ipmi: change device discovery order

[safe/jmp/linux-2.6] / security / selinux / ss / policydb.h

diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h
index b134071..26d9adf 100644 (file)
--- a/security/selinux/ss/policydb.h
+++ b/security/selinux/ss/policydb.h
@@ -12,12 +12,12 @@
  *
  * Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com>
  *
- *     Added conditional policy language extensions
+ *     Added conditional policy language extensions
  *
  * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  * Copyright (C) 2003 - 2004 Tresys Technology, LLC
  *     This program is free software; you can redistribute it and/or modify
- *     it under the terms of the GNU General Public License as published by
+ *     it under the terms of the GNU General Public License as published by
  *     the Free Software Foundation, version 2.
  */
 
@@ -27,6 +27,8 @@
 #include "symtab.h"
 #include "avtab.h"
 #include "sidtab.h"
+#include "ebitmap.h"
+#include "mls_types.h"
 #include "context.h"
 #include "constraint.h"
 
@@ -61,6 +63,7 @@ struct class_datum {
 /* Role attributes */
 struct role_datum {
        u32 value;                      /* internal role value */
+       u32 bounds;                     /* boundary of role */
        struct ebitmap dominates;       /* set of roles dominated by this role */
        struct ebitmap types;           /* set of authorized types for role */
 };
@@ -81,12 +84,15 @@ struct role_allow {
 /* Type attributes */
 struct type_datum {
        u32 value;              /* internal type value */
+       u32 bounds;             /* boundary of type */
        unsigned char primary;  /* primary name? */
+       unsigned char attribute;/* attribute ?*/
 };
 
 /* User attributes */
 struct user_datum {
        u32 value;                      /* internal user value */
+       u32 bounds;                     /* bounds of user */
        struct ebitmap roles;           /* set of authorized roles for user */
        struct mls_range range;         /* MLS range (min - max) for user */
        struct mls_level dfltlevel;     /* default login MLS level for user */
@@ -106,10 +112,9 @@ struct cat_datum {
 };
 
 struct range_trans {
-       u32 dom;                        /* current process domain */
-       u32 type;                       /* program executable type */
-       struct mls_range range;         /* new range */
-       struct range_trans *next;
+       u32 source_type;
+       u32 target_type;
+       u32 target_class;
 };
 
 /* Boolean data type */
@@ -182,6 +187,8 @@ struct genfs {
 
 /* The policy database */
 struct policydb {
+       int mls_enabled;
+
        /* symbol tables */
        struct symtab symtab[SYM_NUM];
 #define p_commons symtab[SYM_COMMONS]
@@ -208,6 +215,7 @@ struct policydb {
        struct class_datum **class_val_to_struct;
        struct role_datum **role_val_to_struct;
        struct user_datum **user_val_to_struct;
+       struct type_datum **type_val_to_struct;
 
        /* type enforcement access vectors and transitions */
        struct avtab te_avtab;
@@ -220,7 +228,7 @@ struct policydb {
        /* type enforcement conditional access vectors and transitions */
        struct avtab te_cond_avtab;
        /* linked list indexing te_cond_avtab by conditional */
-       struct cond_node* cond_list;
+       struct cond_node *cond_list;
 
        /* role allows */
        struct role_allow *role_allow;
@@ -229,29 +237,46 @@ struct policydb {
           TCP or UDP port numbers, network interfaces and nodes */
        struct ocontext *ocontexts[OCON_NUM];
 
-        /* security contexts for files in filesystems that cannot support
+       /* security contexts for files in filesystems that cannot support
           a persistent label mapping or use another
           fixed labeling behavior. */
-       struct genfs *genfs;
+       struct genfs *genfs;
 
-       /* range transitions */
-       struct range_trans *range_tr;
+       /* range transitions table (range_trans_key -> mls_range) */
+       struct hashtab *range_tr;
 
        /* type -> attribute reverse mapping */
        struct ebitmap *type_attr_map;
 
+       struct ebitmap policycaps;
+
+       struct ebitmap permissive_map;
+
        unsigned int policyvers;
+
+       unsigned int reject_unknown : 1;
+       unsigned int allow_unknown : 1;
+
+       u16 process_class;
+       u32 process_trans_perms;
 };
 
 extern void policydb_destroy(struct policydb *p);
 extern int policydb_load_isids(struct policydb *p, struct sidtab *s);
 extern int policydb_context_isvalid(struct policydb *p, struct context *c);
+extern int policydb_class_isvalid(struct policydb *p, unsigned int class);
+extern int policydb_type_isvalid(struct policydb *p, unsigned int type);
+extern int policydb_role_isvalid(struct policydb *p, unsigned int role);
 extern int policydb_read(struct policydb *p, void *fp);
 
 #define PERM_SYMTAB_SIZE 32
 
 #define POLICYDB_CONFIG_MLS    1
 
+/* the config flags related to unknown classes/perms are bits 2 and 3 */
+#define REJECT_UNKNOWN 0x00000002
+#define ALLOW_UNKNOWN  0x00000004
+
 #define OBJECT_R "object_r"
 #define OBJECT_R_VAL 1
 
@@ -274,5 +299,8 @@ static inline int next_entry(void *buf, struct policy_file *fp, size_t bytes)
        return 0;
 }
 
+extern u16 string_to_security_class(struct policydb *p, const char *name);
+extern u32 string_to_av_perm(struct policydb *p, u16 tclass, const char *name);
+
 #endif /* _SS_POLICYDB_H_ */