security/selinux/ss/policydb.h

Source file repositories/reference/linux-study-clean/security/selinux/ss/policydb.h

File Facts

System
Linux kernel
Corpus path
security/selinux/ss/policydb.h
Extension
.h
Size
11814 bytes
Lines
429
Domain
Core OS
Bucket
Security And Isolation
Inferred role
Core OS: implementation source
Status
source implementation candidate

Why This File Exists

Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.

Dependency Surface

Detected Declarations

Annotated Snippet

struct perm_datum {
	u32 value; /* permission bit + 1 */
};

/* Attributes of a common prefix for access vectors */
struct common_datum {
	u32 value; /* internal common value */
	struct symtab permissions; /* common permissions */
};

/* Class attributes */
struct class_datum {
	u16 value; /* class value */
	char *comkey; /* common name */
	struct common_datum *comdatum; /* common datum */
	struct symtab permissions; /* class-specific permission symbol table */
	struct constraint_node *constraints; /* constraints on class perms */
	struct constraint_node *validatetrans; /* special transition rules */
/* Options how a new object user, role, and type should be decided */
#define DEFAULT_SOURCE 1
#define DEFAULT_TARGET 2
	char default_user;
	char default_role;
	char default_type;
/* Options how a new object range should be decided */
#define DEFAULT_SOURCE_LOW	1
#define DEFAULT_SOURCE_HIGH	2
#define DEFAULT_SOURCE_LOW_HIGH 3
#define DEFAULT_TARGET_LOW	4
#define DEFAULT_TARGET_HIGH	5
#define DEFAULT_TARGET_LOW_HIGH 6
#define DEFAULT_GLBLUB		7
	char default_range;
};

/* Role attributes */
struct role_datum {
	u32 value; /* internal role value */
	u32 bounds; /* boundary of role, 0 for none */
	struct ebitmap dominates; /* set of roles dominated by this role */
	struct ebitmap types; /* set of authorized types for role */
};

struct role_trans_key {
	u32 role; /* current role */
	u32 type; /* program executable type, or new object type */
	u16 tclass; /* process class, or new object class */
};

struct role_trans_datum {
	u32 new_role; /* new role */
};

struct filename_trans_key {
	u32 ttype; /* parent dir context */
	u16 tclass; /* class of new object */
	const char *name; /* last path component */
};

struct filename_trans_datum {
	struct ebitmap stypes; /* bitmap of source types for this otype */
	u32 otype; /* resulting type of new object */
	struct filename_trans_datum *next; /* record for next otype*/
};

struct role_allow {
	u32 role; /* current role */
	u32 new_role; /* new role */
	struct role_allow *next;
};

/* Type attributes */
struct type_datum {
	u32 value; /* internal type value */
	u32 bounds; /* boundary of type, 0 for none */
	/* internally unused, only forwarded via policydb_write() */
	unsigned char primary; /* primary name? */
	unsigned char attribute; /* attribute ?*/
};

/* User attributes */
struct user_datum {
	u32 value; /* internal user value */
	u32 bounds; /* bounds of user, 0 for none */
	struct ebitmap roles; /* set of authorized roles for user */
	struct mls_range range; /* MLS range (min - max) for user */
	struct mls_level dfltlevel; /* default login MLS level for user */
};

/* Sensitivity attributes */

Annotation

Implementation Notes