1 /*
2  * Copyright 2011 Tresys Technology, LLC. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions are met:
6  *
7  *    1. Redistributions of source code must retain the above copyright notice,
8  *       this list of conditions and the following disclaimer.
9  *
10  *    2. Redistributions in binary form must reproduce the above copyright notice,
11  *       this list of conditions and the following disclaimer in the documentation
12  *       and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY TRESYS TECHNOLOGY, LLC ``AS IS'' AND ANY EXPRESS
15  * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
16  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
17  * EVENT SHALL TRESYS TECHNOLOGY, LLC OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
18  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
19  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
21  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
22  * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
23  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  *
25  * The views and conclusions contained in the software and documentation are those
26  * of the authors and should not be interpreted as representing official policies,
27  * either expressed or implied, of Tresys Technology, LLC.
28  */
29 
30 #ifndef CIL_INTERNAL_H_
31 #define CIL_INTERNAL_H_
32 
33 #include <stdlib.h>
34 #include <stdio.h>
35 #include <stdint.h>
36 #include <arpa/inet.h>
37 
38 #include <sepol/policydb/services.h>
39 #include <sepol/policydb/policydb.h>
40 #include <sepol/policydb/flask_types.h>
41 
42 #include <cil/cil.h>
43 
44 #include "cil_flavor.h"
45 #include "cil_tree.h"
46 #include "cil_symtab.h"
47 #include "cil_mem.h"
48 
49 #define CIL_MAX_NAME_LENGTH 2048
50 
51 
52 enum cil_pass {
53 	CIL_PASS_INIT = 0,
54 
55 	CIL_PASS_TIF,
56 	CIL_PASS_IN,
57 	CIL_PASS_BLKIN_LINK,
58 	CIL_PASS_BLKIN_COPY,
59 	CIL_PASS_BLKABS,
60 	CIL_PASS_MACRO,
61 	CIL_PASS_CALL1,
62 	CIL_PASS_CALL2,
63 	CIL_PASS_ALIAS1,
64 	CIL_PASS_ALIAS2,
65 	CIL_PASS_MISC1,
66 	CIL_PASS_MLS,
67 	CIL_PASS_MISC2,
68 	CIL_PASS_MISC3,
69 
70 	CIL_PASS_NUM
71 };
72 
73 
74 /*
75 	Keywords
76 */
77 char *CIL_KEY_CONS_T1;
78 char *CIL_KEY_CONS_T2;
79 char *CIL_KEY_CONS_T3;
80 char *CIL_KEY_CONS_R1;
81 char *CIL_KEY_CONS_R2;
82 char *CIL_KEY_CONS_R3;
83 char *CIL_KEY_CONS_U1;
84 char *CIL_KEY_CONS_U2;
85 char *CIL_KEY_CONS_U3;
86 char *CIL_KEY_CONS_L1;
87 char *CIL_KEY_CONS_L2;
88 char *CIL_KEY_CONS_H1;
89 char *CIL_KEY_CONS_H2;
90 char *CIL_KEY_AND;
91 char *CIL_KEY_OR;
92 char *CIL_KEY_NOT;
93 char *CIL_KEY_EQ;
94 char *CIL_KEY_NEQ;
95 char *CIL_KEY_CONS_DOM;
96 char *CIL_KEY_CONS_DOMBY;
97 char *CIL_KEY_CONS_INCOMP;
98 char *CIL_KEY_CONDTRUE;
99 char *CIL_KEY_CONDFALSE;
100 char *CIL_KEY_SELF;
101 char *CIL_KEY_OBJECT_R;
102 char *CIL_KEY_STAR;
103 char *CIL_KEY_TCP;
104 char *CIL_KEY_UDP;
105 char *CIL_KEY_DCCP;
106 char *CIL_KEY_AUDITALLOW;
107 char *CIL_KEY_TUNABLEIF;
108 char *CIL_KEY_ALLOW;
109 char *CIL_KEY_DONTAUDIT;
110 char *CIL_KEY_TYPETRANSITION;
111 char *CIL_KEY_TYPECHANGE;
112 char *CIL_KEY_CALL;
