Server : Apache
System : Linux copper.netcy.com 2.6.32-754.27.1.el6.centos.plus.x86_64 #1 SMP Thu Jan 30 13:54:25 UTC 2020 x86_64
User : montcaro ( 581)
PHP Version : 7.4.28
Disable Function : NONE
Directory : /usr/include/sepol/policydb/
|
Server : Apache System : Linux copper.netcy.com 2.6.32-754.27.1.el6.centos.plus.x86_64 #1 SMP Thu Jan 30 13:54:25 UTC 2020 x86_64 User : montcaro ( 581) PHP Version : 7.4.28 Disable Function : NONE Directory : /usr/include/sepol/policydb/ |
/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */
/*
* Updated: Joshua Brindle <jbrindle@tresys.com>
* Karl MacMillan <kmacmillan@tresys.com>
* Jason Tang <jtang@tresys.com>
*
* Module support
*
* Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
*
* Support for enhanced MLS infrastructure.
*
* Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com>
*
* Added conditional policy language extensions
*
* Updated: Red Hat, Inc. James Morris <jmorris@redhat.com>
*
* Fine-grained netlink support
* IPv6 support
* Code cleanup
*
* Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
* Copyright (C) 2003 - 2004 Tresys Technology, LLC
* Copyright (C) 2003 - 2004 Red Hat, Inc.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
*/
/* FLASK */
/*
* A policy database (policydb) specifies the
* configuration data for the security policy.
*/
#ifndef _SEPOL_POLICYDB_POLICYDB_H_
#define _SEPOL_POLICYDB_POLICYDB_H_
#include <stdio.h>
#include <stddef.h>
#include <sepol/policydb.h>
#include <sepol/policydb/flask_types.h>
#include <sepol/policydb/symtab.h>
#include <sepol/policydb/avtab.h>
#include <sepol/policydb/context.h>
#include <sepol/policydb/constraint.h>
#include <sepol/policydb/sidtab.h>
#define ERRMSG_LEN 1024
#define POLICYDB_SUCCESS 0
#define POLICYDB_ERROR -1
#define POLICYDB_UNSUPPORTED -2
/*
* A datum type is defined for each kind of symbol
* in the configuration data: individual permissions,
* common prefixes for access vectors, classes,
* users, roles, types, sensitivities, categories, etc.
*/
/* type set preserves data needed by modules such as *, ~ and attributes */
typedef struct type_set {
ebitmap_t types;
ebitmap_t negset;
#define TYPE_STAR 1
#define TYPE_COMP 2
uint32_t flags;
} type_set_t;
typedef struct role_set {
ebitmap_t roles;
#define ROLE_STAR 1
#define ROLE_COMP 2
uint32_t flags;
} role_set_t;
/* Permission attributes */
typedef struct perm_datum {
symtab_datum_t s;
} perm_datum_t;
/* Attributes of a common prefix for access vectors */
typedef struct common_datum {
symtab_datum_t s;
symtab_t permissions; /* common permissions */
} common_datum_t;
/* Class attributes */
typedef struct class_datum {
symtab_datum_t s;
char *comkey; /* common name */
common_datum_t *comdatum; /* common datum */
symtab_t permissions; /* class-specific permission symbol table */
constraint_node_t *constraints; /* constraints on class permissions */
constraint_node_t *validatetrans; /* special transition rules */
} class_datum_t;
/* Role attributes */
typedef struct role_datum {
symtab_datum_t s;
ebitmap_t dominates; /* set of roles dominated by this role */
type_set_t types; /* set of authorized types for role */
ebitmap_t cache; /* This is an expanded set used for context validation during parsing */
uint32_t bounds; /* bounds role, if exist */
} role_datum_t;
typedef struct role_trans {
uint32_t role; /* current role */
uint32_t type; /* program executable type */
uint32_t new_role; /* new role */
struct role_trans *next;
} role_trans_t;
typedef struct role_allow {
uint32_t role; /* current role */
uint32_t new_role; /* new role */
struct role_allow *next;
} role_allow_t;
/* Type attributes */
typedef struct type_datum {
symtab_datum_t s;
uint32_t primary; /* primary name? can be set to primary value if below is TYPE_ */
