Commit 4bc6c2d5 authored by Harry Ciao's avatar Harry Ciao Committed by Eric Paris

SELinux: Auto-generate security_is_socket_class

The security_is_socket_class() is auto-generated by genheaders based
on classmap.h to reduce maintenance effort when a new class is defined
in SELinux kernel. The name for any socket class should be suffixed by
"socket" and doesn't contain more than one substr of "socket".
Signed-off-by: default avatarHarry Ciao <qingtao.cao@windriver.com>
Signed-off-by: default avatarEric Paris <eparis@redhat.com>
Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
parent 0b24dcb7
...@@ -43,6 +43,8 @@ int main(int argc, char *argv[]) ...@@ -43,6 +43,8 @@ int main(int argc, char *argv[])
int i, j, k; int i, j, k;
int isids_len; int isids_len;
FILE *fout; FILE *fout;
const char *needle = "SOCKET";
char *substr;
progname = argv[0]; progname = argv[0];
...@@ -88,6 +90,24 @@ int main(int argc, char *argv[]) ...@@ -88,6 +90,24 @@ int main(int argc, char *argv[])
fprintf(fout, "%2d\n", i); fprintf(fout, "%2d\n", i);
} }
fprintf(fout, "\n#define SECINITSID_NUM %d\n", i-1); fprintf(fout, "\n#define SECINITSID_NUM %d\n", i-1);
fprintf(fout, "\nstatic inline bool security_is_socket_class(u16 kern_tclass)\n");
fprintf(fout, "{\n");
fprintf(fout, "\tbool sock = false;\n\n");
fprintf(fout, "\tswitch (kern_tclass) {\n");
for (i = 0; secclass_map[i].name; i++) {
struct security_class_mapping *map = &secclass_map[i];
substr = strstr(map->name, needle);
if (substr && strcmp(substr, needle) == 0)
fprintf(fout, "\tcase SECCLASS_%s:\n", map->name);
}
fprintf(fout, "\t\tsock = true;\n");
fprintf(fout, "\t\tbreak;\n");
fprintf(fout, "\tdefault:\n");
fprintf(fout, "\t\tbreak;\n");
fprintf(fout, "\t}\n\n");
fprintf(fout, "\treturn sock;\n");
fprintf(fout, "}\n");
fprintf(fout, "\n#endif\n"); fprintf(fout, "\n#endif\n");
fclose(fout); fclose(fout);
......
...@@ -12,6 +12,10 @@ ...@@ -12,6 +12,10 @@
#define COMMON_IPC_PERMS "create", "destroy", "getattr", "setattr", "read", \ #define COMMON_IPC_PERMS "create", "destroy", "getattr", "setattr", "read", \
"write", "associate", "unix_read", "unix_write" "write", "associate", "unix_read", "unix_write"
/*
* Note: The name for any socket class should be suffixed by "socket",
* and doesn't contain more than one substr of "socket".
*/
struct security_class_mapping secclass_map[] = { struct security_class_mapping secclass_map[] = {
{ "security", { "security",
{ "compute_av", "compute_create", "compute_member", { "compute_av", "compute_create", "compute_member",
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment