1 2 /* -*- linux-c -*- */ 3 4 /* 5 * Author : Stephen Smalley, <sds@tycho.nsa.gov> 6 */ 7 8 #ifndef _SEPOL_POLICYDB_SERVICES_H_ 9 #define _SEPOL_POLICYDB_SERVICES_H_ 10 11 /* 12 * Security server interface. 13 */ 14 15 #include <sepol/policydb/flask_types.h> 16 #include <sepol/policydb/policydb.h> 17 #include <stddef.h> 18 19 #ifdef __cplusplus 20 extern "C" { 21 #endif 22 23 /* Set the policydb and sidtab structures to be used by 24 the service functions. If not set, then these default 25 to private structures within libsepol that can only be 26 initialized and accessed via the service functions themselves. 27 Setting the structures explicitly allows a program to directly 28 manipulate them, e.g. checkpolicy populates the structures directly 29 from a source policy rather than from a binary policy. */ 30 extern int sepol_set_policydb(policydb_t * p); 31 extern int sepol_set_sidtab(sidtab_t * s); 32 33 /* Load the security policy. This initializes the policydb 34 and sidtab based on the provided binary policy. */ 35 extern int sepol_load_policy(void *data, size_t len); 36 37 /* 38 * Compute access vectors based on a SID pair for 39 * the permissions in a particular class. 40 */ 41 extern int sepol_compute_av(sepol_security_id_t ssid, /* IN */ 42 sepol_security_id_t tsid, /* IN */ 43 sepol_security_class_t tclass, /* IN */ 44 sepol_access_vector_t requested, /* IN */ 45 struct sepol_av_decision *avd); /* OUT */ 46 47 /* Same as above, but also return the reason(s) for any 48 denials of the requested permissions. */ 49 #define SEPOL_COMPUTEAV_TE 0x1U 50 #define SEPOL_COMPUTEAV_CONS 0x2U 51 #define SEPOL_COMPUTEAV_RBAC 0x4U 52 #define SEPOL_COMPUTEAV_BOUNDS 0x8U 53 extern int sepol_compute_av_reason(sepol_security_id_t ssid, 54 sepol_security_id_t tsid, 55 sepol_security_class_t tclass, 56 sepol_access_vector_t requested, 57 struct sepol_av_decision *avd, 58 unsigned int *reason); 59 60 /* 61 * Same as above, but also returns the constraint expression calculations 62 * whether allowed or denied in a buffer. This buffer is allocated by 63 * this call and must be free'd by the caller using free(3). The constraint 64 * buffer will contain any constraints in infix notation. 65 * If the SHOW_GRANTED flag is set it will show granted and denied 66 * constraints. The default is to show only denied constraints. 67 */ 68 #define SHOW_GRANTED 1 69 extern int sepol_compute_av_reason_buffer(sepol_security_id_t ssid, 70 sepol_security_id_t tsid, 71 sepol_security_class_t tclass, 72 sepol_access_vector_t requested, 73 struct sepol_av_decision *avd, 74 unsigned int *reason, 75 char **reason_buf, 76 unsigned int flags); 77 78 /* 79 * Returns the mls/validatetrans constraint expression calculations in 80 * a buffer that must be free'd by the caller using free(3). 81 * If the SHOW_GRANTED flag is set it will show granted and denied 82 * mls/validatetrans (the default is to show only those denied). 83 */ 84 extern int sepol_validate_transition_reason_buffer(sepol_security_id_t oldsid, 85 sepol_security_id_t newsid, 86 sepol_security_id_t tasksid, 87 sepol_security_class_t tclass, 88 char **reason_buf, 89 unsigned int flags); 90 91 /* 92 * Return a class ID associated with the class string representation 93 * specified by `class_name'. 94 */ 95 extern int sepol_string_to_security_class(const char *class_name, 96 sepol_security_class_t *tclass); 97 98 /* 99 * Return a permission av bit associated with tclass and the string 100 * representation of the `perm_name'. 101 */ 102 extern int sepol_string_to_av_perm(sepol_security_class_t tclass, 103 const char *perm_name, 104 sepol_access_vector_t *av); 105 106 /* 107 * Compute a SID to use for labeling a new object in the 108 * class `tclass' based on a SID pair. 109 */ 110 extern int sepol_transition_sid(sepol_security_id_t ssid, /* IN */ 111 sepol_security_id_t tsid, /* IN */ 112 sepol_security_class_t tclass, /* IN */ 113 sepol_security_id_t * out_sid); /* OUT */ 114 115 /* 116 * Compute a SID to use when selecting a member of a 117 * polyinstantiated object of class `tclass' based on 118 * a SID pair. 119 */ 120 extern int sepol_member_sid(sepol_security_id_t ssid, /* IN */ 121 sepol_security_id_t tsid, /* IN */ 122 sepol_security_class_t tclass, /* IN */ 123 sepol_security_id_t * out_sid); /* OUT */ 124 125 /* 126 * Compute a SID to use for relabeling an object in the 127 * class `tclass' based on a SID pair. 128 */ 129 extern int sepol_change_sid(sepol_security_id_t ssid, /* IN */ 130 sepol_security_id_t tsid, /* IN */ 131 sepol_security_class_t tclass, /* IN */ 132 sepol_security_id_t * out_sid); /* OUT */ 133 134 /* 135 * Write the security context string representation of 136 * the context associated with `sid' into a dynamically 137 * allocated string of the correct size. Set `*scontext' 138 * to point to this string and set `*scontext_len' to 139 * the length of the string. 