1 /* 2 * Labeling interface for userspace object managers and others. 3 * 4 * Author : Eamon Walsh <ewalsh@tycho.nsa.gov> 5 */ 6 #ifndef _SELABEL_H_ 7 #define _SELABEL_H_ 8 9 #include <stdbool.h> 10 #include <sys/types.h> 11 #include <selinux/selinux.h> 12 13 #ifdef __cplusplus 14 extern "C" { 15 #endif 16 17 /* 18 * Opaque type used for all label handles. 19 */ 20 21 struct selabel_handle; 22 23 /* 24 * Available backends. 25 */ 26 27 /* file contexts */ 28 #define SELABEL_CTX_FILE 0 29 /* media contexts */ 30 #define SELABEL_CTX_MEDIA 1 31 /* x contexts */ 32 #define SELABEL_CTX_X 2 33 /* db objects */ 34 #define SELABEL_CTX_DB 3 35 /* Android property service contexts */ 36 #define SELABEL_CTX_ANDROID_PROP 4 37 /* Android service contexts */ 38 #define SELABEL_CTX_ANDROID_SERVICE 5 39 40 /* 41 * Available options 42 */ 43 44 /* no-op option, useful for unused slots in an array of options */ 45 #define SELABEL_OPT_UNUSED 0 46 /* validate contexts before returning them (boolean value) */ 47 #define SELABEL_OPT_VALIDATE 1 48 /* don't use local customizations to backend data (boolean value) */ 49 #define SELABEL_OPT_BASEONLY 2 50 /* specify an alternate path to use when loading backend data */ 51 #define SELABEL_OPT_PATH 3 52 /* select a subset of the search space as an optimization (file backend) */ 53 #define SELABEL_OPT_SUBSET 4 54 /* require a hash calculation on spec files */ 55 #define SELABEL_OPT_DIGEST 5 56 /* total number of options */ 57 #define SELABEL_NOPT 6 58 59 /* 60 * Label operations 61 */ 62 63 /** 64 * selabel_open - Create a labeling handle. 65 * @backend: one of the constants specifying a supported labeling backend. 66 * @opts: array of selabel_opt structures specifying label options or NULL. 67 * @nopts: number of elements in opts array or zero for no options. 68 * 69 * Open a labeling backend for use. The available backend identifiers are 70 * listed above. Options may be provided via the opts parameter; available 71 * options are listed above. Not all options may be supported by every 72 * backend. Return value is the created handle on success or NULL with 73 * @errno set on failure. 74 */ 75 struct selabel_handle *selabel_open(unsigned int backend, 76 const struct selinux_opt *opts, 77 unsigned nopts); 78 79 /** 80 * selabel_close - Close a labeling handle. 81 * @handle: specifies handle to close 82 * 83 * Destroy the specified handle, closing files, freeing allocated memory, 84 * etc. The handle may not be further used after it has been closed. 85 */ 86 void selabel_close(struct selabel_handle *handle); 87 88 /** 89 * selabel_lookup - Perform labeling lookup operation. 90 * @handle: specifies backend instance to query 91 * @con: returns the appropriate context with which to label the object 92 * @key: string input to lookup operation 93 * @type: numeric input to the lookup operation 94 * 95 * Perform a labeling lookup operation. Return %0 on success, -%1 with 96 * @errno set on failure. The key and type arguments are the inputs to the 97 * lookup operation; appropriate values are dictated by the backend in use. 98 * The result is returned in the memory pointed to by @con and must be freed 99 * by the user with freecon(). 100 */ 101 int selabel_lookup(struct selabel_handle *handle, char **con, 102 const char *key, int type); 103 int selabel_lookup_raw(struct selabel_handle *handle, char **con, 104 const char *key, int type); 105 106 bool selabel_partial_match(struct selabel_handle *handle, const char *key); 107 108 int selabel_lookup_best_match(struct selabel_handle *rec, char **con, 109 const char *key, const char **aliases, int type); 110 int selabel_lookup_best_match_raw(struct selabel_handle *rec, char **con, 111 const char *key, const char **aliases, int type); 112 113 /** 114 * selabel_digest - Retrieve the SHA1 digest and the list of specfiles used to 115 * generate the digest. The SELABEL_OPT_DIGEST option must 116 * be set in selabel_open() to initiate the digest generation. 117 * @handle: specifies backend instance to query 118 * @digest: returns a pointer to the SHA1 digest. 119 * @digest_len: returns length of digest in bytes. 120 * @specfiles: a list of specfiles used in the SHA1 digest generation. 121 * The list is NULL terminated and will hold @num_specfiles entries. 122 * @num_specfiles: number of specfiles in the list. 123 * 124 * Return %0 on success, -%1 with @errno set on failure. 125 */ 126 int selabel_digest(struct selabel_handle *rec, 127 unsigned char **digest, size_t *digest_len, 128 char ***specfiles, size_t *num_specfiles); 129 130 enum selabel_cmp_result { 131 SELABEL_SUBSET, 132 SELABEL_EQUAL, 133 SELABEL_SUPERSET, 134 SELABEL_INCOMPARABLE 135 }; 136 137 /** 138 * selabel_cmp - Compare two label configurations. 139 * @h1: handle for the first label configuration 140 * @h2: handle for the first label configuration 141 * 142 * Compare two label configurations. 143 * Return %SELABEL_SUBSET if @h1 is a subset of @h2, %SELABEL_EQUAL 144 * if @h1 is identical to @h2, %SELABEL_SUPERSET if @h1 is a superset 145 * of @h2, and %SELABEL_INCOMPARABLE if @h1 and @h2 are incomparable. 146 */ 147 enum selabel_cmp_result selabel_cmp(struct selabel_handle *h1, 148 struct selabel_handle *h2); 149 150 /** 151 * selabel_stats - log labeling operation statistics. 152 * @handle: specifies backend instance to query 153 * 154 * Log a message with information about the number of queries performed, 155 * number of unused matching entries, or other operational statistics. 156 * Message is backend-specific, some backends may not output a message. 157 */ 158 void selabel_stats(struct selabel_handle *handle); 159 160 /* 161 * Type codes used by specific backends 162 */ 163 164 /* X backend */ 165 #define SELABEL_X_PROP 1 166 #define SELABEL_X_EXT 2 167 #define SELABEL_X_CLIENT 3 168 #define SELABEL_X_EVENT 4 169 #define SELABEL_X_SELN 5 170 #define SELABEL_X_POLYPROP 6 171 #define SELABEL_X_POLYSELN 7 172 173 /* DB backend */ 174 #define SELABEL_DB_DATABASE 1 175 #define SELABEL_DB_SCHEMA 2 176 #define SELABEL_DB_TABLE 3 177 #define SELABEL_DB_COLUMN 4 178 #define SELABEL_DB_SEQUENCE 5 179 #define SELABEL_DB_VIEW 6 180 #define SELABEL_DB_PROCEDURE 7 181 #define SELABEL_DB_BLOB 8 182 #define SELABEL_DB_TUPLE 9 183 #define SELABEL_DB_LANGUAGE 10 184 #define SELABEL_DB_EXCEPTION 11 185 #define SELABEL_DB_DATATYPE 12 186 187 #ifdef __cplusplus 188 } 189 #endif 190 #endif /* _SELABEL_H_ */ 191