security/selinux/ss/context.h

   1 /*
   2  * A security context is a set of security attributes
   3  * associated with each subject and object controlled
   4  * by the security policy.  Security contexts are
   5   * externally represented as variable-length strings
   6  * that can be interpreted by a user or application
   7  * with an understanding of the security policy.
   8  * Internally, the security server uses a simple
   9  * structure.  This structure is private to the
  10  * security server and can be changed without affecting
  11  * clients of the security server.
  12  *
  13  * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
  14  */
  15 #ifndef _SS_CONTEXT_H_
  16 #define _SS_CONTEXT_H_
  17
  18 #include "ebitmap.h"
  19 #include "mls_types.h"
  20
  21 /*
  22  * A security context consists of an authenticated user
  23  * identity, a role, a type and a MLS range.
  24  */
  25 struct context {
  26         u32 user;
  27         u32 role;
  28         u32 type;
  29 #ifdef CONFIG_SECURITY_SELINUX_MLS
  30         struct mls_range range;
  31 #endif
  32 };
  33
  34 #ifdef CONFIG_SECURITY_SELINUX_MLS
  35
  36 static inline void mls_context_init(struct context *c)
  37 {
  38         memset(&c->range, 0, sizeof(c->range));
  39 }
  40
  41 static inline int mls_context_cpy(struct context *dst, struct context *src)
  42 {
  43         int rc;
  44
  45         dst->range.level[0].sens = src->range.level[0].sens;
  46         rc = ebitmap_cpy(&dst->range.level[0].cat, &src->range.level[0].cat);
  47         if (rc)
  48                 goto out;
  49
  50         dst->range.level[1].sens = src->range.level[1].sens;
  51         rc = ebitmap_cpy(&dst->range.level[1].cat, &src->range.level[1].cat);
  52         if (rc)
  53                 ebitmap_destroy(&dst->range.level[0].cat);
  54 out:
  55         return rc;
  56 }
  57
  58 static inline int mls_context_cmp(struct context *c1, struct context *c2)
  59 {
  60         return ((c1->range.level[0].sens == c2->range.level[0].sens) &&
  61                 ebitmap_cmp(&c1->range.level[0].cat,&c2->range.level[0].cat) &&
  62                 (c1->range.level[1].sens == c2->range.level[1].sens) &&
  63                 ebitmap_cmp(&c1->range.level[1].cat,&c2->range.level[1].cat));
  64 }
  65
  66 static inline void mls_context_destroy(struct context *c)
  67 {
  68         ebitmap_destroy(&c->range.level[0].cat);
  69         ebitmap_destroy(&c->range.level[1].cat);
  70         mls_context_init(c);
  71 }
  72
  73 #else
  74
  75 static inline void mls_context_init(struct context *c)
  76 { }
  77
  78 static inline int mls_context_cpy(struct context *dst, struct context *src)
  79 { return 0; }
  80
  81 static inline int mls_context_cmp(struct context *c1, struct context *c2)
  82 { return 1; }
  83
  84 static inline void mls_context_destroy(struct context *c)
  85 { }
  86
  87 #endif
  88
  89 static inline void context_init(struct context *c)
  90 {
  91         memset(c, 0, sizeof(*c));
  92 }
  93
  94 static inline int context_cpy(struct context *dst, struct context *src)
  95 {
  96         dst->user = src->user;
  97         dst->role = src->role;
  98         dst->type = src->type;
  99         return mls_context_cpy(dst, src);
 100 }
 101
 102 static inline void context_destroy(struct context *c)
 103 {
 104         c->user = c->role = c->type = 0;
 105         mls_context_destroy(c);
 106 }
 107
 108 static inline int context_cmp(struct context *c1, struct context *c2)
 109 {
 110         return ((c1->user == c2->user) &&
 111                 (c1->role == c2->role) &&
 112                 (c1->type == c2->type) &&
 113                 mls_context_cmp(c1, c2));
 114 }
 115
 116 #endif  /* _SS_CONTEXT_H_ */
 117