113 char *CIL_KEY_TUNABLE;
114 char *CIL_KEY_XOR;
115 char *CIL_KEY_ALL;
116 char *CIL_KEY_RANGE;
117 char *CIL_KEY_GLOB;
118 char *CIL_KEY_FILE;
119 char *CIL_KEY_DIR;
120 char *CIL_KEY_CHAR;
121 char *CIL_KEY_BLOCK;
122 char *CIL_KEY_SOCKET;
123 char *CIL_KEY_PIPE;
124 char *CIL_KEY_SYMLINK;
125 char *CIL_KEY_ANY;
126 char *CIL_KEY_XATTR;
127 char *CIL_KEY_TASK;
128 char *CIL_KEY_TRANS;
129 char *CIL_KEY_TYPE;
130 char *CIL_KEY_ROLE;
131 char *CIL_KEY_USER;
132 char *CIL_KEY_USERATTRIBUTE;
133 char *CIL_KEY_USERATTRIBUTESET;
134 char *CIL_KEY_SENSITIVITY;
135 char *CIL_KEY_CATEGORY;
136 char *CIL_KEY_CATSET;
137 char *CIL_KEY_LEVEL;
138 char *CIL_KEY_LEVELRANGE;
139 char *CIL_KEY_CLASS;
140 char *CIL_KEY_IPADDR;
141 char *CIL_KEY_MAP_CLASS;
142 char *CIL_KEY_CLASSPERMISSION;
143 char *CIL_KEY_BOOL;
144 char *CIL_KEY_STRING;
145 char *CIL_KEY_NAME;
146 char *CIL_KEY_SOURCE;
147 char *CIL_KEY_TARGET;
148 char *CIL_KEY_LOW;
149 char *CIL_KEY_HIGH;
150 char *CIL_KEY_LOW_HIGH;
151 char *CIL_KEY_HANDLEUNKNOWN;
152 char *CIL_KEY_HANDLEUNKNOWN_ALLOW;
153 char *CIL_KEY_HANDLEUNKNOWN_DENY;
154 char *CIL_KEY_HANDLEUNKNOWN_REJECT;
155 char *CIL_KEY_MACRO;
156 char *CIL_KEY_IN;
157 char *CIL_KEY_MLS;
158 char *CIL_KEY_DEFAULTRANGE;
159 char *CIL_KEY_BLOCKINHERIT;
160 char *CIL_KEY_BLOCKABSTRACT;
161 char *CIL_KEY_CLASSORDER;
162 char *CIL_KEY_CLASSMAPPING;
163 char *CIL_KEY_CLASSPERMISSIONSET;
164 char *CIL_KEY_COMMON;
165 char *CIL_KEY_CLASSCOMMON;
166 char *CIL_KEY_SID;
167 char *CIL_KEY_SIDCONTEXT;
168 char *CIL_KEY_SIDORDER;
169 char *CIL_KEY_USERLEVEL;
170 char *CIL_KEY_USERRANGE;
171 char *CIL_KEY_USERBOUNDS;
172 char *CIL_KEY_USERPREFIX;
173 char *CIL_KEY_SELINUXUSER;
174 char *CIL_KEY_SELINUXUSERDEFAULT;
175 char *CIL_KEY_TYPEATTRIBUTE;
176 char *CIL_KEY_TYPEATTRIBUTESET;
177 char *CIL_KEY_TYPEALIAS;
178 char *CIL_KEY_TYPEALIASACTUAL;
179 char *CIL_KEY_TYPEBOUNDS;
180 char *CIL_KEY_TYPEPERMISSIVE;
181 char *CIL_KEY_RANGETRANSITION;
182 char *CIL_KEY_USERROLE;
183 char *CIL_KEY_ROLETYPE;
184 char *CIL_KEY_ROLETRANSITION;
185 char *CIL_KEY_ROLEALLOW;
186 char *CIL_KEY_ROLEATTRIBUTE;
187 char *CIL_KEY_ROLEATTRIBUTESET;
188 char *CIL_KEY_ROLEBOUNDS;
189 char *CIL_KEY_BOOLEANIF;
190 char *CIL_KEY_NEVERALLOW;
191 char *CIL_KEY_TYPEMEMBER;
192 char *CIL_KEY_SENSALIAS;
193 char *CIL_KEY_SENSALIASACTUAL;
194 char *CIL_KEY_CATALIAS;
195 char *CIL_KEY_CATALIASACTUAL;
196 char *CIL_KEY_CATORDER;
197 char *CIL_KEY_SENSITIVITYORDER;
198 char *CIL_KEY_SENSCAT;
199 char *CIL_KEY_CONSTRAIN;
200 char *CIL_KEY_MLSCONSTRAIN;
201 char *CIL_KEY_VALIDATETRANS;
202 char *CIL_KEY_MLSVALIDATETRANS;
203 char *CIL_KEY_CONTEXT;
204 char *CIL_KEY_FILECON;
205 char *CIL_KEY_PORTCON;
206 char *CIL_KEY_NODECON;
207 char *CIL_KEY_GENFSCON;
208 char *CIL_KEY_NETIFCON;
209 char *CIL_KEY_PIRQCON;
210 char *CIL_KEY_IOMEMCON;
211 char *CIL_KEY_IOPORTCON;
212 char *CIL_KEY_PCIDEVICECON;
213 char *CIL_KEY_DEVICETREECON;
214 char *CIL_KEY_FSUSE;
215 char *CIL_KEY_POLICYCAP;
216 char *CIL_KEY_OPTIONAL;
217 char *CIL_KEY_DEFAULTUSER;
218 char *CIL_KEY_DEFAULTROLE;
219 char *CIL_KEY_DEFAULTTYPE;