#define TYPE_TYPE 0 /* regular type or alias in kernel policies */
#define TYPE_ATTRIB 1 /* attribute */
#define TYPE_ALIAS 2 /* alias in modular policy */
uint32_t flavor;
ebitmap_t types; /* types with this attribute */
#define TYPE_FLAGS_PERMISSIVE 0x01
uint32_t flags;
uint32_t bounds; /* bounds type, if exist */
} type_datum_t;
/*
* Properties of type_datum
* available on the policy version >= (MOD_)POLICYDB_VERSION_BOUNDARY
*/
#define TYPEDATUM_PROPERTY_PRIMARY 0x0001
#define TYPEDATUM_PROPERTY_ATTRIBUTE 0x0002
#define TYPEDATUM_PROPERTY_ALIAS 0x0004 /* userspace only */
#define TYPEDATUM_PROPERTY_PERMISSIVE 0x0008 /* userspace only */
/* User attributes */
typedef struct user_datum {
symtab_datum_t s;
role_set_t roles; /* set of authorized roles for user */
mls_semantic_range_t range; /* MLS range (min. - max.) for user */
mls_semantic_level_t dfltlevel; /* default login MLS level for user */
ebitmap_t cache; /* This is an expanded set used for context validation during parsing */
mls_range_t exp_range; /* expanded range used for validation */
mls_level_t exp_dfltlevel; /* expanded range used for validation */
uint32_t bounds; /* bounds user, if exist */
} user_datum_t;
/* Sensitivity attributes */
typedef struct level_datum {
mls_level_t *level; /* sensitivity and associated categories */
unsigned char isalias; /* is this sensitivity an alias for another? */
unsigned char defined;
} level_datum_t;
/* Category attributes */
typedef struct cat_datum {
symtab_datum_t s;
unsigned char isalias; /* is this category an alias for another? */
} cat_datum_t;
typedef struct range_trans {
uint32_t source_type;
uint32_t target_type;
uint32_t target_class;
mls_range_t target_range;
struct range_trans *next;
} range_trans_t;
/* Boolean data type */
typedef struct cond_bool_datum {
symtab_datum_t s;
int state;
} cond_bool_datum_t;
struct cond_node;
typedef struct cond_node cond_list_t;
struct cond_av_list;
typedef struct class_perm_node {
uint32_t class;
uint32_t data; /* permissions or new type */
struct class_perm_node *next;
} class_perm_node_t;
typedef struct avrule {
/* these typedefs are almost exactly the same as those in avtab.h - they are
* here because of the need to include neverallow and dontaudit messages */
#define AVRULE_ALLOWED 1
#define AVRULE_AUDITALLOW 2
#define AVRULE_AUDITDENY 4
#define AVRULE_DONTAUDIT 8
#define AVRULE_NEVERALLOW 128
#define AVRULE_AV (AVRULE_ALLOWED | AVRULE_AUDITALLOW | AVRULE_AUDITDENY | AVRULE_DONTAUDIT | AVRULE_NEVERALLOW)
#define AVRULE_TRANSITION 16
#define AVRULE_MEMBER 32
#define AVRULE_CHANGE 64
#define AVRULE_TYPE (AVRULE_TRANSITION | AVRULE_MEMBER | AVRULE_CHANGE)
uint32_t specified;
#define RULE_SELF 1
uint32_t flags;
type_set_t stypes;
type_set_t ttypes;
class_perm_node_t *perms;
unsigned long line; /* line number from policy.conf where
* this rule originated */
struct avrule *next;
} avrule_t;
typedef struct role_trans_rule {
role_set_t roles; /* current role */
type_set_t types; /* program executable type */
uint32_t new_role; /* new role */
struct role_trans_rule *next;
} role_trans_rule_t;
typedef struct role_allow_rule {
role_set_t roles; /* current role */
role_set_t new_roles; /* new roles */
struct role_allow_rule *next;
} role_allow_rule_t;
typedef struct range_trans_rule {
type_set_t stypes;
type_set_t ttypes;
ebitmap_t tclasses;
mls_semantic_range_t trange;
struct range_trans_rule *next;
} range_trans_rule_t;
/*
* The configuration data includes security contexts for
* initial SIDs, unlabeled file systems, TCP and UDP port numbers,
* network interfaces, and nodes. This structure stores the
* relevant data for one such entry. Entries of the same kind
* (e.g. all initial SIDs) are linked together into a list.
