• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright 2011 Tresys Technology, LLC. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions are met:
6  *
7  *    1. Redistributions of source code must retain the above copyright notice,
8  *       this list of conditions and the following disclaimer.
9  *
10  *    2. Redistributions in binary form must reproduce the above copyright notice,
11  *       this list of conditions and the following disclaimer in the documentation
12  *       and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY TRESYS TECHNOLOGY, LLC ``AS IS'' AND ANY EXPRESS
15  * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
16  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
17  * EVENT SHALL TRESYS TECHNOLOGY, LLC OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
18  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
19  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
21  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
22  * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
23  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  *
25  * The views and conclusions contained in the software and documentation are those
26  * of the authors and should not be interpreted as representing official policies,
27  * either expressed or implied, of Tresys Technology, LLC.
28  */
29 
30 #ifndef CIL_INTERNAL_H_
31 #define CIL_INTERNAL_H_
32 
33 #include <stdlib.h>
34 #include <stdio.h>
35 #include <stdint.h>
36 #include <arpa/inet.h>
37 
38 #include <sepol/policydb/services.h>
39 #include <sepol/policydb/policydb.h>
40 #include <sepol/policydb/flask_types.h>
41 
42 #include <cil/cil.h>
43 
44 #include "cil_flavor.h"
45 #include "cil_tree.h"
46 #include "cil_symtab.h"
47 #include "cil_mem.h"
48 
49 #define CIL_MAX_NAME_LENGTH 2048
50 
51 
52 enum cil_pass {
53 	CIL_PASS_INIT = 0,
54 
55 	CIL_PASS_TIF,
56 	CIL_PASS_IN,
57 	CIL_PASS_BLKIN_LINK,
58 	CIL_PASS_BLKIN_COPY,
59 	CIL_PASS_BLKABS,
60 	CIL_PASS_MACRO,
61 	CIL_PASS_CALL1,
62 	CIL_PASS_CALL2,
63 	CIL_PASS_ALIAS1,
64 	CIL_PASS_ALIAS2,
65 	CIL_PASS_MISC1,
66 	CIL_PASS_MLS,
67 	CIL_PASS_MISC2,
68 	CIL_PASS_MISC3,
69 
70 	CIL_PASS_NUM
71 };
72 
73 
74 /*
75 	Keywords
76 */
77 char *CIL_KEY_CONS_T1;
78 char *CIL_KEY_CONS_T2;
79 char *CIL_KEY_CONS_T3;
80 char *CIL_KEY_CONS_R1;
81 char *CIL_KEY_CONS_R2;
82 char *CIL_KEY_CONS_R3;
83 char *CIL_KEY_CONS_U1;
84 char *CIL_KEY_CONS_U2;
85 char *CIL_KEY_CONS_U3;
86 char *CIL_KEY_CONS_L1;
87 char *CIL_KEY_CONS_L2;
88 char *CIL_KEY_CONS_H1;
89 char *CIL_KEY_CONS_H2;
90 char *CIL_KEY_AND;
91 char *CIL_KEY_OR;
92 char *CIL_KEY_NOT;
93 char *CIL_KEY_EQ;
94 char *CIL_KEY_NEQ;
95 char *CIL_KEY_CONS_DOM;
96 char *CIL_KEY_CONS_DOMBY;
97 char *CIL_KEY_CONS_INCOMP;
98 char *CIL_KEY_CONDTRUE;
99 char *CIL_KEY_CONDFALSE;
100 char *CIL_KEY_SELF;
101 char *CIL_KEY_OBJECT_R;
102 char *CIL_KEY_STAR;
103 char *CIL_KEY_TCP;
104 char *CIL_KEY_UDP;
105 char *CIL_KEY_DCCP;
106 char *CIL_KEY_AUDITALLOW;
107 char *CIL_KEY_TUNABLEIF;
108 char *CIL_KEY_ALLOW;
109 char *CIL_KEY_DONTAUDIT;
110 char *CIL_KEY_TYPETRANSITION;
111 char *CIL_KEY_TYPECHANGE;
112 char *CIL_KEY_CALL;
113 char *CIL_KEY_TUNABLE;
114 char *CIL_KEY_XOR;
115 char *CIL_KEY_ALL;
116 char *CIL_KEY_RANGE;
117 char *CIL_KEY_GLOB;
118 char *CIL_KEY_FILE;
119 char *CIL_KEY_DIR;
120 char *CIL_KEY_CHAR;
121 char *CIL_KEY_BLOCK;
122 char *CIL_KEY_SOCKET;
123 char *CIL_KEY_PIPE;
124 char *CIL_KEY_SYMLINK;
125 char *CIL_KEY_ANY;
126 char *CIL_KEY_XATTR;
127 char *CIL_KEY_TASK;
128 char *CIL_KEY_TRANS;
129 char *CIL_KEY_TYPE;
130 char *CIL_KEY_ROLE;
131 char *CIL_KEY_USER;
132 char *CIL_KEY_USERATTRIBUTE;
133 char *CIL_KEY_USERATTRIBUTESET;
134 char *CIL_KEY_SENSITIVITY;
135 char *CIL_KEY_CATEGORY;
