Karl MacMillan <kmacmillan (at) tresys.com>
      6  *	    Jason Tang <jtang (at) tresys.com>
      7  *
      8  *	Module support
      9  *
     10  * Updated: Trusted Computer Solutions, Inc. <dgoeddel (at) trustedcs.com>
     11  *
     12  *	Support for enhanced MLS infrastructure.
     13  *
     14  * Updated: Frank Mayer <mayerf (at) tresys.com> and Karl MacMillan <kmacmillan (at) tresys.com>
     15  *
     16  * 	Added conditional policy language extensions
     17  *
     18  * Updated: Red Hat, Inc.  James Morris <jmorris (at) redhat.com>
     19  *
     20  *      Fine-grained netlink support
     21  *      IPv6 support
     22  *      Code cleanup
     23  *
     24  * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
     25  * Copyright (C) 2003 - 2004 Tresys Technology, LLC
     26  * Copyright (C) 2003 - 2004 Red Hat, Inc.
     27  * Copyright (C) 2017 Mellanox Techonolgies Inc.
     28  *
     29  *  This library is free software; you can redistribute it and/or
     30  *  modify it under the terms of the GNU Lesser General Public
     31  *  License as published by the Free Software Foundation; either
     32  *  version 2.1 of the License, or (at your option) any later version.
     33  *
     34  *  This library is distributed in the hope that it will be useful,
     35  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
     36  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     37  *  Lesser General Public License for more details.
     38  *
     39  *  You should have received a copy of the GNU Lesser General Public
     40  *  License along with this library; if not, write to the Free Software
     41  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
     42  */
     43 
     44 /* FLASK */
     45 
     46 /*
     47  * A policy database (policydb) specifies the
     48  * configuration data for the security policy.
     49  */
     50 
     51 #ifndef _SEPOL_POLICYDB_POLICYDB_H_
     52 #define _SEPOL_POLICYDB_POLICYDB_H_
     53 
     54 #include <stdio.h>
     55 #include <stddef.h>
     56 
     57 #include <sepol/policydb.h>
     58 
     59 #include <sepol/policydb/flask_types.h>
     60 #include <sepol/policydb/symtab.h>
     61 #include <sepol/policydb/avtab.h>
     62 #include <sepol/policydb/context.h>
     63 #include <sepol/policydb/constraint.h>
     64 #include <sepol/policydb/sidtab.h>
     65 
     66 #define ERRMSG_LEN 1024
     67 
     68 #define POLICYDB_SUCCESS      0
     69 #define POLICYDB_ERROR       -1
     70 #define POLICYDB_UNSUPPORTED -2
     71 
     72 #ifdef __cplusplus
     73 extern "C" {
     74 #endif
     75 
     76 #define IB_DEVICE_NAME_MAX 64
     77 
     78 /*
     79  * A datum type is defined for each kind of symbol
     80  * in the configuration data:  individual permissions,
     81  * common prefixes for access vectors, classes,
     82  * users, roles, types, sensitivities, categories, etc.
     83  */
     84 
     85 /* type set preserves data needed by modules such as *, ~ and attributes */
     86 typedef struct type_set {
     87 	ebitmap_t types;
     88 	ebitmap_t negset;
     89 #define TYPE_STAR 1
     90 #define TYPE_COMP 2
     91 	uint32_t flags;
     92 } type_set_t;
     93 
     94 typedef struct role_set {
     95 	ebitmap_t roles;
     96 #define ROLE_STAR 1
     97 #define ROLE_COMP 2
     98 	uint32_t flags;
     99 } role_set_t;
    100 
    101 /* Permission attributes */
    102 typedef struct perm_datum {
    103 	symtab_datum_t s;
    104 } perm_datum_t;
    105 
    106 /* Attributes of a common prefix for access vectors */
    107 typedef struct common_datum {
    108 	symtab_datum_t s;
    109 	symtab_t permissions;	/* common permissions */
    110 } common_datum_t;
    111 
    112 /* Class attributes */
    113 typedef struct class_datum {
    114 	symtab_datum_t s;
    115 	char *comkey;		/* common name */
    116 	common_datum_t *comdatum;	/* common datum */
    117 	symtab_t permissions;	/* class-specific permission symbol table */
    118 	constraint_node_t *constraints;	/* constraints on class permissions */
    119 	constraint_node_t *validatetrans;	/* special transition rules */
    120 /* Options how a new object user and role should be decided */
    121 #define DEFAULT_SOURCE		1
    122 #define DEFAULT_TARGET		2
    123 	char default_user;
    124 	char default_role;
    125 	char default_type;
    126 /* Options how a new object range should be decided */
    127 #define DEFAULT_SOURCE_LOW	1
    128 #define DEFAULT_SOURCE_HIGH	2
    129 #define DEFAULT_SOURCE_LOW_HIGH	3
    130 #define DEFAULT_TARGET_LOW	4
    131 #define DEFAULT_TARGET_HIGH	5
    132 #define DEFAULT_TARGET_LOW_HIGH	6
    133 	char default_range;
    134 } class_datum_t;
    135 
    136 /* Role attributes */
    137 typedef struct role_datum {
    138 	symtab_datum_t s;
    139 	ebitmap_t dominates;	/* set of roles dominated by this role */
    140 	type_set_t types;	/* set of authorized types for role */
    141 	ebitmap_t cache;	/* This is an expanded set used for context validation during parsing */
    142 	uint32_t bounds;	/* bounds role, if exist */
    143 #define ROLE_ROLE 0		/* regular role in kernel policies */
    144 #define ROLE_ATTRIB 1		/* attribute */
    145 	uint32_t flavor;
    146 	ebitmap_t roles;	/* roles with this attribute */
    147 } role_datum_t;
    148 
    149 typedef struct role_trans {
    150 	uint32_t role;		/* current role */
    151 	uint32_t type;		/* program executable type, or new object type */
    152 	uint32_t tclass;	/* process class, or new object class */
    153 	uint32_t new_role;	/* new role */
    154 	struct role_trans *next;
    155 } role_trans_t;
    156 
    157 typedef struct role_allow {
    158 	uint32_t role;		/* current role */
    159 	uint32_t new_role;	/* new role */
    160 	struct role_allow *next;
    161 } role_allow_t;
    162 
    163 /* filename_trans rules */
    164 typedef struct filename_trans {
    165 	uint32_t stype;
    166 	uint32_t ttype;
    167 	uint32_t tclass;
    168 	char *name;
    169 } filename_trans_t;
    170 
    171 typedef struct filename_trans_datum {
    172 	uint32_t otype;		/* expected of new object */
    173 } filename_trans_datum_t;
    174 
    175 /* Type attributes */
    176 typedef struct type_datum {
    177 	symtab_datum_t s;
    178 	uint32_t primary;	/* primary name? can be set to primary value if below is TYPE_ */
    179 #define TYPE_TYPE 0		/* regular type or alias in kernel policies */
    180 #define TYPE_ATTRIB 1		/* attribute */
    181 #define TYPE_ALIAS 2		/* alias in modular policy */
    182 	uint32_t flavor;
    183 	ebitmap_t types;	/* types with this attribute */
    184 #define TYPE_FLAGS_PERMISSIVE		(1 << 0)
    185 #define TYPE_FLAGS_EXPAND_ATTR_TRUE	(1 << 1)
    186 #define TYPE_FLAGS_EXPAND_ATTR_FALSE	(1 << 2)
    187 #define TYPE_FLAGS_EXPAND_ATTR (TYPE_FLAGS_EXPAND_ATTR_TRUE | \
    188 				TYPE_FLAGS_EXPAND_ATTR_FALSE)
    189 	uint32_t flags;
    190 	uint32_t bounds;	/* bounds type, if exist */
    191 } type_datum_t;
    192 
    193 /*
    194  * Properties of type_datum
    195  * available on the policy version >= (MOD_)POLICYDB_VERSION_BOUNDARY
    196  */
    197 #define TYPEDATUM_PROPERTY_PRIMARY	0x0001
    198 #define TYPEDATUM_PROPERTY_ATTRIBUTE	0x0002
    199 #define TYPEDATUM_PROPERTY_ALIAS	0x0004	/* userspace only */
    200 #define TYPEDATUM_PROPERTY_PERMISSIVE	0x0008	/* userspace only */
    201 
    202 /* User attributes */
    203 typedef struct user_datum {
    204 	symtab_datum_t s;
    205 	role_set_t roles;	/* set of authorized roles for user */
    206 	mls_semantic_range_t range;	/* MLS range (min. - max.) for user */
    207 	mls_semantic_level_t dfltlevel;	/* default login MLS level for user */
    208 	ebitmap_t cache;	/* This is an expanded set used for context validation during parsing */
    209 	mls_range_t exp_range;     /* expanded range used for validation */
    210 	mls_level_t exp_dfltlevel; /* expanded range used for validation */
    211 	uint32_t bounds;	/* bounds user, if exist */
    212 } user_datum_t;
    213 
    214 /* Sensitivity attributes */
    215 typedef struct level_datum {
    216 	mls_level_t *level;	/* sensitivity and associated categories */
    217 	unsigned char isalias;	/* is this sensitivity an alias for another? */
    218 	unsigned char defined;
    219 } level_datum_t;
    220 
    221 /* Category attributes */
    222 typedef struct cat_datum {
    223 	symtab_datum_t s;
    224 	unsigned char isalias;	/* is this category an alias for another? */
    225 } cat_datum_t;
    226 
    227 typedef struct range_trans {
    228 	uint32_t source_type;
    229 	uint32_t target_type;