220 char *CIL_KEY_ROOT;
221 char *CIL_KEY_NODE;
222 char *CIL_KEY_PERM;
223 char *CIL_KEY_ALLOWX;
224 char *CIL_KEY_AUDITALLOWX;
225 char *CIL_KEY_DONTAUDITX;
226 char *CIL_KEY_NEVERALLOWX;
227 char *CIL_KEY_PERMISSIONX;
228 char *CIL_KEY_IOCTL;
229 char *CIL_KEY_UNORDERED;
230 char *CIL_KEY_SRC_INFO;
231 char *CIL_KEY_SRC_CIL;
232 char *CIL_KEY_SRC_HLL;
233 
234 /*
235 	Symbol Table Array Indices
236 */
237 enum cil_sym_index {
238 	CIL_SYM_BLOCKS = 0,
239 	CIL_SYM_USERS,
240 	CIL_SYM_ROLES,
241 	CIL_SYM_TYPES,
242 	CIL_SYM_COMMONS,
243 	CIL_SYM_CLASSES,
244 	CIL_SYM_CLASSPERMSETS,
245 	CIL_SYM_BOOLS,
246 	CIL_SYM_TUNABLES,
247 	CIL_SYM_SENS,
248 	CIL_SYM_CATS,
249 	CIL_SYM_SIDS,
250 	CIL_SYM_CONTEXTS,
251 	CIL_SYM_LEVELS,
252 	CIL_SYM_LEVELRANGES,
253 	CIL_SYM_POLICYCAPS,
254 	CIL_SYM_IPADDRS,
255 	CIL_SYM_NAMES,
256 	CIL_SYM_PERMX,
257 	CIL_SYM_NUM,
258 	CIL_SYM_UNKNOWN,
259 	CIL_SYM_PERMS	// Special case for permissions. This symtab is not included in arrays
260 };
261 
262 enum cil_sym_array {
263 	CIL_SYM_ARRAY_ROOT = 0,
264 	CIL_SYM_ARRAY_BLOCK,
265 	CIL_SYM_ARRAY_IN,
266 	CIL_SYM_ARRAY_MACRO,
267 	CIL_SYM_ARRAY_CONDBLOCK,
268 	CIL_SYM_ARRAY_NUM
269 };
270 
271 extern int cil_sym_sizes[CIL_SYM_ARRAY_NUM][CIL_SYM_NUM];
272 
273 #define CIL_CLASS_SYM_SIZE	256
274 #define CIL_PERMS_PER_CLASS (sizeof(sepol_access_vector_t) * 8)
275 
276 struct cil_db {
277 	struct cil_tree *parse;
278 	struct cil_tree *ast;
279 	struct cil_type *selftype;
280 	struct cil_list *sidorder;
281 	struct cil_list *classorder;
282 	struct cil_list *catorder;
283 	struct cil_list *sensitivityorder;
284 	struct cil_sort *netifcon;
285 	struct cil_sort *genfscon;
286 	struct cil_sort *filecon;
287 	struct cil_sort *nodecon;
288 	struct cil_sort *portcon;
289 	struct cil_sort *pirqcon;
290 	struct cil_sort *iomemcon;
291 	struct cil_sort *ioportcon;
292 	struct cil_sort *pcidevicecon;
293 	struct cil_sort *devicetreecon;
294 	struct cil_sort *fsuse;
295 	struct cil_list *userprefixes;
296 	struct cil_list *selinuxusers;
297 	struct cil_list *names;
298 	int num_types_and_attrs;
299 	int num_classes;
300 	int num_cats;
301 	int num_types;
302 	int num_roles;
303 	int num_users;
304 	struct cil_type **val_to_type;
305 	struct cil_role **val_to_role;
306 	struct cil_user **val_to_user;
307 	int disable_dontaudit;
308 	int disable_neverallow;
309 	int attrs_expand_generated;
310 	unsigned attrs_expand_size;
311 	int preserve_tunables;
312 	int handle_unknown;
313 	int mls;
314 	int target_platform;
315 	int policy_version;
316 };
317 
318 struct cil_root {
319 	symtab_t symtab[CIL_SYM_NUM];
320 };
321 
322 struct cil_sort {
323 	enum cil_flavor flavor;
324 	uint32_t count;
325 	uint32_t index;
326 	void **array;
327 };
328 
329 struct cil_block {
330 	struct cil_symtab_datum datum;
331 	symtab_t symtab[CIL_SYM_NUM];
332 	uint16_t is_abstract;
333 	struct cil_list *bi_nodes;
334 };
335 
336 struct cil_blockinherit {
337 	char *block_str;
338 	struct cil_block *block;
339 };
340 
341 struct cil_blockabstract {
342 	char *block_str;
343 };
344 
345 struct cil_in {