140 */ 141 extern int sepol_sid_to_context(sepol_security_id_t sid, /* IN */ 142 sepol_security_context_t * scontext, /* OUT */ 143 size_t * scontext_len); /* OUT */ 144 145 /* 146 * Return a SID associated with the security context that 147 * has the string representation specified by `scontext'. 148 */ 149 extern int sepol_context_to_sid(const sepol_security_context_t scontext, /* IN */ 150 size_t scontext_len, /* IN */ 151 sepol_security_id_t * out_sid); /* OUT */ 152 153 /* 154 * Generate the set of SIDs for legal security contexts 155 * for a given user that can be reached by `fromsid'. 156 * Set `*sids' to point to a dynamically allocated 157 * array containing the set of SIDs. Set `*nel' to the 158 * number of elements in the array. 159 */ 160 extern int sepol_get_user_sids(sepol_security_id_t callsid, 161 char *username, 162 sepol_security_id_t ** sids, uint32_t * nel); 163 164 /* 165 * Return the SIDs to use for an unlabeled file system 166 * that is being mounted from the device with the 167 * the kdevname `name'. The `fs_sid' SID is returned for 168 * the file system and the `file_sid' SID is returned 169 * for all files within that file system. 170 */ 171 extern int sepol_fs_sid(char *dev, /* IN */ 172 sepol_security_id_t * fs_sid, /* OUT */ 173 sepol_security_id_t * file_sid); /* OUT */ 174 175 /* 176 * Return the SID of the port specified by 177 * `domain', `type', `protocol', and `port'. 178 */ 179 extern int sepol_port_sid(uint16_t domain, 180 uint16_t type, 181 uint8_t protocol, 182 uint16_t port, sepol_security_id_t * out_sid); 183 184 /* 185 * Return the SID of the ibpkey specified by 186 * `subnet prefix', and `pkey'. 187 */ 188 extern int sepol_ibpkey_sid(uint64_t subnet_prefix_p, 189 uint16_t pkey, 190 sepol_security_id_t *out_sid); 191 192 /* 193 * Return the SID of the ibendport specified by 194 * `dev_name', and `port'. 195 */ 196 extern int sepol_ibendport_sid(char *dev_name, 197 uint8_t port, 198 sepol_security_id_t *out_sid); 199 200 /* 201 * Return the SIDs to use for a network interface 202 * with the name `name'. The `if_sid' SID is returned for 203 * the interface and the `msg_sid' SID is returned as 204 * the default SID for messages received on the 205 * interface. 206 */ 207 extern int sepol_netif_sid(char *name, 208 sepol_security_id_t * if_sid, 209 sepol_security_id_t * msg_sid); 210 211 /* 212 * Return the SID of the node specified by the address 213 * `addr' where `addrlen' is the length of the address 214 * in bytes and `domain' is the communications domain or 215 * address family in which the address should be interpreted. 216 */ 217 extern int sepol_node_sid(uint16_t domain, 218 void *addr, 219 size_t addrlen, sepol_security_id_t * out_sid); 220 221 /* 222 * Return a value indicating how to handle labeling for the 223 * the specified filesystem type, and optionally return a SID 224 * for the filesystem object. 225 */ 226 #define SECURITY_FS_USE_XATTR 1 /* use xattr */ 227 #define SECURITY_FS_USE_TRANS 2 /* use transition SIDs, e.g. devpts/tmpfs */ 228 #define SECURITY_FS_USE_TASK 3 /* use task SIDs, e.g. pipefs/sockfs */ 229 #define SECURITY_FS_USE_GENFS 4 /* use the genfs support */ 230 #define SECURITY_FS_USE_NONE 5 /* no labeling support */ 231 extern int sepol_fs_use(const char *fstype, /* IN */ 232 unsigned int *behavior, /* OUT */ 233 sepol_security_id_t * sid); /* OUT */ 234 235 /* 236 * Return the SID to use for a file in a filesystem 237 * that cannot support a persistent label mapping or use another 238 * fixed labeling behavior like transition SIDs or task SIDs. 239 */ 240 extern int sepol_genfs_sid(const char *fstype, /* IN */ 241 const char *name, /* IN */ 242 sepol_security_class_t sclass, /* IN */ 243 sepol_security_id_t * sid); /* OUT */ 244 245 #ifdef __cplusplus 246 } 247 #endif 248 249 #endif 250