136 char *CIL_KEY_CATSET;
137 char *CIL_KEY_LEVEL;
138 char *CIL_KEY_LEVELRANGE;
139 char *CIL_KEY_CLASS;
140 char *CIL_KEY_IPADDR;
141 char *CIL_KEY_MAP_CLASS;
142 char *CIL_KEY_CLASSPERMISSION;
143 char *CIL_KEY_BOOL;
144 char *CIL_KEY_STRING;
145 char *CIL_KEY_NAME;
146 char *CIL_KEY_SOURCE;
147 char *CIL_KEY_TARGET;
148 char *CIL_KEY_LOW;
149 char *CIL_KEY_HIGH;
150 char *CIL_KEY_LOW_HIGH;
151 char *CIL_KEY_HANDLEUNKNOWN;
152 char *CIL_KEY_HANDLEUNKNOWN_ALLOW;
153 char *CIL_KEY_HANDLEUNKNOWN_DENY;
154 char *CIL_KEY_HANDLEUNKNOWN_REJECT;
155 char *CIL_KEY_MACRO;
156 char *CIL_KEY_IN;
157 char *CIL_KEY_MLS;
158 char *CIL_KEY_DEFAULTRANGE;
159 char *CIL_KEY_BLOCKINHERIT;
160 char *CIL_KEY_BLOCKABSTRACT;
161 char *CIL_KEY_CLASSORDER;
162 char *CIL_KEY_CLASSMAPPING;
163 char *CIL_KEY_CLASSPERMISSIONSET;
164 char *CIL_KEY_COMMON;
165 char *CIL_KEY_CLASSCOMMON;
166 char *CIL_KEY_SID;
167 char *CIL_KEY_SIDCONTEXT;
168 char *CIL_KEY_SIDORDER;
169 char *CIL_KEY_USERLEVEL;
170 char *CIL_KEY_USERRANGE;
171 char *CIL_KEY_USERBOUNDS;
172 char *CIL_KEY_USERPREFIX;
173 char *CIL_KEY_SELINUXUSER;
174 char *CIL_KEY_SELINUXUSERDEFAULT;
175 char *CIL_KEY_TYPEATTRIBUTE;
176 char *CIL_KEY_TYPEATTRIBUTESET;
177 char *CIL_KEY_EXPANDTYPEATTRIBUTE;
178 char *CIL_KEY_TYPEALIAS;
179 char *CIL_KEY_TYPEALIASACTUAL;
180 char *CIL_KEY_TYPEBOUNDS;
181 char *CIL_KEY_TYPEPERMISSIVE;
182 char *CIL_KEY_RANGETRANSITION;
183 char *CIL_KEY_USERROLE;
184 char *CIL_KEY_ROLETYPE;
185 char *CIL_KEY_ROLETRANSITION;
186 char *CIL_KEY_ROLEALLOW;
187 char *CIL_KEY_ROLEATTRIBUTE;
188 char *CIL_KEY_ROLEATTRIBUTESET;
189 char *CIL_KEY_ROLEBOUNDS;
190 char *CIL_KEY_BOOLEANIF;
191 char *CIL_KEY_NEVERALLOW;
192 char *CIL_KEY_TYPEMEMBER;
193 char *CIL_KEY_SENSALIAS;
194 char *CIL_KEY_SENSALIASACTUAL;
195 char *CIL_KEY_CATALIAS;
196 char *CIL_KEY_CATALIASACTUAL;
197 char *CIL_KEY_CATORDER;
198 char *CIL_KEY_SENSITIVITYORDER;
199 char *CIL_KEY_SENSCAT;
200 char *CIL_KEY_CONSTRAIN;
201 char *CIL_KEY_MLSCONSTRAIN;
202 char *CIL_KEY_VALIDATETRANS;
203 char *CIL_KEY_MLSVALIDATETRANS;
204 char *CIL_KEY_CONTEXT;
205 char *CIL_KEY_FILECON;
206 char *CIL_KEY_IBPKEYCON;
207 char *CIL_KEY_IBENDPORTCON;
208 char *CIL_KEY_PORTCON;
209 char *CIL_KEY_NODECON;
210 char *CIL_KEY_GENFSCON;
211 char *CIL_KEY_NETIFCON;
212 char *CIL_KEY_PIRQCON;
213 char *CIL_KEY_IOMEMCON;
214 char *CIL_KEY_IOPORTCON;
215 char *CIL_KEY_PCIDEVICECON;
216 char *CIL_KEY_DEVICETREECON;
217 char *CIL_KEY_FSUSE;
218 char *CIL_KEY_POLICYCAP;
219 char *CIL_KEY_OPTIONAL;
220 char *CIL_KEY_DEFAULTUSER;
221 char *CIL_KEY_DEFAULTROLE;
222 char *CIL_KEY_DEFAULTTYPE;
223 char *CIL_KEY_ROOT;
224 char *CIL_KEY_NODE;
225 char *CIL_KEY_PERM;
226 char *CIL_KEY_ALLOWX;
227 char *CIL_KEY_AUDITALLOWX;
228 char *CIL_KEY_DONTAUDITX;
229 char *CIL_KEY_NEVERALLOWX;
230 char *CIL_KEY_PERMISSIONX;
231 char *CIL_KEY_IOCTL;
232 char *CIL_KEY_UNORDERED;
233 char *CIL_KEY_SRC_INFO;
234 char *CIL_KEY_SRC_CIL;
235 char *CIL_KEY_SRC_HLL;
236 
237 /*
238 	Symbol Table Array Indices
239 */
240 enum cil_sym_index {
241 	CIL_SYM_BLOCKS = 0,
242 	CIL_SYM_USERS,
243 	CIL_SYM_ROLES,
244 	CIL_SYM_TYPES,
245 	CIL_SYM_COMMONS,
246 	CIL_SYM_CLASSES,
247 	CIL_SYM_CLASSPERMSETS,
248 	CIL_SYM_BOOLS,
249 	CIL_SYM_TUNABLES,
250 	CIL_SYM_SENS,
251 	CIL_SYM_CATS,
252 	CIL_SYM_SIDS,
253 	CIL_SYM_CONTEXTS,
254 	CIL_SYM_LEVELS,
255 	CIL_SYM_LEVELRANGES,
256 	CIL_SYM_POLICYCAPS,
257 	CIL_SYM_IPADDRS,
258 	CIL_SYM_NAMES,
259 	CIL_SYM_PERMX,
260 	CIL_SYM_NUM,
261 	CIL_SYM_UNKNOWN,
262 	CIL_SYM_PERMS	// Special case for permissions. This symtab is not included in arrays
263 };
264 
265 enum cil_sym_array {
266 	CIL_SYM_ARRAY_ROOT = 0,
267 	CIL_SYM_ARRAY_BLOCK,
268 	CIL_SYM_ARRAY_IN,
269 	CIL_SYM_ARRAY_MACRO,
270 	CIL_SYM_ARRAY_CONDBLOCK,