*/
typedef struct ocontext {
union {
char *name; /* name of initial SID, fs, netif, fstype, path */
struct {
uint8_t protocol;
uint16_t low_port;
uint16_t high_port;
} port; /* TCP or UDP port information */
struct {
uint32_t addr; /* network order */
uint32_t mask; /* network order */
} node; /* node information */
struct {
uint32_t addr[4]; /* network order */
uint32_t mask[4]; /* network order */
} node6; /* IPv6 node information */
uint32_t device;
uint16_t pirq;
struct {
uint32_t low_iomem;
uint32_t high_iomem;
} iomem;
struct {
uint32_t low_ioport;
uint32_t high_ioport;
} ioport;
} u;
union {
uint32_t sclass; /* security class for genfs */
uint32_t behavior; /* labeling behavior for fs_use */
} v;
context_struct_t context[2]; /* security context(s) */
sepol_security_id_t sid[2]; /* SID(s) */
struct ocontext *next;
} ocontext_t;
typedef struct genfs {
char *fstype;
struct ocontext *head;
struct genfs *next;
} genfs_t;
/* symbol table array indices */
#define SYM_COMMONS 0
#define SYM_CLASSES 1
#define SYM_ROLES 2
#define SYM_TYPES 3
#define SYM_USERS 4
#define SYM_BOOLS 5
#define SYM_LEVELS 6
#define SYM_CATS 7
#define SYM_NUM 8
/* object context array indices */
#define OCON_ISID 0 /* initial SIDs */
#define OCON_FS 1 /* unlabeled file systems */
#define OCON_PORT 2 /* TCP and UDP port numbers */
#define OCON_NETIF 3 /* network interfaces */
#define OCON_NODE 4 /* nodes */
#define OCON_FSUSE 5 /* fs_use */
#define OCON_NODE6 6 /* IPv6 nodes */
#define OCON_GENFS 7 /* needed for ocontext_supported */
/* object context array indices for Xen */
#define OCON_XEN_ISID 0 /* initial SIDs */
#define OCON_XEN_PIRQ 1 /* physical irqs */
#define OCON_XEN_IOPORT 2 /* io ports */
#define OCON_XEN_IOMEM 3 /* io memory */
#define OCON_XEN_PCIDEVICE 4 /* pci devices */
/* OCON_NUM needs to be the largest index in any platform's ocontext array */
#define OCON_NUM 7
/* section: module information */
/* scope_index_t holds all of the symbols that are in scope in a
* particular situation. The bitmaps are indices (and thus must
* subtract one) into the global policydb->scope array. */
typedef struct scope_index {
ebitmap_t scope[SYM_NUM];
#define p_classes_scope scope[SYM_CLASSES]
#define p_roles_scope scope[SYM_ROLES]
#define p_types_scope scope[SYM_TYPES]
#define p_users_scope scope[SYM_USERS]
#define p_bools_scope scope[SYM_BOOLS]
#define p_sens_scope scope[SYM_LEVELS]
#define p_cat_scope scope[SYM_CATS]
/* this array maps from class->value to the permissions within
* scope. if bit (perm->value - 1) is set in map
* class_perms_map[class->value - 1] then that permission is
* enabled for this class within this decl. */
ebitmap_t *class_perms_map;
/* total number of classes in class_perms_map array */
uint32_t class_perms_len;
} scope_index_t;
/* a list of declarations for a particular avrule_decl */
/* These two structs declare a block of policy that has TE and RBAC
* statements and declarations. The root block (the global policy)
* can never have an ELSE branch. */
typedef struct avrule_decl {
uint32_t decl_id;
uint32_t enabled; /* whether this block is enabled */
cond_list_t *cond_list;
avrule_t *avrules;
role_trans_rule_t *role_tr_rules;
role_allow_rule_t *role_allow_rules;
range_trans_rule_t *range_tr_rules;
scope_index_t required; /* symbols needed to activate this block */
