mirror of
https://github.com/SELinuxProject/selinux
synced 2024-12-24 15:02:44 +00:00
9eefe11b3a
Adds policy source defined 'type' or 'typeattribute' names to constraints by adding additional structures (->type_names->types) to a binary policy. Before this change all typeattributes were expanded to lists of types and added to the constraint under ->names. This made it difficult for system admins to determine from the policy source what attribute needed to be updated. To facilitate analysis of constraint failures a new function has also been added, see sepol_compute_av_reason_buffer. As additional structures have been added to policy, the policy version is also updated (POLICYDB_VERSION_CONSTRAINT_NAMES). There is also a corresponding kernel patch to handle the additional structures. sepol_compute_av_reason_buffer is an extended version of sepol_compute_av_reason. This will return a buffer with constraint expression information, containing the constrain type, class, perms, keywords etc.. It will also contain which constraint expr failed plus the final outcome. The buffer MUST be free'd with free(3). The type information output by sepol_compute_av_reason_buffer depends on the policy version: If >= POLICYDB_VERSION_CONSTRAINT_NAMES, then the output will be whatever was in the original policy (type or attribute names). If < POLICYDB_VERSION_CONSTRAINT_NAMES, then the output will be the types listed in the constraint (as no attribute information is available in these versions). For users and roles whatever policy version, only the names are listed (as role attributes are not currently held in the constraint). Also added are two functions that obtain the class and permissions from a binary policy file that has been loaded for testing: sepol_string_to_security_class sepol_string_to_av_perm Signed-off-by: Richard Haines <richard_c_haines@btinternet.com> |
||
|---|---|---|
| .. | ||
| policydb | ||
| boolean_record.h | ||
| booleans.h | ||
| context_record.h | ||
| context.h | ||
| debug.h | ||
| errcodes.h | ||
| handle.h | ||
| iface_record.h | ||
| interfaces.h | ||
| module.h | ||
| node_record.h | ||
| nodes.h | ||
| policydb.h | ||
| port_record.h | ||
| ports.h | ||
| roles.h | ||
| sepol.h | ||
| user_record.h | ||
| users.h | ||