243 lines
7.0 KiB
Cheetah
243 lines
7.0 KiB
Cheetah
########################################
|
|
#
|
|
# Support macros for sets of object classes and permissions
|
|
#
|
|
# This file should only have object class and permission set macros - they
|
|
# can only reference object classes and/or permissions.
|
|
|
|
#
|
|
# All directory and file classes
|
|
#
|
|
define(`dir_file_class_set', `{ dir file lnk_file sock_file fifo_file chr_file blk_file }')
|
|
|
|
#
|
|
# All non-directory file classes.
|
|
#
|
|
define(`file_class_set', `{ file lnk_file sock_file fifo_file chr_file blk_file }')
|
|
|
|
#
|
|
# Non-device file classes.
|
|
#
|
|
define(`notdevfile_class_set', `{ file lnk_file sock_file fifo_file }')
|
|
|
|
#
|
|
# Device file classes.
|
|
#
|
|
define(`devfile_class_set', `{ chr_file blk_file }')
|
|
|
|
#
|
|
# All socket classes.
|
|
#
|
|
define(`socket_class_set', `{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket }')
|
|
|
|
|
|
#
|
|
# Datagram socket classes.
|
|
#
|
|
define(`dgram_socket_class_set', `{ udp_socket unix_dgram_socket }')
|
|
|
|
#
|
|
# Stream socket classes.
|
|
#
|
|
define(`stream_socket_class_set', `{ tcp_socket unix_stream_socket }')
|
|
|
|
#
|
|
# Unprivileged socket classes (exclude rawip, netlink, packet).
|
|
#
|
|
define(`unpriv_socket_class_set', `{ tcp_socket udp_socket unix_stream_socket unix_dgram_socket }')
|
|
|
|
########################################
|
|
#
|
|
# Macros for sets of permissions
|
|
#
|
|
|
|
#
|
|
# Permissions for getting file attributes.
|
|
#
|
|
define(`stat_file_perms', `{ getattr }')
|
|
|
|
#
|
|
# Permissions for executing files.
|
|
#
|
|
define(`x_file_perms', `{ getattr execute }')
|
|
|
|
#
|
|
# Permissions for reading files and their attributes.
|
|
#
|
|
define(`r_file_perms', `{ read getattr lock ioctl }')
|
|
|
|
#
|
|
# Permissions for reading and executing files.
|
|
#
|
|
define(`rx_file_perms', `{ read getattr lock execute ioctl }')
|
|
|
|
#
|
|
# Permissions for reading and appending to files.
|
|
#
|
|
define(`ra_file_perms', `{ ioctl read getattr lock append }')
|
|
|
|
#
|
|
# Permissions for linking, unlinking and renaming files.
|
|
#
|
|
define(`link_file_perms', `{ getattr link unlink rename }')
|
|
|
|
#
|
|
# Permissions for creating lnk_files.
|
|
#
|
|
define(`create_lnk_perms', `{ create read getattr setattr link unlink rename }')
|
|
|
|
#
|
|
# Permissions for creating and using files.
|
|
#
|
|
define(`create_file_perms', `{ create ioctl read getattr lock write setattr append link unlink rename }')
|
|
|
|
#
|
|
# Permissions for reading directories and their attributes.
|
|
#
|
|
define(`r_dir_perms', `{ read getattr lock search ioctl }')
|
|
|
|
#
|
|
# Permissions for reading and writing directories and their attributes.
|
|
#
|
|
define(`rw_dir_perms', `{ read getattr lock search ioctl add_name remove_name write }')
|
|
|
|
#
|
|
# Permissions for reading and adding names to directories.
|
|
#
|
|
define(`ra_dir_perms', `{ read getattr lock search ioctl add_name write }')
|
|
|
|
|
|
#
|
|
# Permissions for creating and using directories.
|
|
#
|
|
define(`create_dir_perms', `{ create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir }')
|
|
|
|
#
|
|
# Permissions to mount and unmount file systems.
|
|
#
|
|
define(`mount_fs_perms', `{ mount remount unmount getattr }')
|
|
|
|
#
|
|
# Permissions for using sockets.
|
|
#
|
|
define(`rw_socket_perms', `{ ioctl read getattr write setattr append bind connect getopt setopt shutdown }')
|
|
|
|
#
|
|
# Permissions for creating and using sockets.
|
|
#
|
|
define(`create_socket_perms', `{ create rw_socket_perms }')
|
|
|
|
#
|
|
# Permissions for using stream sockets.
|
|
#
|
|
define(`rw_stream_socket_perms', `{ rw_socket_perms listen accept }')