scope_index_t declared; /* symbols declared within this block */
/* for additive statements (type attribute, roles, and users) */
symtab_t symtab[SYM_NUM];
/* In a linked module this will contain the name of the module
* from which this avrule_decl originated. */
char *module_name;
struct avrule_decl *next;
} avrule_decl_t;
typedef struct avrule_block {
avrule_decl_t *branch_list;
avrule_decl_t *enabled; /* pointer to which branch is enabled. this is
used in linking and never written to disk */
#define AVRULE_OPTIONAL 1
uint32_t flags; /* any flags for this block, currently just optional */
struct avrule_block *next;
} avrule_block_t;
/* Every identifier has its own scope datum. The datum describes if
* the item is to be included into the final policy during
* expansion. */
typedef struct scope_datum {
/* Required for this decl */
#define SCOPE_REQ 1
/* Declared in this decl */
#define SCOPE_DECL 2
uint32_t scope;
uint32_t *decl_ids;
uint32_t decl_ids_len;
/* decl_ids is a list of avrule_decl's that declare/require
* this symbol. If scope==SCOPE_DECL then this is a list of
* declarations. If the symbol may only be declared once
* (types, bools) then decl_ids_len will be exactly 1. For
* implicitly declared things (roles, users) then decl_ids_len
* will be at least 1. */
} scope_datum_t;
/* The policy database */
typedef struct policydb {
#define POLICY_KERN SEPOL_POLICY_KERN
#define POLICY_BASE SEPOL_POLICY_BASE
#define POLICY_MOD SEPOL_POLICY_MOD
uint32_t policy_type;
char *name;
char *version;
int target_platform;
/* Set when the policydb is modified such that writing is unsupported */
int unsupported_format;
/* Whether this policydb is mls, should always be set */
int mls;
/* symbol tables */
symtab_t symtab[SYM_NUM];
#define p_commons symtab[SYM_COMMONS]
#define p_classes symtab[SYM_CLASSES]
#define p_roles symtab[SYM_ROLES]
#define p_types symtab[SYM_TYPES]
#define p_users symtab[SYM_USERS]
#define p_bools symtab[SYM_BOOLS]
#define p_levels symtab[SYM_LEVELS]
#define p_cats symtab[SYM_CATS]
/* symbol names indexed by (value - 1) */
char **sym_val_to_name[SYM_NUM];
#define p_common_val_to_name sym_val_to_name[SYM_COMMONS]
#define p_class_val_to_name sym_val_to_name[SYM_CLASSES]
#define p_role_val_to_name sym_val_to_name[SYM_ROLES]
#define p_type_val_to_name sym_val_to_name[SYM_TYPES]
#define p_user_val_to_name sym_val_to_name[SYM_USERS]
#define p_bool_val_to_name sym_val_to_name[SYM_BOOLS]
#define p_sens_val_to_name sym_val_to_name[SYM_LEVELS]
#define p_cat_val_to_name sym_val_to_name[SYM_CATS]
/* class, role, and user attributes indexed by (value - 1) */
class_datum_t **class_val_to_struct;
role_datum_t **role_val_to_struct;
user_datum_t **user_val_to_struct;
type_datum_t **type_val_to_struct;
/* module stuff section -- used in parsing and for modules */
/* keep track of the scope for every identifier. these are
* hash tables, where the key is the identifier name and value
* a scope_datum_t. as a convenience, one may use the
* p_*_macros (cf. struct scope_index_t declaration). */
symtab_t scope[SYM_NUM];
/* module rule storage */
avrule_block_t *global;
/* avrule_decl index used for link/expand */
avrule_decl_t **decl_val_to_struct;
/* compiled storage of rules - use for the kernel policy */
/* type enforcement access vectors and transitions */
avtab_t te_avtab;
/* bools indexed by (value - 1) */
