lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SELinux: Auto-generate security_is_socket_class

Browse Source 
The security_is_socket_class() is auto-generated by genheaders based
on classmap.h to reduce maintenance effort when a new class is defined
in SELinux kernel. The name for any socket class should be suffixed by
"socket" and doesn't contain more than one substr of "socket".

Signed-off-by: Harry Ciao <qingtao.cao@windriver.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
This commit is contained in:
Harry Ciao
2011-03-02 13:46:08 +08:00
committed by Eric Paris
parent 0b24dcb7f2
commit 4bc6c2d5d8
2 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
scripts/selinux/genheaders/genheaders.c
View File

@@ -43,6 +43,8 @@ int main(int argc, char *argv[])
int i, j, k; int i, j, k;
int isids_len; int isids_len;
FILE *fout; FILE *fout;
const char *needle = "SOCKET";
char *substr;
progname = argv[0]; progname = argv[0];
@@ -88,6 +90,24 @@ int main(int argc, char *argv[])
fprintf(fout, "%2d\n", i); fprintf(fout, "%2d\n", i);
} }
fprintf(fout, "\n#define SECINITSID_NUM %d\n", i-1); fprintf(fout, "\n#define SECINITSID_NUM %d\n", i-1);
fprintf(fout, "\nstatic inline bool security_is_socket_class(u16 kern_tclass)\n");
fprintf(fout, "{\n");
fprintf(fout, "\tbool sock = false;\n\n");
fprintf(fout, "\tswitch (kern_tclass) {\n");
for (i = 0; secclass_map[i].name; i++) {
struct security_class_mapping *map = &secclass_map[i];
substr = strstr(map->name, needle);
if (substr && strcmp(substr, needle) == 0)
fprintf(fout, "\tcase SECCLASS_%s:\n", map->name);
}
fprintf(fout, "\t\tsock = true;\n");
fprintf(fout, "\t\tbreak;\n");
fprintf(fout, "\tdefault:\n");
fprintf(fout, "\t\tbreak;\n");
fprintf(fout, "\t}\n\n");
fprintf(fout, "\treturn sock;\n");
fprintf(fout, "}\n");
fprintf(fout, "\n#endif\n"); fprintf(fout, "\n#endif\n");
fclose(fout); fclose(fout);

4
security/selinux/include/classmap.h
View File

@@ -12,6 +12,10 @@
#define COMMON_IPC_PERMS "create", "destroy", "getattr", "setattr", "read", \ #define COMMON_IPC_PERMS "create", "destroy", "getattr", "setattr", "read", \
"write", "associate", "unix_read", "unix_write" "write", "associate", "unix_read", "unix_write"
/*
* Note: The name for any socket class should be suffixed by "socket",
* and doesn't contain more than one substr of "socket".
*/
struct security_class_mapping secclass_map[] = { struct security_class_mapping secclass_map[] = {
{ "security", { "security",
{ "compute_av", "compute_create", "compute_member", { "compute_av", "compute_create", "compute_member",