346 	symtab_t symtab[CIL_SYM_NUM];
347 	char *block_str;
348 };
349 
350 struct cil_optional {
351 	struct cil_symtab_datum datum;
352 	int enabled;
353 };
354 
355 struct cil_perm {
356 	struct cil_symtab_datum datum;
357 	unsigned int value;
358 	struct cil_list *classperms; /* Only used for map perms */
359 };
360 
361 struct cil_class {
362 	struct cil_symtab_datum datum;
363 	symtab_t perms;
364 	unsigned int num_perms;
365 	struct cil_class *common; /* Only used for kernel class */
366 	uint32_t ordered; /* Only used for kernel class */
367 };
368 
369 struct cil_classorder {
370 	struct cil_list *class_list_str;
371 };
372 
373 struct cil_classperms_set {
374 	char *set_str;
375 	struct cil_classpermission *set;
376 };
377 
378 struct cil_classperms {
379 	char *class_str;
380 	struct cil_class *class;
381 	struct cil_list *perm_strs;
382 	struct cil_list *perms;
383 };
384 
385 struct cil_classpermission {
386 	struct cil_symtab_datum datum;
387 	struct cil_list *classperms;
388 };
389 
390 struct cil_classpermissionset {
391 	char *set_str;
392 	struct cil_list *classperms;
393 };
394 
395 struct cil_classmapping {
396 	char *map_class_str;
397 	char *map_perm_str;
398 	struct cil_list *classperms;
399 };
400 
401 struct cil_classcommon {
402 	char *class_str;
403 	char *common_str;
404 };
405 
406 struct cil_alias {
407 	struct cil_symtab_datum datum;
408 	void *actual;
409 };
410 
411 struct cil_aliasactual {
412 	char *alias_str;
413 	char *actual_str;
414 };
415 
416 struct cil_sid {
417 	struct cil_symtab_datum datum;
418 	struct cil_context *context;
419 	uint32_t ordered;
420 };
421 
422 struct cil_sidcontext {
423 	char *sid_str;
424 	char *context_str;
425 	struct cil_context *context;
426 };
427 
428 struct cil_sidorder {
429 	struct cil_list *sid_list_str;
430 };
431 
432 struct cil_user {
433 	struct cil_symtab_datum datum;
434 	struct cil_user *bounds;
435 	ebitmap_t *roles;
436 	struct cil_level *dftlevel;
437 	struct cil_levelrange *range;
438 	int value;
439 };
440 
441 struct cil_userattribute {
442 	struct cil_symtab_datum datum;
443 	struct cil_list *expr_list;
444 	ebitmap_t *users;
445 };
446 
447 struct cil_userattributeset {
448 	char *attr_str;
449 	struct cil_list *str_expr;
450 	struct cil_list *datum_expr;
451 };
452 
453 struct cil_userrole {
454 	char *user_str;
455 	void *user;
456 	char *role_str;
457 	void *role;
458 };
459 
460 struct cil_userlevel {
461 	char *user_str;
462 	char *level_str;
463 	struct cil_level *level;
464 };
465 
466 struct cil_userrange {
467 	char *user_str;
468 	char *range_str;
469 	struct cil_levelrange *range;
470 };
471 
472 struct cil_userprefix {
473 	char *user_str;
474 	struct cil_user *user;
475 	char *prefix_str;
476 };
477 
478 struct cil_selinuxuser {
479 	char *name_str;
480 	char *user_str;
481 	struct cil_user *user;
482 	char *range_str;
483 	struct cil_levelrange *range;
484 };
485 
486 struct cil_role {
487 	struct cil_symtab_datum datum;
488 	struct cil_role *bounds;
489 	ebitmap_t *types;
490 	int value;
491 };
492 
493 struct cil_roleattribute {
494 	struct cil_symtab_datum datum;
