security/selinux/ss/policydb.c

File Facts

System

Linux kernel

Corpus path

security/selinux/ss/policydb.c

Extension

.c

Size

84290 bytes

Lines

4018

Domain

Core OS

Bucket

Security And Isolation

Inferred role

Core OS: implementation source

Status

source implementation candidate

Why This File Exists

Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.

• Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.
• Allocates kernel memory; connect allocation flags and lifetime to context constraints.
• Defines or uses C structs; map object ownership, embedded links, reference counts, and lock ownership.

Dependency Surface

• linux/kernel.h
• linux/sched.h
• linux/slab.h
• linux/string.h
• linux/errno.h
• linux/audit.h
• linux/sort.h
• security.h
• policydb.h
• conditional.h
• mls.h
• services.h

Detected Declarations

• struct policydb_compat_info
• function policydb_lookup_compat
• function perm_destroy
• function common_destroy
• function constraint_expr_destroy
• function cls_destroy
• function role_destroy
• function type_destroy
• function user_destroy
• function sens_destroy
• function cat_destroy
• function filenametr_destroy
• function range_tr_destroy
• function role_tr_destroy
• function ocontext_destroy
• function roles_init
• function filenametr_hash
• function filenametr_cmp
• function policydb_filenametr_search
• function rangetr_hash
• function rangetr_cmp
• function role_trans_hash
• function role_trans_cmp
• function policydb_init
• function common_index
• function class_index
• function role_index
• function type_index
• function user_index
• function sens_index
• function cat_index
• function hash_eval
• function symtab_hash_eval
• function hash_eval
• function policydb_destroy
• function policydb_load_isids
• function policydb_class_isvalid
• function policydb_user_isvalid
• function policydb_role_isvalid
• function policydb_type_isvalid
• function policydb_simpletype_isvalid
• function policydb_context_isvalid
• function mls_read_range_helper
• function context_read_and_validate
• function str_read
• function perm_read
• function common_read
• function type_set_init

Annotated Snippet

struct policydb_compat_info {
	unsigned int version;
	unsigned int sym_num;
	unsigned int ocon_num;
};

/* These need to be updated if SYM_NUM or OCON_NUM changes */
static const struct policydb_compat_info policydb_compat[] = {
	{
		.version = POLICYDB_VERSION_BASE,
		.sym_num = SYM_NUM - 3,
		.ocon_num = OCON_NUM - 3,
	},
	{
		.version = POLICYDB_VERSION_BOOL,
		.sym_num = SYM_NUM - 2,
		.ocon_num = OCON_NUM - 3,
	},
	{
		.version = POLICYDB_VERSION_IPV6,
		.sym_num = SYM_NUM - 2,
		.ocon_num = OCON_NUM - 2,
	},
	{
		.version = POLICYDB_VERSION_NLCLASS,
		.sym_num = SYM_NUM - 2,
		.ocon_num = OCON_NUM - 2,
	},
	{
		.version = POLICYDB_VERSION_MLS,
		.sym_num = SYM_NUM,
		.ocon_num = OCON_NUM - 2,
	},
	{
		.version = POLICYDB_VERSION_AVTAB,
		.sym_num = SYM_NUM,
		.ocon_num = OCON_NUM - 2,
	},
	{
		.version = POLICYDB_VERSION_RANGETRANS,
		.sym_num = SYM_NUM,
		.ocon_num = OCON_NUM - 2,
	},
	{
		.version = POLICYDB_VERSION_POLCAP,
		.sym_num = SYM_NUM,
		.ocon_num = OCON_NUM - 2,
	},
	{
		.version = POLICYDB_VERSION_PERMISSIVE,
		.sym_num = SYM_NUM,
		.ocon_num = OCON_NUM - 2,
	},
	{
		.version = POLICYDB_VERSION_BOUNDARY,
		.sym_num = SYM_NUM,
		.ocon_num = OCON_NUM - 2,
	},
	{
		.version = POLICYDB_VERSION_FILENAME_TRANS,
		.sym_num = SYM_NUM,
		.ocon_num = OCON_NUM - 2,
	},
	{
		.version = POLICYDB_VERSION_ROLETRANS,
		.sym_num = SYM_NUM,
		.ocon_num = OCON_NUM - 2,
	},
	{
		.version = POLICYDB_VERSION_NEW_OBJECT_DEFAULTS,
		.sym_num = SYM_NUM,
		.ocon_num = OCON_NUM - 2,
	},
	{
		.version = POLICYDB_VERSION_DEFAULT_TYPE,
		.sym_num = SYM_NUM,
		.ocon_num = OCON_NUM - 2,
	},
	{
		.version = POLICYDB_VERSION_CONSTRAINT_NAMES,
		.sym_num = SYM_NUM,
		.ocon_num = OCON_NUM - 2,
	},
	{
		.version = POLICYDB_VERSION_XPERMS_IOCTL,
		.sym_num = SYM_NUM,
		.ocon_num = OCON_NUM - 2,
	},
	{
		.version = POLICYDB_VERSION_INFINIBAND,

Annotation

• Immediate include surface: `linux/kernel.h`, `linux/sched.h`, `linux/slab.h`, `linux/string.h`, `linux/errno.h`, `linux/audit.h`, `linux/sort.h`, `security.h`.
• Detected declarations: `struct policydb_compat_info`, `function policydb_lookup_compat`, `function perm_destroy`, `function common_destroy`, `function constraint_expr_destroy`, `function cls_destroy`, `function role_destroy`, `function type_destroy`, `function user_destroy`, `function sens_destroy`.
• Atlas domain: Core OS / Security And Isolation.
• Implementation status: source implementation candidate.

Implementation Notes

• This generated page is the file-by-file coverage layer; curated subsystem chapters should link here when they synthesize a multi-file control flow.
• Core OS pages should be promoted from atlas-only to deep-reviewed when they explain data structures, invariants, locking, lifecycle, and C implementation snippets.
• Driver-family pages are intentionally pattern-oriented unless they are part of the selected PCIe/NVMe representative device path.