271 	CIL_SYM_ARRAY_NUM
272 };
273 
274 extern int cil_sym_sizes[CIL_SYM_ARRAY_NUM][CIL_SYM_NUM];
275 
276 #define CIL_CLASS_SYM_SIZE	256
277 #define CIL_PERMS_PER_CLASS (sizeof(sepol_access_vector_t) * 8)
278 
279 struct cil_db {
280 	struct cil_tree *parse;
281 	struct cil_tree *ast;
282 	struct cil_type *selftype;
283 	struct cil_list *sidorder;
284 	struct cil_list *classorder;
285 	struct cil_list *catorder;
286 	struct cil_list *sensitivityorder;
287 	struct cil_sort *netifcon;
288 	struct cil_sort *genfscon;
289 	struct cil_sort *filecon;
290 	struct cil_sort *nodecon;
291 	struct cil_sort *ibpkeycon;
292 	struct cil_sort *ibendportcon;
293 	struct cil_sort *portcon;
294 	struct cil_sort *pirqcon;
295 	struct cil_sort *iomemcon;
296 	struct cil_sort *ioportcon;
297 	struct cil_sort *pcidevicecon;
298 	struct cil_sort *devicetreecon;
299 	struct cil_sort *fsuse;
300 	struct cil_list *userprefixes;
301 	struct cil_list *selinuxusers;
302 	struct cil_list *names;
303 	int num_types_and_attrs;
304 	int num_classes;
305 	int num_cats;
306 	int num_types;
307 	int num_roles;
308 	int num_users;
309 	struct cil_type **val_to_type;
310 	struct cil_role **val_to_role;
311 	struct cil_user **val_to_user;
312 	int disable_dontaudit;
313 	int disable_neverallow;
314 	int attrs_expand_generated;
315 	unsigned attrs_expand_size;
316 	int preserve_tunables;
317 	int handle_unknown;
318 	int mls;
319 	int multiple_decls;
320 	int target_platform;
321 	int policy_version;
322 };
323 
324 struct cil_root {
325 	symtab_t symtab[CIL_SYM_NUM];
326 };
327 
328 struct cil_sort {
329 	enum cil_flavor flavor;
330 	uint32_t count;
331 	uint32_t index;
332 	void **array;
333 };
334 
335 struct cil_block {
336 	struct cil_symtab_datum datum;
337 	symtab_t symtab[CIL_SYM_NUM];
338 	uint16_t is_abstract;
339 	struct cil_list *bi_nodes;
340 };
341 
342 struct cil_blockinherit {
343 	char *block_str;
344 	struct cil_block *block;
345 };
346 
347 struct cil_blockabstract {
348 	char *block_str;
349 };
350 
351 struct cil_in {
352 	symtab_t symtab[CIL_SYM_NUM];
353 	char *block_str;
354 };
355 
356 struct cil_optional {
357 	struct cil_symtab_datum datum;
358 	int enabled;
359 };
360 
361 struct cil_perm {
362 	struct cil_symtab_datum datum;
363 	unsigned int value;
364 	struct cil_list *classperms; /* Only used for map perms */
365 };
366 
367 struct cil_class {
368 	struct cil_symtab_datum datum;
369 	symtab_t perms;
370 	unsigned int num_perms;
371 	struct cil_class *common; /* Only used for kernel class */
372 	uint32_t ordered; /* Only used for kernel class */
373 };
374 
375 struct cil_classorder {
376 	struct cil_list *class_list_str;
377 };
378 
379 struct cil_classperms_set {
380 	char *set_str;
381 	struct cil_classpermission *set;
382 };
383 
384 struct cil_classperms {
385 	char *class_str;
386 	struct cil_class *class;
387 	struct cil_list *perm_strs;
388 	struct cil_list *perms;
389 };
390 
391 struct cil_classpermission {
392 	struct cil_symtab_datum datum;
393 	struct cil_list *classperms;
394 };
395 
396 struct cil_classpermissionset {
397 	char *set_str;
398 	struct cil_list *classperms;
399 };
400 
401 struct cil_classmapping {
402 	char *map_class_str;
403 	char *map_perm_str;
404 	struct cil_list *classperms;
405 };
406 
407 struct cil_classcommon {
408 	char *class_str;
409 	char *common_str;
410 };
411 
412 struct cil_alias {
413 	struct cil_symtab_datum datum;
414 	void *actual;
415 };
416 
417 struct cil_aliasactual {
418 	char *alias_str;
419 	char *actual_str;
420 };
421 
422 struct cil_sid {
423 	struct cil_symtab_datum datum;
424 	struct cil_context *context;
425 	uint32_t ordered;
426 };
427 
428 struct cil_sidcontext {
429 	char *sid_str;
430 	char *context_str;
