2008-08-19 19:30:36 +00:00
|
|
|
#ifndef _SEPOL_POLICYDB_POLCAPS_H_
|
|
|
|
|
#define _SEPOL_POLICYDB_POLCAPS_H_
|
|
|
|
|
|
2016-11-29 15:57:48 +00:00
|
|
|
#ifdef __cplusplus
|
|
|
|
|
extern "C" {
|
|
|
|
|
#endif
|
2014-12-16 19:44:41 +00:00
|
|
|
|
2008-08-19 19:30:36 +00:00
|
|
|
/* Policy capabilities */
|
|
|
|
|
enum {
|
|
|
|
|
POLICYDB_CAPABILITY_NETPEER,
|
|
|
|
|
POLICYDB_CAPABILITY_OPENPERM,
|
2016-12-01 16:08:06 +00:00
|
|
|
POLICYDB_CAPABILITY_EXTSOCKCLASS,
|
2012-06-06 17:27:10 +00:00
|
|
|
POLICYDB_CAPABILITY_ALWAYSNETWORK,
|
2017-02-28 15:26:48 +00:00
|
|
|
POLICYDB_CAPABILITY_CGROUPSECLABEL,
|
2017-07-14 16:11:40 +00:00
|
|
|
POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION,
|
2020-01-31 18:39:00 +00:00
|
|
|
POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS,
|
2008-08-19 19:30:36 +00:00
|
|
|
__POLICYDB_CAPABILITY_MAX
|
|
|
|
|
};
|
|
|
|
|
#define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
|
|
|
|
|
|
|
|
|
|
/* Convert a capability name to number. */
|
|
|
|
|
extern int sepol_polcap_getnum(const char *name);
|
|
|
|
|
|
|
|
|
|
/* Convert a capability number to name. */
|
libsepol: make capability index an unsigned int
When sepol_polcap_getname() is called with a negative capnum, it
dereferences polcap_names[capnum] which produces a segmentation fault
most of the time.
For information, here is a gdb session when hll/pp loads a policy module
which has been mutated by American Fuzzy Lop:
Program received signal SIGSEGV, Segmentation fault.
sepol_polcap_getname (capnum=capnum@entry=-4259840) at polcaps.c:34
34 return polcap_names[capnum];
=> 0x00007ffff7a8da07 <sepol_polcap_getname+135>: 48 8b 04 f8 mov
(%rax,%rdi,8),%rax
(gdb) bt
#0 sepol_polcap_getname (capnum=capnum@entry=-4259840) at
polcaps.c:34
#1 0x00007ffff7a7c440 in polcaps_to_cil (pdb=0x6042e0) at
module_to_cil.c:2492
#2 sepol_module_policydb_to_cil (fp=fp@entry=0x7ffff79c75e0
<_IO_2_1_stdout_>, pdb=0x6042e0, linked=linked@entry=0) at
module_to_cil.c:4039
#3 0x00007ffff7a7e695 in sepol_module_package_to_cil
(fp=fp@entry=0x7ffff79c75e0 <_IO_2_1_stdout_>, mod_pkg=0x604280) at
module_to_cil.c:4087
#4 0x0000000000401acc in main (argc=<optimized out>,
argv=<optimized out>) at pp.c:150
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2017-01-04 22:02:29 +00:00
|
|
|
extern const char *sepol_polcap_getname(unsigned int capnum);
|
2008-08-19 19:30:36 +00:00
|
|
|
|
2016-11-29 15:57:48 +00:00
|
|
|
#ifdef __cplusplus
|
|
|
|
|
}
|
|
|
|
|
#endif
|
|
|
|
|
|
2008-08-19 19:30:36 +00:00
|
|
|
#endif /* _SEPOL_POLICYDB_POLCAPS_H_ */
|