    230 	uint32_t target_class;
    231 } range_trans_t;
    232 
    233 /* Boolean data type */
    234 typedef struct cond_bool_datum {
    235 	symtab_datum_t s;
    236 	int state;
    237 #define COND_BOOL_FLAGS_TUNABLE	0x01	/* is this a tunable? */
    238 	uint32_t flags;
    239 } cond_bool_datum_t;
    240 
    241 struct cond_node;
    242 
    243 typedef struct cond_node cond_list_t;
    244 struct cond_av_list;
    245 
    246 typedef struct class_perm_node {
    247 	uint32_t tclass;
    248 	uint32_t data;		/* permissions or new type */
    249 	struct class_perm_node *next;
    250 } class_perm_node_t;
    251 
    252 #define xperm_test(x, p) (1 & (p[x >> 5] >> (x & 0x1f)))
    253 #define xperm_set(x, p) (p[x >> 5] |= (1 << (x & 0x1f)))
    254 #define xperm_clear(x, p) (p[x >> 5] &= ~(1 << (x & 0x1f)))
    255 #define EXTENDED_PERMS_LEN 8
    256 
    257 typedef struct av_extended_perms {
    258 #define AVRULE_XPERMS_IOCTLFUNCTION	0x01
    259 #define AVRULE_XPERMS_IOCTLDRIVER	0x02
    260 	uint8_t specified;
    261 	uint8_t driver;
    262 	/* 256 bits of permissions */
    263 	uint32_t perms[EXTENDED_PERMS_LEN];
    264 } av_extended_perms_t;
    265 
    266 typedef struct avrule {
    267 /* these typedefs are almost exactly the same as those in avtab.h - they are
    268  * here because of the need to include neverallow and dontaudit messages */
    269 #define AVRULE_ALLOWED			AVTAB_ALLOWED
    270 #define AVRULE_AUDITALLOW		AVTAB_AUDITALLOW
    271 #define AVRULE_AUDITDENY		AVTAB_AUDITDENY
    272 #define AVRULE_DONTAUDIT		0x0008
    273 #define AVRULE_NEVERALLOW		AVTAB_NEVERALLOW
    274 #define AVRULE_AV         (AVRULE_ALLOWED | AVRULE_AUDITALLOW | AVRULE_AUDITDENY | AVRULE_DONTAUDIT | AVRULE_NEVERALLOW)
    275 #define AVRULE_TRANSITION		AVTAB_TRANSITION
    276 #define AVRULE_MEMBER			AVTAB_MEMBER
    277 #define AVRULE_CHANGE			AVTAB_CHANGE
    278 #define AVRULE_TYPE       (AVRULE_TRANSITION | AVRULE_MEMBER | AVRULE_CHANGE)
    279 #define AVRULE_XPERMS_ALLOWED 		AVTAB_XPERMS_ALLOWED
    280 #define AVRULE_XPERMS_AUDITALLOW	AVTAB_XPERMS_AUDITALLOW
    281 #define AVRULE_XPERMS_DONTAUDIT		AVTAB_XPERMS_DONTAUDIT
    282 #define AVRULE_XPERMS_NEVERALLOW	AVTAB_XPERMS_NEVERALLOW
    283 #define AVRULE_XPERMS	(AVRULE_XPERMS_ALLOWED | AVRULE_XPERMS_AUDITALLOW | \
    284 				AVRULE_XPERMS_DONTAUDIT | AVRULE_XPERMS_NEVERALLOW)
    285 	uint32_t specified;
    286 #define RULE_SELF 1
    287 	uint32_t flags;
    288 	type_set_t stypes;
    289 	type_set_t ttypes;
    290 	class_perm_node_t *perms;
    291 	av_extended_perms_t *xperms;
    292 	unsigned long line;	/* line number from policy.conf where
    293 				 * this rule originated  */
    294 	/* source file name and line number (e.g. .te file) */
    295 	char *source_filename;
    296 	unsigned long source_line;
    297 	struct avrule *next;
    298 } avrule_t;
    299 
    300 typedef struct role_trans_rule {
    301 	role_set_t roles;	/* current role */
    302 	type_set_t types;	/* program executable type, or new object type */
    303 	ebitmap_t classes;	/* process class, or new object class */
    304 	uint32_t new_role;	/* new role */
    305 	struct role_trans_rule *next;
    306 } role_trans_rule_t;
    307 
    308 typedef struct role_allow_rule {
    309 	role_set_t roles;	/* current role */
    310 	role_set_t new_roles;	/* new roles */
    311 	struct role_allow_rule *next;
    312 } role_allow_rule_t;
    313 
    314 typedef struct filename_trans_rule {
    315 	type_set_t stypes;
    316 	type_set_t ttypes;
    317 	uint32_t tclass;
    318 	char *name;
    319 	uint32_t otype;	/* new type */
    320 	struct filename_trans_rule *next;
    321 } filename_trans_rule_t;
    322 
    323 typedef struct range_trans_rule {
    324 	type_set_t stypes;
    325 	type_set_t ttypes;
    326 	ebitmap_t tclasses;
    327 	mls_semantic_range_t trange;
    328 	struct range_trans_rule *next;
    329 } range_trans_rule_t;
    330 
    331 /*
    332  * The configuration data includes security contexts for
    333  * initial SIDs, unlabeled file systems, TCP and UDP port numbers,
    334  * network interfaces, and nodes.  This structure stores the
    335  * relevant data for one such entry.  Entries of the same kind
    336  * (e.g. all initial SIDs) are linked together into a list.