431 	struct cil_context *context;
432 };
433 
434 struct cil_sidorder {
435 	struct cil_list *sid_list_str;
436 };
437 
438 struct cil_user {
439 	struct cil_symtab_datum datum;
440 	struct cil_user *bounds;
441 	ebitmap_t *roles;
442 	struct cil_level *dftlevel;
443 	struct cil_levelrange *range;
444 	int value;
445 };
446 
447 struct cil_userattribute {
448 	struct cil_symtab_datum datum;
449 	struct cil_list *expr_list;
450 	ebitmap_t *users;
451 };
452 
453 struct cil_userattributeset {
454 	char *attr_str;
455 	struct cil_list *str_expr;
456 	struct cil_list *datum_expr;
457 };
458 
459 struct cil_userrole {
460 	char *user_str;
461 	void *user;
462 	char *role_str;
463 	void *role;
464 };
465 
466 struct cil_userlevel {
467 	char *user_str;
468 	char *level_str;
469 	struct cil_level *level;
470 };
471 
472 struct cil_userrange {
473 	char *user_str;
474 	char *range_str;
475 	struct cil_levelrange *range;
476 };
477 
478 struct cil_userprefix {
479 	char *user_str;
480 	struct cil_user *user;
481 	char *prefix_str;
482 };
483 
484 struct cil_selinuxuser {
485 	char *name_str;
486 	char *user_str;
487 	struct cil_user *user;
488 	char *range_str;
489 	struct cil_levelrange *range;
490 };
491 
492 struct cil_role {
493 	struct cil_symtab_datum datum;
494 	struct cil_role *bounds;
495 	ebitmap_t *types;
496 	int value;
497 };
498 
499 struct cil_roleattribute {
500 	struct cil_symtab_datum datum;
501 	struct cil_list *expr_list;
502 	ebitmap_t *roles;
503 };
504 
505 struct cil_roleattributeset {
506 	char *attr_str;
507 	struct cil_list *str_expr;
508 	struct cil_list *datum_expr;
509 };
510 
511 struct cil_roletype {
512 	char *role_str;
513 	void *role; /* role or attribute */
514 	char *type_str;
515 	void *type; /* type, alias, or attribute */
516 };
517 
518 struct cil_type	{
519 	struct cil_symtab_datum datum;
520 	struct cil_type *bounds;
521 	int value;
522 };
523 
524 #define CIL_ATTR_AVRULE		(1 << 0)
525 #define CIL_ATTR_NEVERALLOW	(1 << 1)
526 #define CIL_ATTR_CONSTRAINT	(1 << 2)
527 #define CIL_ATTR_EXPAND_TRUE	(1 << 3)
528 #define CIL_ATTR_EXPAND_FALSE	(1 << 4)
529 struct cil_typeattribute {
530 	struct cil_symtab_datum datum;
531 	struct cil_list *expr_list;
532 	ebitmap_t *types;
533 	int used;	// whether or not this attribute was used in a binary policy rule
534 	int keep;
535 };
536 
537 struct cil_typeattributeset {
538 	char *attr_str;
539 	struct cil_list *str_expr;
540 	struct cil_list *datum_expr;
541 };
542 
543 struct cil_expandtypeattribute {
544 	struct cil_list *attr_strs;
545 	struct cil_list *attr_datums;
546 	int expand;
547 };
548 
549 struct cil_typepermissive {
550 	char *type_str;
551 	void *type; /* type or alias */
552 };
553 
554 struct cil_name {
555 	struct cil_symtab_datum datum;
556 	char *name_str;
557 };
558 
559 struct cil_nametypetransition {
560 	char *src_str;
561 	void *src; /* type, alias, or attribute */
562 	char *tgt_str;
563 	void *tgt; /* type, alias, or attribute */
564 	char *obj_str;
565 	struct cil_class *obj;
566 	char *name_str;
567 	struct cil_name *name;
568 	char *result_str;
569 	void *result; /* type or alias */
570 
571 };
572 
573 struct cil_rangetransition {
574 	char *src_str;
575 	void *src; /* type, alias, or attribute */
576 	char *exec_str;
577 	void *exec; /* type, alias, or attribute */
578 	char *obj_str;
579 	struct cil_class *obj;
580 	char *range_str;
581 	struct cil_levelrange *range;
582 };
583 
584 struct cil_bool {
585 	struct cil_symtab_datum datum;
586 	uint16_t value;
587 };
588 
589 struct cil_tunable {
590 	struct cil_symtab_datum datum;
591 	uint16_t value;
592 };
593 
594 #define CIL_AVRULE_ALLOWED     1
595 #define CIL_AVRULE_AUDITALLOW  2
596 #define CIL_AVRULE_DONTAUDIT   8
