diff options
| author | Harry Ciao <qingtao.cao@windriver.com> | 2011-03-02 13:46:08 +0800 |
|---|---|---|
| committer | Eric Paris <eparis@redhat.com> | 2011-03-03 15:19:43 -0500 |
| commit | 4bc6c2d5d8386800fde23a8e78cd4f04a0ade0ad (patch) | |
| tree | 9ed72f305050b876d846b44ccf13f63fcbab1ff4 | |
| parent | 0b24dcb7f2f7a0ce9b762eef0362c21c88f47b32 (diff) | |
| download | lwn-4bc6c2d5d8386800fde23a8e78cd4f04a0ade0ad.tar.gz lwn-4bc6c2d5d8386800fde23a8e78cd4f04a0ade0ad.zip | |
SELinux: Auto-generate security_is_socket_class
The security_is_socket_class() is auto-generated by genheaders based
on classmap.h to reduce maintenance effort when a new class is defined
in SELinux kernel. The name for any socket class should be suffixed by
"socket" and doesn't contain more than one substr of "socket".
Signed-off-by: Harry Ciao <qingtao.cao@windriver.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
| -rw-r--r-- | scripts/selinux/genheaders/genheaders.c | 20 | ||||
| -rw-r--r-- | security/selinux/include/classmap.h | 4 |
2 files changed, 24 insertions, 0 deletions
diff --git a/scripts/selinux/genheaders/genheaders.c b/scripts/selinux/genheaders/genheaders.c index 58a12c278706..539855ff31f9 100644 --- a/scripts/selinux/genheaders/genheaders.c +++ b/scripts/selinux/genheaders/genheaders.c @@ -43,6 +43,8 @@ int main(int argc, char *argv[]) int i, j, k; int isids_len; FILE *fout; + const char *needle = "SOCKET"; + char *substr; progname = argv[0]; @@ -88,6 +90,24 @@ int main(int argc, char *argv[]) fprintf(fout, "%2d\n", i); } fprintf(fout, "\n#define SECINITSID_NUM %d\n", i-1); + fprintf(fout, "\nstatic inline bool security_is_socket_class(u16 kern_tclass)\n"); + fprintf(fout, "{\n"); + fprintf(fout, "\tbool sock = false;\n\n"); + fprintf(fout, "\tswitch (kern_tclass) {\n"); + for (i = 0; secclass_map[i].name; i++) { + struct security_class_mapping *map = &secclass_map[i]; + substr = strstr(map->name, needle); + if (substr && strcmp(substr, needle) == 0) + fprintf(fout, "\tcase SECCLASS_%s:\n", map->name); + } + fprintf(fout, "\t\tsock = true;\n"); + fprintf(fout, "\t\tbreak;\n"); + fprintf(fout, "\tdefault:\n"); + fprintf(fout, "\t\tbreak;\n"); + fprintf(fout, "\t}\n\n"); + fprintf(fout, "\treturn sock;\n"); + fprintf(fout, "}\n"); + fprintf(fout, "\n#endif\n"); fclose(fout); diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index 4227e5fa7861..b8c53723e09b 100644 --- a/security/selinux/include/classmap.h +++ b/security/selinux/include/classmap.h @@ -12,6 +12,10 @@ #define COMMON_IPC_PERMS "create", "destroy", "getattr", "setattr", "read", \ "write", "associate", "unix_read", "unix_write" +/* + * Note: The name for any socket class should be suffixed by "socket", + * and doesn't contain more than one substr of "socket". + */ struct security_class_mapping secclass_map[] = { { "security", { "compute_av", "compute_create", "compute_member", |