    337  */
    338 typedef struct ocontext {
    339 	union {
    340 		char *name;	/* name of initial SID, fs, netif, fstype, path */
    341 		struct {
    342 			uint8_t protocol;
    343 			uint16_t low_port;
    344 			uint16_t high_port;
    345 		} port;		/* TCP or UDP port information */
    346 		struct {
    347 			uint32_t addr; /* network order */
    348 			uint32_t mask; /* network order */
    349 		} node;		/* node information */
    350 		struct {
    351 			uint32_t addr[4]; /* network order */
    352 			uint32_t mask[4]; /* network order */
    353 		} node6;	/* IPv6 node information */
    354 		uint32_t device;
    355 		uint16_t pirq;
    356 		struct {
    357 			uint64_t low_iomem;
    358 			uint64_t high_iomem;
    359 		} iomem;
    360 		struct {
    361 			uint32_t low_ioport;
    362 			uint32_t high_ioport;
    363 		} ioport;
    364 		struct {
    365 			uint64_t subnet_prefix;
    366 			uint16_t low_pkey;
    367 			uint16_t high_pkey;
    368 		} ibpkey;
    369 		struct {
    370 			char *dev_name;
    371 			uint8_t port;
    372 		} ibendport;
    373 	} u;
    374 	union {
    375 		uint32_t sclass;	/* security class for genfs */
    376 		uint32_t behavior;	/* labeling behavior for fs_use */
    377 	} v;
    378 	context_struct_t context[2];	/* security context(s) */
    379 	sepol_security_id_t sid[2];	/* SID(s) */
    380 	struct ocontext *next;
    381 } ocontext_t;
    382 
    383 typedef struct genfs {
    384 	char *fstype;
    385 	struct ocontext *head;
    386 	struct genfs *next;
    387 } genfs_t;
    388 
    389 /* symbol table array indices */
    390 #define SYM_COMMONS 0
    391 #define SYM_CLASSES 1
    392 #define SYM_ROLES   2
    393 #define SYM_TYPES   3
    394 #define SYM_USERS   4
    395 #define SYM_BOOLS   5
    396 #define SYM_LEVELS  6
    397 #define SYM_CATS    7
    398 #define SYM_NUM     8
    399 
    400 /* object context array indices */
    401 #define OCON_ISID  0	/* initial SIDs */
    402 #define OCON_FS    1	/* unlabeled file systems */
    403 #define OCON_PORT  2	/* TCP and UDP port numbers */
    404 #define OCON_NETIF 3	/* network interfaces */
    405 #define OCON_NODE  4	/* nodes */
    406 #define OCON_FSUSE 5	/* fs_use */
    407 #define OCON_NODE6 6	/* IPv6 nodes */
    408 #define OCON_IBPKEY 7	/* Infiniband PKEY */
    409 #define OCON_IBENDPORT 8	/* Infiniband End Port */
    410 
    411 /* object context array indices for Xen */
    412 #define OCON_XEN_ISID  	    0    /* initial SIDs */
    413 #define OCON_XEN_PIRQ       1    /* physical irqs */
    414 #define OCON_XEN_IOPORT     2    /* io ports */
    415 #define OCON_XEN_IOMEM	    3    /* io memory */
    416 #define OCON_XEN_PCIDEVICE  4    /* pci devices */
    417 #define OCON_XEN_DEVICETREE 5    /* device tree node */
    418 
    419 /* OCON_NUM needs to be the largest index in any platform's ocontext array */
    420 #define OCON_NUM   9
    421 
    422 /* section: module information */
    423 
    424 /* scope_index_t holds all of the symbols that are in scope in a
    425  * particular situation.  The bitmaps are indices (and thus must
    426  * subtract one) into the global policydb->scope array. */
    427 typedef struct scope_index {
    428 	ebitmap_t scope[SYM_NUM];
    429 #define p_classes_scope scope[SYM_CLASSES]
    430 #define p_roles_scope scope[SYM_ROLES]
    431 #define p_types_scope scope[SYM_TYPES]
    432 #define p_users_scope scope[SYM_USERS]
    433 #define p_bools_scope scope[SYM_BOOLS]
    434 #define p_sens_scope scope[SYM_LEVELS]
    435 #define p_cat_scope scope[SYM_CATS]
    436 
    437 	/* this array maps from class->value to the permissions within
    438 	 * scope.  if bit (perm->value - 1) is set in map
    439 	 * class_perms_map[class->value - 1] then that permission is