597 #define CIL_AVRULE_NEVERALLOW 128
598 #define CIL_AVRULE_AV         (AVRULE_ALLOWED | AVRULE_AUDITALLOW | AVRULE_DONTAUDIT | AVRULE_NEVERALLOW)
599 struct cil_avrule {
600 	int is_extended;
601 	uint32_t rule_kind;
602 	char *src_str;
603 	void *src; /* type, alias, or attribute */
604 	char *tgt_str;
605 	void *tgt; /* type, alias, or attribute */
606 	union {
607 		struct cil_list *classperms;
608 		struct {
609 			char *permx_str;
610 			struct cil_permissionx *permx;
611 		} x;
612 	} perms;
613 };
614 
615 #define CIL_PERMX_KIND_IOCTL 1
616 struct cil_permissionx {
617 	struct cil_symtab_datum datum;
618 	uint32_t kind;
619 	char *obj_str;
620 	struct cil_class *obj;
621 	struct cil_list *expr_str;
622 	ebitmap_t *perms;
623 };
624 
625 #define CIL_TYPE_TRANSITION 16
626 #define CIL_TYPE_MEMBER     32
627 #define CIL_TYPE_CHANGE     64
628 #define CIL_AVRULE_TYPE       (AVRULE_TRANSITION | AVRULE_MEMBER | AVRULE_CHANGE)
629 struct cil_type_rule {
630 	uint32_t rule_kind;
631 	char *src_str;
632 	void *src; /* type, alias, or attribute */
633 	char *tgt_str;
634 	void *tgt; /* type, alias, or attribute */
635 	char *obj_str;
636 	struct cil_class *obj;
637 	char *result_str;
638 	void *result; /* type or alias */
639 };
640 
641 struct cil_roletransition {
642 	char *src_str;
643 	struct cil_role *src;
644 	char *tgt_str;
645 	void *tgt; /* type, alias, or attribute */
646 	char *obj_str;
647 	struct cil_class *obj;
648 	char *result_str;
649 	struct cil_role *result;
650 };
651 
652 struct cil_roleallow {
653 	char *src_str;
654 	void *src; /* role or attribute */
655 	char *tgt_str;
656 	void *tgt; /* role or attribute */
657 };
658 
659 struct cil_sens {
660 	struct cil_symtab_datum datum;
661 	struct cil_list *cats_list;
662 	uint32_t ordered;
663 };
664 
665 struct cil_sensorder {
666 	struct cil_list *sens_list_str;
667 };
668 
669 struct cil_cat {
670 	struct cil_symtab_datum datum;
671 	uint32_t ordered;
672 	int value;
673 };
674 
675 struct cil_cats {
676 	uint32_t evaluated;
677 	struct cil_list *str_expr;
678 	struct cil_list *datum_expr;
679 };
680 
681 struct cil_catset {
682 	struct cil_symtab_datum datum;
683 	struct cil_cats *cats;
684 };
685 
686 struct cil_catorder {
687 	struct cil_list *cat_list_str;
688 };
689 
690 struct cil_senscat {
691 	char *sens_str;
692 	struct cil_cats *cats;
693 };
694 
695 struct cil_level {
696 	struct cil_symtab_datum datum;
697 	char *sens_str;
698 	struct cil_sens *sens;
699 	struct cil_cats *cats;
700 };
701 
702 struct cil_levelrange {
703 	struct cil_symtab_datum datum;
704 	char *low_str;
705 	struct cil_level *low;
706 	char *high_str;
707 	struct cil_level *high;
708 };
709 
710 struct cil_context {
711 	struct cil_symtab_datum datum;
712 	char *user_str;
713 	struct cil_user *user;
714 	char *role_str;
715 	struct cil_role *role;
716 	char *type_str;
717 	void *type; /* type or alias */
718 	char *range_str;
719 	struct cil_levelrange *range;
720 };
721 
722 enum cil_filecon_types {
723 	CIL_FILECON_FILE = 1,
724 	CIL_FILECON_DIR,
725 	CIL_FILECON_CHAR,
726 	CIL_FILECON_BLOCK,
727 	CIL_FILECON_SOCKET,
728 	CIL_FILECON_PIPE,
729 	CIL_FILECON_SYMLINK,
730 	CIL_FILECON_ANY
731 };
732 
733 struct cil_filecon {
734 	char *path_str;
735 	enum cil_filecon_types type;
736 	char *context_str;
737 	struct cil_context *context;
738 };
739 
740 enum cil_protocol {
741 	CIL_PROTOCOL_UDP = 1,
742 	CIL_PROTOCOL_TCP,
743 	CIL_PROTOCOL_DCCP
744 };
745 
746 struct cil_ibpkeycon {
747 	char *subnet_prefix_str;
748 	uint32_t pkey_low;
749 	uint32_t pkey_high;
750 	char *context_str;
751 	struct cil_context *context;
752 };
753 
754 struct cil_portcon {
755 	enum cil_protocol proto;
756 	uint32_t port_low;
757 	uint32_t port_high;
758 	char *context_str;
759 	struct cil_context *context;
760 };
761 
762 struct cil_nodecon {
763 	char *addr_str;
764 	struct cil_ipaddr *addr;
765 	char *mask_str;
766 	struct cil_ipaddr *mask;
767 	char *context_str;
768 	struct cil_context *context;
769 };
770 
771 struct cil_ipaddr {
772 	struct cil_symtab_datum datum;
773 	int family;
774 	union {
775 		struct in_addr v4;
776 		struct in6_addr v6;
777 	} ip;
778 };
779 
780 struct cil_genfscon {
781 	char *fs_str;
782 	char *path_str;
783 	char *context_str;
784 	struct cil_context *context;
785 };
786 
787 struct cil_netifcon {
788 	char *interface_str;
789 	char *if_context_str;
790 	struct cil_context *if_context;
791 	char *packet_context_str;
792 	struct cil_context *packet_context;
793 	char *context_str;
794 };
795 
796 struct cil_ibendportcon {
797 	char *dev_name_str;
798 	uint32_t port;
799 	char *context_str;
800 	struct cil_context *context;
801 };
802 struct cil_pirqcon {
803 	uint32_t pirq;
804 	char *context_str;
805 	struct cil_context *context;
806 };
807 
808 struct cil_iomemcon {
809 	uint64_t iomem_low;
810 	uint64_t iomem_high;
811 	char *context_str;
812 	struct cil_context *context;
813 };
814 
815 struct cil_ioportcon {
816 	uint32_t ioport_low;
817 	uint32_t ioport_high;
818 	char *context_str;
819 	struct cil_context *context;
820 };
821 
822 struct cil_pcidevicecon {
823 	uint32_t dev;
824 	char *context_str;
825 	struct cil_context *context;
826 };
827 
828 struct cil_devicetreecon {
829 	char *path;
830 	char *context_str;
831 	struct cil_context *context;
832 };
833 
834 
835 /* Ensure that CIL uses the same values as sepol services.h */
836 enum cil_fsuse_types {
837 	CIL_FSUSE_XATTR = SECURITY_FS_USE_XATTR,
838 	CIL_FSUSE_TASK = SECURITY_FS_USE_TASK,
839 	CIL_FSUSE_TRANS = SECURITY_FS_USE_TRANS
840 };
841 
842 struct cil_fsuse {
843 	enum cil_fsuse_types type;
844 	char *fs_str;
845 	char *context_str;
846 	struct cil_context *context;
847 };
848 
849 #define CIL_MLS_LEVELS "l1 l2 h1 h2"
850 #define CIL_CONSTRAIN_KEYS "t1 t2 r1 r2 u1 u2"
851 #define CIL_MLSCONSTRAIN_KEYS CIL_MLS_LEVELS CIL_CONSTRAIN_KEYS
852 #define CIL_CONSTRAIN_OPER "== != eq dom domby incomp not and or"
853 struct cil_constrain {
854 	struct cil_list *classperms;
855 	struct cil_list *str_expr;
856 	struct cil_list *datum_expr;
857 };
858 
859 struct cil_validatetrans {
860 	char *class_str;
861 	struct cil_class *class;
862 	struct cil_list *str_expr;
863 	struct cil_list *datum_expr;
864 };
865 
866 struct cil_param {
867 	char *str;
868 	enum cil_flavor flavor;
869 };
870 
871 struct cil_macro {
872 	struct cil_symtab_datum datum;
873 	symtab_t symtab[CIL_SYM_NUM];
874 	struct cil_list *params;
875 };
876 
877 struct cil_args {
878 	char *arg_str;
879 	struct cil_symtab_datum *arg;
880 	char *param_str;
881 	enum cil_flavor flavor;
882 };
883 
884 struct cil_call {
885 	char *macro_str;
886 	struct cil_macro *macro;
887 	struct cil_tree *args_tree;
888 	struct cil_list *args;
889 	int copied;
890 };
891 
892 #define CIL_TRUE	1
893 #define CIL_FALSE	0
894 
895 struct cil_condblock {
896 	enum cil_flavor flavor;
897 	symtab_t symtab[CIL_SYM_NUM];
898 };
899 
900 struct cil_booleanif {
901 	struct cil_list *str_expr;
902 	struct cil_list *datum_expr;
903 	int preserved_tunable;
904 };
905 
906 struct cil_tunableif {
907 	struct cil_list *str_expr;
908 	struct cil_list *datum_expr;
909 };
910 
911 struct cil_policycap {
912 	struct cil_symtab_datum datum;
913 };
914 
915 struct cil_bounds {
916 	char *parent_str;
917 	char *child_str;
918 };
919 
920 /* Ensure that CIL uses the same values as sepol policydb.h */
921 enum cil_default_object {
922 	CIL_DEFAULT_SOURCE = DEFAULT_SOURCE,
923 	CIL_DEFAULT_TARGET = DEFAULT_TARGET,