cond_bool_datum_t **bool_val_to_struct;
/* type enforcement conditional access vectors and transitions */
avtab_t te_cond_avtab;
/* linked list indexing te_cond_avtab by conditional */
cond_list_t *cond_list;
/* role transitions */
role_trans_t *role_tr;
/* role allows */
role_allow_t *role_allow;
/* security contexts of initial SIDs, unlabeled file systems,
TCP or UDP port numbers, network interfaces and nodes */
ocontext_t *ocontexts[OCON_NUM];
/* security contexts for files in filesystems that cannot support
a persistent label mapping or use another
fixed labeling behavior. */
genfs_t *genfs;
/* range transitions */
range_trans_t *range_tr;
ebitmap_t *type_attr_map;
ebitmap_t *attr_type_map; /* not saved in the binary policy */
ebitmap_t policycaps;
/* this bitmap is referenced by type NOT the typical type-1 used in other
bitmaps. Someday the 0 bit may be used for global permissive */
ebitmap_t permissive_map;
unsigned policyvers;
unsigned handle_unknown;
} policydb_t;
struct sepol_policydb {
struct policydb p;
};
extern int policydb_init(policydb_t * p);
extern int policydb_from_image(sepol_handle_t * handle,
void *data, size_t len, policydb_t * policydb);
extern int policydb_to_image(sepol_handle_t * handle,
policydb_t * policydb, void **newdata,
size_t * newlen);
extern int policydb_index_classes(policydb_t * p);
extern int policydb_index_bools(policydb_t * p);
extern int policydb_index_others(sepol_handle_t * handle, policydb_t * p,
unsigned int verbose);
extern int policydb_reindex_users(policydb_t * p);
extern void policydb_destroy(policydb_t * p);
extern int policydb_load_isids(policydb_t * p, sidtab_t * s);
/* Deprecated */
extern int policydb_context_isvalid(const policydb_t * p,
const context_struct_t * c);
extern void symtabs_destroy(symtab_t * symtab);
extern int scope_destroy(hashtab_key_t key, hashtab_datum_t datum, void *p);
typedef void (*hashtab_destroy_func_t) (hashtab_key_t k, hashtab_datum_t d,
void *args);
extern hashtab_destroy_func_t get_symtab_destroy_func(int sym_num);
extern void class_perm_node_init(class_perm_node_t * x);
extern void type_set_init(type_set_t * x);
extern void type_set_destroy(type_set_t * x);
extern int type_set_cpy(type_set_t * dst, type_set_t * src);
extern int type_set_or_eq(type_set_t * dst, type_set_t * other);
extern void role_set_init(role_set_t * x);
extern void role_set_destroy(role_set_t * x);
extern void avrule_init(avrule_t * x);
extern void avrule_destroy(avrule_t * x);
extern void avrule_list_destroy(avrule_t * x);
extern void role_trans_rule_init(role_trans_rule_t * x);
extern void role_trans_rule_list_destroy(role_trans_rule_t * x);
extern void role_datum_init(role_datum_t * x);
extern void role_datum_destroy(role_datum_t * x);
extern void role_allow_rule_init(role_allow_rule_t * x);
extern void role_allow_rule_destroy(role_allow_rule_t * x);
extern void role_allow_rule_list_destroy(role_allow_rule_t * x);
extern void range_trans_rule_init(range_trans_rule_t *x);
extern void range_trans_rule_destroy(range_trans_rule_t *x);
extern void range_trans_rule_list_destroy(range_trans_rule_t *x);
extern void type_datum_init(type_datum_t * x);
extern void type_datum_destroy(type_datum_t * x);
extern void user_datum_init(user_datum_t * x);
extern void user_datum_destroy(user_datum_t * x);