    440 	 * enabled for this class within this decl.  */
    441 	ebitmap_t *class_perms_map;
    442 	/* total number of classes in class_perms_map array */
    443 	uint32_t class_perms_len;
    444 } scope_index_t;
    445 
    446 /* a list of declarations for a particular avrule_decl */
    447 
    448 /* These two structs declare a block of policy that has TE and RBAC
    449  * statements and declarations.  The root block (the global policy)
    450  * can never have an ELSE branch. */
    451 typedef struct avrule_decl {
    452 	uint32_t decl_id;
    453 	uint32_t enabled;	/* whether this block is enabled */
    454 
    455 	cond_list_t *cond_list;
    456 	avrule_t *avrules;
    457 	role_trans_rule_t *role_tr_rules;
    458 	role_allow_rule_t *role_allow_rules;
    459 	range_trans_rule_t *range_tr_rules;
    460 	scope_index_t required;	/* symbols needed to activate this block */
    461 	scope_index_t declared;	/* symbols declared within this block */
    462 
    463 	/* type transition rules with a 'name' component */
    464 	filename_trans_rule_t *filename_trans_rules;
    465 
    466 	/* for additive statements (type attribute, roles, and users) */
    467 	symtab_t symtab[SYM_NUM];
    468 
    469 	/* In a linked module this will contain the name of the module
    470 	 * from which this avrule_decl originated. */
    471 	char *module_name;
    472 
    473 	struct avrule_decl *next;
    474 } avrule_decl_t;
    475 
    476 typedef struct avrule_block {
    477 	avrule_decl_t *branch_list;
    478 	avrule_decl_t *enabled;	/* pointer to which branch is enabled.  this is
    479 				   used in linking and never written to disk */
    480 #define AVRULE_OPTIONAL 1
    481 	uint32_t flags;		/* any flags for this block, currently just optional */
    482 	struct avrule_block *next;
    483 } avrule_block_t;
    484 
    485 /* Every identifier has its own scope datum.  The datum describes if
    486  * the item is to be included into the final policy during
    487  * expansion. */
    488 typedef struct scope_datum {
    489 /* Required for this decl */
    490 #define SCOPE_REQ  1
    491 /* Declared in this decl */
    492 #define SCOPE_DECL 2
    493 	uint32_t scope;
    494 	uint32_t *decl_ids;
    495 	uint32_t decl_ids_len;
    496 	/* decl_ids is a list of avrule_decl's that declare/require
    497 	 * this symbol.  If scope==SCOPE_DECL then this is a list of
    498 	 * declarations.  If the symbol may only be declared once
    499 	 * (types, bools) then decl_ids_len will be exactly 1.  For
    500 	 * implicitly declared things (roles, users) then decl_ids_len
    501 	 * will be at least 1. */
    502 } scope_datum_t;
    503 
    504 /* The policy database */
    505 typedef struct policydb {
    506 #define POLICY_KERN SEPOL_POLICY_KERN
    507 #define POLICY_BASE SEPOL_POLICY_BASE
    508 #define POLICY_MOD SEPOL_POLICY_MOD
    509 	uint32_t policy_type;
    510 	char *name;
    511 	char *version;
    512 	int  target_platform;
    513 
    514 	/* Set when the policydb is modified such that writing is unsupported */
    515 	int unsupported_format;
    516 
    517 	/* Whether this policydb is mls, should always be set */
    518 	int mls;
    519 
    520 	/* symbol tables */
    521 	symtab_t symtab[SYM_NUM];
    522 #define p_commons symtab[SYM_COMMONS]
    523 #define p_classes symtab[SYM_CLASSES]
    524 #define p_roles symtab[SYM_ROLES]
    525 #define p_types symtab[SYM_TYPES]
    526 #define p_users symtab[SYM_USERS]
    527 #define p_bools symtab[SYM_BOOLS]
    528 #define p_levels symtab[SYM_LEVELS]
    529 #define p_cats symtab[SYM_CATS]
    530 
    531 	/* symbol names indexed by (value - 1) */
    532 	char **sym_val_to_name[SYM_NUM];
    533 #define p_common_val_to_name sym_val_to_name[SYM_COMMONS]
    534 #define p_class_val_to_name sym_val_to_name[SYM_CLASSES]
    535 #define p_role_val_to_name sym_val_to_name[SYM_ROLES]
    536 #define p_type_val_to_name sym_val_to_name[SYM_TYPES]
    537 #define p_user_val_to_name sym_val_to_name[SYM_USERS]
    538 #define p_bool_val_to_name sym_val_to_name[SYM_BOOLS]
    539 #define p_sens_val_to_name sym_val_to_name[SYM_LEVELS]
    540 #define p_cat_val_to_name sym_val_to_name[SYM_CATS]
    541 
    542 	/* class, role, and user attributes indexed by (value - 1) */
    543 	class_datum_t **class_val_to_struct;
    544 	role_datum_t **role_val_to_struct;
    545 	user_datum_t **user_val_to_struct;
    546 	type_datum_t **type_val_to_struct;
    547 
    548 	/* module stuff section -- used in parsing and for modules */
    549 
    550 	/* keep track of the scope for every identifier.  these are
    551 	 * hash tables, where the key is the identifier name and value
    552 	 * a scope_datum_t.  as a convenience, one may use the
    553 	 * p_*_macros (cf. struct scope_index_t declaration). */
    554 	symtab_t scope[SYM_NUM];
    555 
    556 	/* module rule storage */
    557 	avrule_block_t *global;
    558 	/* avrule_decl index used for link/expand */
    559 	avrule_decl_t **decl_val_to_struct;
    560 
    561 	/* compiled storage of rules - use for the kernel policy */
    562 
    563 	/* type enforcement access vectors and transitions */
    564 	avtab_t te_avtab;
    565 
    566 	/* bools indexed by (value - 1) */
    567 	cond_bool_datum_t **bool_val_to_struct;
    568 	/* type enforcement conditional access vectors and transitions */
    569 	avtab_t te_cond_avtab;
    570 	/* linked list indexing te_cond_avtab by conditional */
    571 	cond_list_t *cond_list;
    572 
    573 	/* role transitions */
    574 	role_trans_t *role_tr;
    575 
    576 	/* role allows */
    577 	role_allow_t *role_allow;
    578 
    579 	/* security contexts of initial SIDs, unlabeled file systems,
    580 	   TCP or UDP port numbers, network interfaces and nodes */
    581 	ocontext_t *ocontexts[OCON_NUM];
    582 
    583 	/* security contexts for files in filesystems that cannot support
    584 	   a persistent label mapping or use another
    585 	   fixed labeling behavior. */
    586 	genfs_t *genfs;
    587 
    588 	/* range transitions table (range_trans_key -> mls_range) */
    589 	hashtab_t range_tr;
    590 
    591 	/* file transitions with the last path component */
    592 	hashtab_t filename_trans;
    593 
    594 	ebitmap_t *type_attr_map;
    595 
    596 	ebitmap_t *attr_type_map;	/* not saved in the binary policy */
    597 
    598 	ebitmap_t policycaps;
    599 
    600 	/* this bitmap is referenced by type NOT the typical type-1 used in other
    601 	   bitmaps.  Someday the 0 bit may be used for global permissive */
    602 	ebitmap_t permissive_map;
    603 
    604 	unsigned policyvers;
    605 
    606 	unsigned handle_unknown;
    607 } policydb_t;
    608 
    609 struct sepol_policydb {
    610 	struct policydb p;
    611 };
    612 
    613 extern int policydb_init(policydb_t * p);
    614 
    615 extern int policydb_from_image(sepol_handle_t * handle,
    616 			       void *data, size_t len, policydb_t * policydb);
    617 
    618 extern int policydb_to_image(sepol_handle_t * handle,
    619 			     policydb_t * policydb, void **newdata,
    620 			     size_t * newlen);
    621 
    622 extern int policydb_index_classes(policydb_t * p);
    623 
    624 extern int policydb_index_bools(policydb_t * p);
    625 
    626 extern int policydb_index_others(sepol_handle_t * handle, policydb_t * p,
    627 				 unsigned int verbose);
    628 
    629 extern int policydb_role_cache(hashtab_key_t key,
    630 			       hashtab_datum_t datum,
    631 			       void *arg);
    632 
    633 extern int policydb_user_cache(hashtab_key_t key,
    634 			       hashtab_datum_t datum,
    635 			       void *arg);
    636 
    637 extern int policydb_reindex_users(policydb_t * p);
    638 
    639 extern void policydb_destroy(policydb_t * p);
    640 
    641 extern int policydb_load_isids(policydb_t * p, sidtab_t * s);
    642 
    643 /* Deprecated */
    644 extern int policydb_context_isvalid(const policydb_t * p,
    645 				    const context_struct_t * c);
    646 
    647 extern void symtabs_destroy(symtab_t * symtab);
    648 extern int scope_destroy(hashtab_key_t key, hashtab_datum_t datum, void *p);
    649 typedef void (*hashtab_destroy_func_t) (hashtab_key_t k, hashtab_datum_t d,
    650 					void *args);
    651 extern hashtab_destroy_func_t get_symtab_destroy_func(int sym_num);
    652 
    653 extern void class_perm_node_init(class_perm_node_t * x);
    654 extern void type_set_init(type_set_t * x);
    655 extern void type_set_destroy(type_set_t * x);
    656 extern int type_set_cpy(type_set_t * dst, type_set_t * src);
    657 extern int type_set_or_eq(type_set_t * dst, type_set_t * other);
    658 extern void role_set_init(role_set_t * x);
    659 extern void role_set_destroy(role_set_t * x);
    660 extern void avrule_init(avrule_t * x);
    661 extern void avrule_destroy(avrule_t * x);
    662 extern void avrule_list_destroy(avrule_t * x);
    663 extern void role_trans_rule_init(role_trans_rule_t * x);
    664 extern void role_trans_rule_list_destroy(role_trans_rule_t * x);
    665 extern void filename_trans_rule_init(filename_trans_rule_t * x);
    666 extern void filename_trans_rule_list_destroy(filename_trans_rule_t * x);
    667 
    668 extern void role_datum_init(role_datum_t * x);
    669 extern void role_datum_destroy(role_datum_t * x);
    670 extern void role_allow_rule_init(role_allow_rule_t * x);
    671 extern void role_allow_rule_destroy(role_allow_rule_t * x);
    672 extern void role_allow_rule_list_destroy(role_allow_rule_t * x);
    673 extern void range_trans_rule_init(range_trans_rule_t *x);
    674 extern void range_trans_rule_destroy(range_trans_rule_t *x);
    675 extern void range_trans_rule_list_destroy(range_trans_rule_t *x);
    676 extern void type_datum_init(type_datum_t * x);
    677 extern void type_datum_destroy(type_datum_t * x);
    678 extern void user_datum_init(user_datum_t * x);
    679 extern void user_datum_destroy(user_datum_t * x);
    680 extern void level_datum_init(level_datum_t * x);
    681 extern void level_datum_destroy(level_datum_t * x);
    682 extern void cat_datum_init(cat_datum_t * x);
    683 extern void cat_datum_destroy(cat_datum_t * x);
    684 extern int check_assertion(policydb_t *p, avrule_t *avrule);
    685 extern int check_assertions(sepol_handle_t * handle,
    686 			    policydb_t * p, avrule_t * avrules);
    687 
    688 extern int symtab_insert(policydb_t * x, uint32_t sym,
    689 			 hashtab_key_t key, hashtab_datum_t datum,
    690 			 uint32_t scope, uint32_t avrule_decl_id,
    691 			 uint32_t * value);
    692 
    693 /* A policy "file" may be a memory region referenced by a (data, len) pair
    694    or a file referenced by a FILE pointer. */
    695 typedef struct policy_file {
    696 #define PF_USE_MEMORY  0
    697 #define PF_USE_STDIO   1
    698 #define PF_LEN         2	/* total up length in len field */
    699 	unsigned type;
    700 	char *data;
    701 	size_t len;
    702 	size_t size;
    703 	FILE *fp;
    704 	struct sepol_handle *handle;
    705 } policy_file_t;
    706 
    707 struct sepol_policy_file {
    708 	struct policy_file pf;
    709 };
    710 
    711 extern void policy_file_init(policy_file_t * x);
    712 
    713 extern int policydb_read(policydb_t * p, struct policy_file *fp,
    714 			 unsigned int verbose);
    715 extern int avrule_read_list(policydb_t * p, avrule_t ** avrules,
    716 			    struct policy_file *fp);