924 };
925 
926 /* Default labeling behavior for users, roles, and types */
927 struct cil_default {
928 	enum cil_flavor flavor;
929 	struct cil_list *class_strs;
930 	struct cil_list *class_datums;
931 	enum cil_default_object object;
932 };
933 
934 /* Ensure that CIL uses the same values as sepol policydb.h */
935 enum cil_default_object_range {
936 	CIL_DEFAULT_SOURCE_LOW      = DEFAULT_SOURCE_LOW,
937 	CIL_DEFAULT_SOURCE_HIGH     = DEFAULT_SOURCE_HIGH,
938 	CIL_DEFAULT_SOURCE_LOW_HIGH = DEFAULT_SOURCE_LOW_HIGH,
939 	CIL_DEFAULT_TARGET_LOW      = DEFAULT_TARGET_LOW,
940 	CIL_DEFAULT_TARGET_HIGH     = DEFAULT_TARGET_HIGH,
941 	CIL_DEFAULT_TARGET_LOW_HIGH = DEFAULT_TARGET_LOW_HIGH,
942 };
943 
944 /* Default labeling behavior for range */
945 struct cil_defaultrange {
946 	struct cil_list *class_strs;
947 	struct cil_list *class_datums;
948 	enum cil_default_object_range object_range;
949 };
950 
951 struct cil_handleunknown {
952 	int handle_unknown;
953 };
954 
955 struct cil_mls {
956 	int value;
957 };
958 
959 struct cil_src_info {
960 	int is_cil;
961 	char *path;
962 };
963 
964 void cil_db_init(struct cil_db **db);
965 void cil_db_destroy(struct cil_db **db);
966 
967 void cil_root_init(struct cil_root **root);
968 void cil_root_destroy(struct cil_root *root);
969 
970 void cil_destroy_data(void **data, enum cil_flavor flavor);
971 
972 int cil_flavor_to_symtab_index(enum cil_flavor flavor, enum cil_sym_index *index);
973 const char * cil_node_to_string(struct cil_tree_node *node);
974 
975 int cil_userprefixes_to_string(struct cil_db *db, char **out, size_t *size);
976 int cil_selinuxusers_to_string(struct cil_db *db, char **out, size_t *size);
977 int cil_filecons_to_string(struct cil_db *db, char **out, size_t *size);
978 
979 void cil_symtab_array_init(symtab_t symtab[], int symtab_sizes[CIL_SYM_NUM]);
980 void cil_symtab_array_destroy(symtab_t symtab[]);
981 void cil_destroy_ast_symtabs(struct cil_tree_node *root);
982 int cil_get_symtab(struct cil_tree_node *ast_node, symtab_t **symtab, enum cil_sym_index sym_index);
983 
984 void cil_sort_init(struct cil_sort **sort);
985 void cil_sort_destroy(struct cil_sort **sort);
986 void cil_netifcon_init(struct cil_netifcon **netifcon);
987 void cil_ibendportcon_init(struct cil_ibendportcon **ibendportcon);
988 void cil_context_init(struct cil_context **context);
989 void cil_level_init(struct cil_level **level);
990 void cil_levelrange_init(struct cil_levelrange **lvlrange);
991 void cil_sens_init(struct cil_sens **sens);
992 void cil_block_init(struct cil_block **block);
993 void cil_blockinherit_init(struct cil_blockinherit **inherit);
994 void cil_blockabstract_init(struct cil_blockabstract **abstract);
995 void cil_in_init(struct cil_in **in);
996 void cil_class_init(struct cil_class **class);
997 void cil_classorder_init(struct cil_classorder **classorder);
998 void cil_classcommon_init(struct cil_classcommon **classcommon);
999 void cil_sid_init(struct cil_sid **sid);
1000 void cil_sidcontext_init(struct cil_sidcontext **sidcontext);
1001 void cil_sidorder_init(struct cil_sidorder **sidorder);
1002 void cil_userrole_init(struct cil_userrole **userrole);
1003 void cil_userprefix_init(struct cil_userprefix **userprefix);
1004 void cil_selinuxuser_init(struct cil_selinuxuser **selinuxuser);
1005 void cil_roleattribute_init(struct cil_roleattribute **attribute);
1006 void cil_roleattributeset_init(struct cil_roleattributeset **attrset);
1007 void cil_roletype_init(struct cil_roletype **roletype);
1008 void cil_typeattribute_init(struct cil_typeattribute **attribute);
1009 void cil_typeattributeset_init(struct cil_typeattributeset **attrset);
1010 void cil_expandtypeattribute_init(struct cil_expandtypeattribute **expandattr);
