1602a6c2ec
As part of on ongoing effort to perform more automated testing and provide more tools for individual developers to validate their patches before submitting, we are trying to make our code "clang-format clean". My hope is that once we have fixed all of our style "quirks", developers will be able to run clang-format on their patches to help avoid silly formatting problems and ensure their changes fit in well with the rest of the SELinux kernel code. Signed-off-by: Paul Moore <paul@paul-moore.com>
85 lines
2.4 KiB
C
85 lines
2.4 KiB
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/* Authors: Karl MacMillan <kmacmillan@tresys.com>
|
|
* Frank Mayer <mayerf@tresys.com>
|
|
* Copyright (C) 2003 - 2004 Tresys Technology, LLC
|
|
*/
|
|
|
|
#ifndef _CONDITIONAL_H_
|
|
#define _CONDITIONAL_H_
|
|
|
|
#include "avtab.h"
|
|
#include "symtab.h"
|
|
#include "policydb.h"
|
|
#include "../include/conditional.h"
|
|
|
|
#define COND_EXPR_MAXDEPTH 10
|
|
|
|
/*
|
|
* A conditional expression is a list of operators and operands
|
|
* in reverse polish notation.
|
|
*/
|
|
struct cond_expr_node {
|
|
#define COND_BOOL 1 /* plain bool */
|
|
#define COND_NOT 2 /* !bool */
|
|
#define COND_OR 3 /* bool || bool */
|
|
#define COND_AND 4 /* bool && bool */
|
|
#define COND_XOR 5 /* bool ^ bool */
|
|
#define COND_EQ 6 /* bool == bool */
|
|
#define COND_NEQ 7 /* bool != bool */
|
|
#define COND_LAST COND_NEQ
|
|
u32 expr_type;
|
|
u32 boolean;
|
|
};
|
|
|
|
struct cond_expr {
|
|
struct cond_expr_node *nodes;
|
|
u32 len;
|
|
};
|
|
|
|
/*
|
|
* Each cond_node contains a list of rules to be enabled/disabled
|
|
* depending on the current value of the conditional expression. This
|
|
* struct is for that list.
|
|
*/
|
|
struct cond_av_list {
|
|
struct avtab_node **nodes;
|
|
u32 len;
|
|
};
|
|
|
|
/*
|
|
* A cond node represents a conditional block in a policy. It
|
|
* contains a conditional expression, the current state of the expression,
|
|
* two lists of rules to enable/disable depending on the value of the
|
|
* expression (the true list corresponds to if and the false list corresponds
|
|
* to else)..
|
|
*/
|
|
struct cond_node {
|
|
int cur_state;
|
|
struct cond_expr expr;
|
|
struct cond_av_list true_list;
|
|
struct cond_av_list false_list;
|
|
};
|
|
|
|
void cond_policydb_init(struct policydb *p);
|
|
void cond_policydb_destroy(struct policydb *p);
|
|
|
|
int cond_init_bool_indexes(struct policydb *p);
|
|
int cond_destroy_bool(void *key, void *datum, void *p);
|
|
|
|
int cond_index_bool(void *key, void *datum, void *datap);
|
|
|
|
int cond_read_bool(struct policydb *p, struct symtab *s, void *fp);
|
|
int cond_read_list(struct policydb *p, void *fp);
|
|
int cond_write_bool(void *key, void *datum, void *ptr);
|
|
int cond_write_list(struct policydb *p, void *fp);
|
|
|
|
void cond_compute_av(struct avtab *ctab, struct avtab_key *key,
|
|
struct av_decision *avd, struct extended_perms *xperms);
|
|
void cond_compute_xperms(struct avtab *ctab, struct avtab_key *key,
|
|
struct extended_perms_decision *xpermd);
|
|
void evaluate_cond_nodes(struct policydb *p);
|
|
void cond_policydb_destroy_dup(struct policydb *p);
|
|
int cond_policydb_dup(struct policydb *new, struct policydb *orig);
|
|
|
|
#endif /* _CONDITIONAL_H_ */
|