    717 
    718 extern int policydb_write(struct policydb *p, struct policy_file *pf);
    719 extern int policydb_set_target_platform(policydb_t *p, int platform);
    720 
    721 #define PERM_SYMTAB_SIZE 32
    722 
    723 /* Identify specific policy version changes */
    724 #define POLICYDB_VERSION_BASE		15
    725 #define POLICYDB_VERSION_BOOL		16
    726 #define POLICYDB_VERSION_IPV6		17
    727 #define POLICYDB_VERSION_NLCLASS	18
    728 #define POLICYDB_VERSION_VALIDATETRANS	19
    729 #define POLICYDB_VERSION_MLS		19
    730 #define POLICYDB_VERSION_AVTAB		20
    731 #define POLICYDB_VERSION_RANGETRANS	21
    732 #define POLICYDB_VERSION_POLCAP		22
    733 #define POLICYDB_VERSION_PERMISSIVE	23
    734 #define POLICYDB_VERSION_BOUNDARY	24
    735 #define POLICYDB_VERSION_FILENAME_TRANS	25
    736 #define POLICYDB_VERSION_ROLETRANS	26
    737 #define POLICYDB_VERSION_NEW_OBJECT_DEFAULTS	27
    738 #define POLICYDB_VERSION_DEFAULT_TYPE	28
    739 #define POLICYDB_VERSION_CONSTRAINT_NAMES	29
    740 #define POLICYDB_VERSION_XEN_DEVICETREE		30 /* Xen-specific */
    741 #define POLICYDB_VERSION_XPERMS_IOCTL	30 /* Linux-specific */
    742 #define POLICYDB_VERSION_INFINIBAND		31 /* Linux-specific */
    743 
    744 /* Range of policy versions we understand*/
    745 #define POLICYDB_VERSION_MIN	POLICYDB_VERSION_BASE
    746 #define POLICYDB_VERSION_MAX	POLICYDB_VERSION_INFINIBAND
    747 
    748 /* Module versions and specific changes*/
    749 #define MOD_POLICYDB_VERSION_BASE		4
    750 #define MOD_POLICYDB_VERSION_VALIDATETRANS	5
    751 #define MOD_POLICYDB_VERSION_MLS		5
    752 #define MOD_POLICYDB_VERSION_RANGETRANS 	6
    753 #define MOD_POLICYDB_VERSION_MLS_USERS		6
    754 #define MOD_POLICYDB_VERSION_POLCAP		7
    755 #define MOD_POLICYDB_VERSION_PERMISSIVE		8
    756 #define MOD_POLICYDB_VERSION_BOUNDARY		9
    757 #define MOD_POLICYDB_VERSION_BOUNDARY_ALIAS	10
    758 #define MOD_POLICYDB_VERSION_FILENAME_TRANS	11
    759 #define MOD_POLICYDB_VERSION_ROLETRANS		12
    760 #define MOD_POLICYDB_VERSION_ROLEATTRIB		13
    761 #define MOD_POLICYDB_VERSION_TUNABLE_SEP	14
    762 #define MOD_POLICYDB_VERSION_NEW_OBJECT_DEFAULTS	15
    763 #define MOD_POLICYDB_VERSION_DEFAULT_TYPE	16
    764 #define MOD_POLICYDB_VERSION_CONSTRAINT_NAMES  17
    765 #define MOD_POLICYDB_VERSION_XPERMS_IOCTL  18
    766 #define MOD_POLICYDB_VERSION_INFINIBAND		19
    767 
    768 #define MOD_POLICYDB_VERSION_MIN MOD_POLICYDB_VERSION_BASE
    769 #define MOD_POLICYDB_VERSION_MAX MOD_POLICYDB_VERSION_INFINIBAND
    770 
    771 #define POLICYDB_CONFIG_MLS    1
    772 
    773 /* macros to check policy feature */
    774 
    775 /* TODO: add other features here */
    776 
    777 #define policydb_has_boundary_feature(p)			\
    778 	(((p)->policy_type == POLICY_KERN			\
    779 	  && p->policyvers >= POLICYDB_VERSION_BOUNDARY) ||	\
    780 	 ((p)->policy_type != POLICY_KERN			\
    781 	  && p->policyvers >= MOD_POLICYDB_VERSION_BOUNDARY))
    782 
    783 /* the config flags related to unknown classes/perms are bits 2 and 3 */
    784 #define DENY_UNKNOWN	SEPOL_DENY_UNKNOWN
    785 #define REJECT_UNKNOWN	SEPOL_REJECT_UNKNOWN
    786 #define ALLOW_UNKNOWN 	SEPOL_ALLOW_UNKNOWN
    787 
    788 #define POLICYDB_CONFIG_UNKNOWN_MASK	(DENY_UNKNOWN | REJECT_UNKNOWN | ALLOW_UNKNOWN)
    789 
    790 #define OBJECT_R "object_r"
    791 #define OBJECT_R_VAL 1
    792 
    793 #define POLICYDB_MAGIC SELINUX_MAGIC
    794 #define POLICYDB_STRING "SE Linux"
    795 #define POLICYDB_XEN_STRING "XenFlask"
    796 #define POLICYDB_STRING_MAX_LENGTH 32
    797 #define POLICYDB_MOD_MAGIC SELINUX_MOD_MAGIC
    798 #define POLICYDB_MOD_STRING "SE Linux Module"
    799 
    800 #ifdef __cplusplus
    801 }
    802 #endif
    803 
    804 #endif				/* _POLICYDB_H_ */
    805 
    806 /* FLASK */
    807