1011 void cil_alias_init(struct cil_alias **alias);
1012 void cil_aliasactual_init(struct cil_aliasactual **aliasactual);
1013 void cil_typepermissive_init(struct cil_typepermissive **typeperm);
1014 void cil_name_init(struct cil_name **name);
1015 void cil_nametypetransition_init(struct cil_nametypetransition **nametypetrans);
1016 void cil_rangetransition_init(struct cil_rangetransition **rangetrans);
1017 void cil_bool_init(struct cil_bool **cilbool);
1018 void cil_boolif_init(struct cil_booleanif **bif);
1019 void cil_condblock_init(struct cil_condblock **cb);
1020 void cil_tunable_init(struct cil_tunable **ciltun);
1021 void cil_tunif_init(struct cil_tunableif **tif);
1022 void cil_avrule_init(struct cil_avrule **avrule);
1023 void cil_permissionx_init(struct cil_permissionx **permx);
1024 void cil_type_rule_init(struct cil_type_rule **type_rule);
1025 void cil_roletransition_init(struct cil_roletransition **roletrans);
1026 void cil_roleallow_init(struct cil_roleallow **role_allow);
1027 void cil_catset_init(struct cil_catset **catset);
1028 void cil_cats_init(struct cil_cats **cats);
1029 void cil_senscat_init(struct cil_senscat **senscat);
1030 void cil_filecon_init(struct cil_filecon **filecon);
1031 void cil_ibpkeycon_init(struct cil_ibpkeycon **ibpkeycon);
1032 void cil_portcon_init(struct cil_portcon **portcon);
1033 void cil_nodecon_init(struct cil_nodecon **nodecon);
1034 void cil_genfscon_init(struct cil_genfscon **genfscon);
1035 void cil_pirqcon_init(struct cil_pirqcon **pirqcon);
1036 void cil_iomemcon_init(struct cil_iomemcon **iomemcon);
1037 void cil_ioportcon_init(struct cil_ioportcon **ioportcon);
1038 void cil_pcidevicecon_init(struct cil_pcidevicecon **pcidevicecon);
1039 void cil_devicetreecon_init(struct cil_devicetreecon **devicetreecon);
1040 void cil_fsuse_init(struct cil_fsuse **fsuse);
1041 void cil_constrain_init(struct cil_constrain **constrain);
1042 void cil_validatetrans_init(struct cil_validatetrans **validtrans);
1043 void cil_ipaddr_init(struct cil_ipaddr **ipaddr);
1044 void cil_perm_init(struct cil_perm **perm);
1045 void cil_classpermission_init(struct cil_classpermission **cp);
1046 void cil_classpermissionset_init(struct cil_classpermissionset **cps);
1047 void cil_classperms_set_init(struct cil_classperms_set **cp_set);
1048 void cil_classperms_init(struct cil_classperms **cp);
1049 void cil_classmapping_init(struct cil_classmapping **mapping);
1050 void cil_user_init(struct cil_user **user);
1051 void cil_userlevel_init(struct cil_userlevel **usrlvl);
1052 void cil_userrange_init(struct cil_userrange **userrange);
1053 void cil_role_init(struct cil_role **role);
1054 void cil_type_init(struct cil_type **type);
1055 void cil_cat_init(struct cil_cat **cat);
1056 void cil_catorder_init(struct cil_catorder **catorder);
1057 void cil_sensorder_init(struct cil_sensorder **sensorder);
1058 void cil_args_init(struct cil_args **args);
1059 void cil_call_init(struct cil_call **call);
1060 void cil_optional_init(struct cil_optional **optional);
1061 void cil_param_init(struct cil_param **param);
1062 void cil_macro_init(struct cil_macro **macro);
1063 void cil_policycap_init(struct cil_policycap **policycap);
1064 void cil_bounds_init(struct cil_bounds **bounds);
1065 void cil_default_init(struct cil_default **def);
1066 void cil_defaultrange_init(struct cil_defaultrange **def);
1067 void cil_handleunknown_init(struct cil_handleunknown **unk);
1068 void cil_mls_init(struct cil_mls **mls);
1069 void cil_src_info_init(struct cil_src_info **info);
1070 void cil_userattribute_init(struct cil_userattribute **attribute);
1071 void cil_userattributeset_init(struct cil_userattributeset **attrset);
1072 
1073 #endif
1074