extern void level_datum_init(level_datum_t * x);
extern void level_datum_destroy(level_datum_t * x);
extern void cat_datum_init(cat_datum_t * x);
extern void cat_datum_destroy(cat_datum_t * x);
extern int check_assertions(sepol_handle_t * handle,
policydb_t * p, avrule_t * avrules);
extern int symtab_insert(policydb_t * x, uint32_t sym,
hashtab_key_t key, hashtab_datum_t datum,
uint32_t scope, uint32_t avrule_decl_id,
uint32_t * value);
/* A policy "file" may be a memory region referenced by a (data, len) pair
or a file referenced by a FILE pointer. */
typedef struct policy_file {
#define PF_USE_MEMORY 0
#define PF_USE_STDIO 1
#define PF_LEN 2 /* total up length in len field */
unsigned type;
char *data;
size_t len;
size_t size;
FILE *fp;
struct sepol_handle *handle;
} policy_file_t;
struct sepol_policy_file {
struct policy_file pf;
};
extern void policy_file_init(policy_file_t * x);
extern int policydb_read(policydb_t * p, struct policy_file *fp,
unsigned int verbose);
extern int avrule_read_list(policydb_t * p, avrule_t ** avrules,
struct policy_file *fp);
extern int policydb_write(struct policydb *p, struct policy_file *pf);
extern int policydb_set_target_platform(policydb_t *p, int platform);
#define PERM_SYMTAB_SIZE 32
/* Identify specific policy version changes */
#define POLICYDB_VERSION_BASE 15
#define POLICYDB_VERSION_BOOL 16
#define POLICYDB_VERSION_IPV6 17
#define POLICYDB_VERSION_NLCLASS 18
#define POLICYDB_VERSION_VALIDATETRANS 19
#define POLICYDB_VERSION_MLS 19
#define POLICYDB_VERSION_AVTAB 20
#define POLICYDB_VERSION_RANGETRANS 21
#define POLICYDB_VERSION_POLCAP 22
#define POLICYDB_VERSION_PERMISSIVE 23
#define POLICYDB_VERSION_BOUNDARY 24
/* Range of policy versions we understand*/
#define POLICYDB_VERSION_MIN POLICYDB_VERSION_BASE
#define POLICYDB_VERSION_MAX POLICYDB_VERSION_BOUNDARY
/* Module versions and specific changes*/
#define MOD_POLICYDB_VERSION_BASE 4
#define MOD_POLICYDB_VERSION_VALIDATETRANS 5
#define MOD_POLICYDB_VERSION_MLS 5
#define MOD_POLICYDB_VERSION_RANGETRANS 6
#define MOD_POLICYDB_VERSION_MLS_USERS 6
#define MOD_POLICYDB_VERSION_POLCAP 7
#define MOD_POLICYDB_VERSION_PERMISSIVE 8
#define MOD_POLICYDB_VERSION_BOUNDARY 9
#define MOD_POLICYDB_VERSION_BOUNDARY_ALIAS 10
#define MOD_POLICYDB_VERSION_MIN MOD_POLICYDB_VERSION_BASE
#define MOD_POLICYDB_VERSION_MAX MOD_POLICYDB_VERSION_BOUNDARY_ALIAS
#define POLICYDB_CONFIG_MLS 1
/* macros to check policy feature */
/* TODO: add other features here */
#define policydb_has_boundary_feature(p) \
(((p)->policy_type == POLICY_KERN \
&& p->policyvers >= POLICYDB_VERSION_BOUNDARY) || \
((p)->policy_type != POLICY_KERN \
&& p->policyvers >= MOD_POLICYDB_VERSION_BOUNDARY))
/* the config flags related to unknown classes/perms are bits 2 and 3 */
#define DENY_UNKNOWN SEPOL_DENY_UNKNOWN
#define REJECT_UNKNOWN SEPOL_REJECT_UNKNOWN
#define ALLOW_UNKNOWN SEPOL_ALLOW_UNKNOWN
#define POLICYDB_CONFIG_UNKNOWN_MASK (DENY_UNKNOWN | REJECT_UNKNOWN | ALLOW_UNKNOWN)
#define OBJECT_R "object_r"
#define OBJECT_R_VAL 1
#define POLICYDB_MAGIC SELINUX_MAGIC
#define POLICYDB_STRING "SE Linux"
#define POLICYDB_XEN_STRING "XenFlask"
#define POLICYDB_STRING_MAX_LENGTH 32
#define POLICYDB_MOD_MAGIC SELINUX_MOD_MAGIC
#define POLICYDB_MOD_STRING "SE Linux Module"
#define SEPOL_TARGET_SELINUX 0
#define SEPOL_TARGET_XEN 1
#endif /* _POLICYDB_H_ */
/* FLASK */