constraint.h 2.1 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162
  1. /*
  2. * A constraint is a condition that must be satisfied in
  3. * order for one or more permissions to be granted.
  4. * Constraints are used to impose additional restrictions
  5. * beyond the type-based rules in `te' or the role-based
  6. * transition rules in `rbac'. Constraints are typically
  7. * used to prevent a process from transitioning to a new user
  8. * identity or role unless it is in a privileged type.
  9. * Constraints are likewise typically used to prevent a
  10. * process from labeling an object with a different user
  11. * identity.
  12. *
  13. * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
  14. */
  15. #ifndef _SS_CONSTRAINT_H_
  16. #define _SS_CONSTRAINT_H_
  17. #include "ebitmap.h"
  18. #define CEXPR_MAXDEPTH 5
  19. struct constraint_expr {
  20. #define CEXPR_NOT 1 /* not expr */
  21. #define CEXPR_AND 2 /* expr and expr */
  22. #define CEXPR_OR 3 /* expr or expr */
  23. #define CEXPR_ATTR 4 /* attr op attr */
  24. #define CEXPR_NAMES 5 /* attr op names */
  25. u32 expr_type; /* expression type */
  26. #define CEXPR_USER 1 /* user */
  27. #define CEXPR_ROLE 2 /* role */
  28. #define CEXPR_TYPE 4 /* type */
  29. #define CEXPR_TARGET 8 /* target if set, source otherwise */
  30. #define CEXPR_XTARGET 16 /* special 3rd target for validatetrans rule */
  31. #define CEXPR_L1L2 32 /* low level 1 vs. low level 2 */
  32. #define CEXPR_L1H2 64 /* low level 1 vs. high level 2 */
  33. #define CEXPR_H1L2 128 /* high level 1 vs. low level 2 */
  34. #define CEXPR_H1H2 256 /* high level 1 vs. high level 2 */
  35. #define CEXPR_L1H1 512 /* low level 1 vs. high level 1 */
  36. #define CEXPR_L2H2 1024 /* low level 2 vs. high level 2 */
  37. u32 attr; /* attribute */
  38. #define CEXPR_EQ 1 /* == or eq */
  39. #define CEXPR_NEQ 2 /* != */
  40. #define CEXPR_DOM 3 /* dom */
  41. #define CEXPR_DOMBY 4 /* domby */
  42. #define CEXPR_INCOMP 5 /* incomp */
  43. u32 op; /* operator */
  44. struct ebitmap names; /* names */
  45. struct type_set *type_names;
  46. struct constraint_expr *next; /* next expression */
  47. };
  48. struct constraint_node {
  49. u32 permissions; /* constrained permissions */
  50. struct constraint_expr *expr; /* constraint on permissions */
  51. struct constraint_node *next; /* next constraint */
  52. };
  53. #endif /* _SS_CONSTRAINT_H_ */