|
|
|
|
#
|
|
# Permissions for creating and using stream sockets.
|
|
#
|
|
define(`create_stream_socket_perms', `{ create_socket_perms listen accept }')
|
|
|
|
#
|
|
# Permissions for creating and using sockets.
|
|
#
|
|
define(`connected_socket_perms', `{ create ioctl read getattr write setattr append bind getopt setopt shutdown }')
|
|
|
|
#
|
|
# Permissions for creating and using sockets.
|
|
#
|
|
define(`connected_stream_socket_perms', `{ connected_socket_perms listen accept }')
|
|
|
|
|
|
#
|
|
# Permissions for creating and using netlink sockets.
|
|
#
|
|
define(`create_netlink_socket_perms', `{ create_socket_perms nlmsg_read nlmsg_write }')
|
|
|
|
#
|
|
# Permissions for using netlink sockets for operations that modify state.
|
|
#
|
|
define(`rw_netlink_socket_perms', `{ create_socket_perms nlmsg_read nlmsg_write }')
|
|
|
|
#
|
|
# Permissions for using netlink sockets for operations that observe state.
|
|
#
|
|
define(`r_netlink_socket_perms', `{ create_socket_perms nlmsg_read }')
|
|
|
|
#
|
|
# Permissions for sending all signals.
|
|
#
|
|
define(`signal_perms', `{ sigchld sigkill sigstop signull signal }')
|
|
|
|
#
|
|
# Permissions for sending and receiving network packets.
|
|
#
|
|
define(`packet_perms', `{ tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send }')
|
|
|
|
#
|
|
# Permissions for using System V IPC
|
|
#
|
|
define(`r_sem_perms', `{ associate getattr read unix_read }')
|
|
define(`rw_sem_perms', `{ associate getattr read write unix_read unix_write }')
|
|
define(`create_sem_perms', `{ associate getattr setattr create destroy read write unix_read unix_write }')
|
|
define(`r_msgq_perms', `{ associate getattr read unix_read }')
|
|
define(`rw_msgq_perms', `{ associate getattr read write enqueue unix_read unix_write }')
|
|
define(`create_msgq_perms', `{ associate getattr setattr create destroy read write enqueue unix_read unix_write }')
|
|
define(`r_shm_perms', `{ associate getattr read unix_read }')
|
|
define(`rw_shm_perms', `{ associate getattr read write lock unix_read unix_write }')
|
|
define(`create_shm_perms', `{ associate getattr setattr create destroy read write lock unix_read unix_write }')
|
|
|
|
########################################
|
|
#
|
|
# New permission sets
|
|
#
|
|
|
|
#
|
|
# Directory
|
|
#
|
|
define(`search_dir_perms',`{ getattr search }')
|
|
define(`getattr_dir_perms',`{ getattr }')
|
|
define(`setattr_dir_perms',`{ setattr }')
|
|
define(`list_dir_perms',`{ getattr search read lock ioctl }')
|
|
define(`add_entry_dir_perms',`{ getattr search lock ioctl write add_name }')
|
|
define(`del_entry_dir_perms',`{ getattr search lock ioctl write remove_name }')
|
|
define(`manage_dir_perms',`{ create getattr setattr read write link unlink rename search add_name remove_name reparent rmdir lock ioctl }')
|
|
|
|
#
|
|
# File
|
|
#
|
|
define(`getattr_file_perms',`{ getattr }')
|
|
define(`setattr_file_perms',`{ setattr }')
|
|
define(`read_file_perms',`{ getattr read lock ioctl }')
|
|
define(`append_file_perms',`{ getattr append lock ioctl }')
|
|
define(`write_file_perms',`{ getattr write append lock ioctl }')
|
|
define(`rw_file_perms', `{ getattr read write append ioctl lock }')
|
|
define(`manage_file_perms',`{ create getattr setattr read write append rename link unlink ioctl lock }')
|
|
|
|
#
|
|
# Use (read and write) terminals
|
|
#
|
|
define(`rw_term_perms', `{ getattr read write ioctl }')
|
|
|
|
########################################
|
|
#
|
|
# Expand object class set macros.
|
|
#
|
|
# gen_require_set(permissions,object_class_set)
|
|
#
|
|
# the statement:
|
|
# gen_require_set({ getattr read },{ foo bar tar })
|
|
#
|
|
# makes:
|
|
# class foo { getattr read };
|
|
# class bar { getattr read };
|
|
# class tar { getattr read };
|
|
#
|
|
# !! This is only used in require blocks. !!
|
|
|
|
define(`gen_require_set',`
|
|
ifelse(regexp($2, `\w'), -1, `', `dnl
|
|
class regexp($2, `\(\w+\)', `\1') $1;
|
|
gen_require_set($1, regexp($2, `\w+\(.*\)', `\1'))dnl
|
|
') dnl
|
|
')
|