495 	struct cil_list *expr_list;
496 	ebitmap_t *roles;
497 };
498 
499 struct cil_roleattributeset {
500 	char *attr_str;
501 	struct cil_list *str_expr;
502 	struct cil_list *datum_expr;
503 };
504 
505 struct cil_roletype {
506 	char *role_str;
507 	void *role; /* role or attribute */
508 	char *type_str;
509 	void *type; /* type, alias, or attribute */
510 };
511 
512 struct cil_type	{
513 	struct cil_symtab_datum datum;
514 	struct cil_type *bounds;
515 	int value;
516 };
517 
518 #define CIL_ATTR_AVRULE     0x01
519 #define CIL_ATTR_NEVERALLOW 0x02
520 #define CIL_ATTR_CONSTRAINT 0x04
521 struct cil_typeattribute {
522 	struct cil_symtab_datum datum;
523 	struct cil_list *expr_list;
524 	ebitmap_t *types;
525 	int used;	// whether or not this attribute was used in a binary policy rule
526 };
527 
528 struct cil_typeattributeset {
529 	char *attr_str;
530 	struct cil_list *str_expr;
531 	struct cil_list *datum_expr;
532 };
533 
534 struct cil_typepermissive {
535 	char *type_str;
536 	void *type; /* type or alias */
537 };
538 
539 struct cil_name {
540 	struct cil_symtab_datum datum;
541 	char *name_str;
542 };
543 
544 struct cil_nametypetransition {
545 	char *src_str;
546 	void *src; /* type, alias, or attribute */
547 	char *tgt_str;
548 	void *tgt; /* type, alias, or attribute */
549 	char *obj_str;
550 	struct cil_class *obj;
551 	char *name_str;
552 	struct cil_name *name;
553 	char *result_str;
554 	void *result; /* type or alias */
555 
556 };
557 
558 struct cil_rangetransition {
559 	char *src_str;
560 	void *src; /* type, alias, or attribute */
561 	char *exec_str;
562 	void *exec; /* type, alias, or attribute */
563 	char *obj_str;
564 	struct cil_class *obj;
565 	char *range_str;
566 	struct cil_levelrange *range;
567 };
568 
569 struct cil_bool {
570 	struct cil_symtab_datum datum;
571 	uint16_t value;
572 };
573 
574 struct cil_tunable {
575 	struct cil_symtab_datum datum;
576 	uint16_t value;
577 };
578 
579 #define CIL_AVRULE_ALLOWED     1
580 #define CIL_AVRULE_AUDITALLOW  2
581 #define CIL_AVRULE_DONTAUDIT   8
582 #define CIL_AVRULE_NEVERALLOW 128
583 #define CIL_AVRULE_AV         (AVRULE_ALLOWED | AVRULE_AUDITALLOW | AVRULE_DONTAUDIT | AVRULE_NEVERALLOW)
584 struct cil_avrule {
585 	int is_extended;
586 	uint32_t rule_kind;
587 	char *src_str;
588 	void *src; /* type, alias, or attribute */
589 	char *tgt_str;
590 	void *tgt; /* type, alias, or attribute */
591 	union {
592 		struct cil_list *classperms;
593 		struct {
594 			char *permx_str;
595 			struct cil_permissionx *permx;
596 		} x;
597 	} perms;
598 };
599 
600 #define CIL_PERMX_KIND_IOCTL 1
601 struct cil_permissionx {
602 	struct cil_symtab_datum datum;
603 	uint32_t kind;
604 	char *obj_str;
605 	struct cil_class *obj;
606 	struct cil_list *expr_str;
607 	ebitmap_t *perms;
608 };
609 
610 #define CIL_TYPE_TRANSITION 16
611 #define CIL_TYPE_MEMBER     32
612 #define CIL_TYPE_CHANGE     64
613 #define CIL_AVRULE_TYPE       (AVRULE_TRANSITION | AVRULE_MEMBER | AVRULE_CHANGE)
614 struct cil_type_rule {
615 	uint32_t rule_kind;
616 	char *src_str;
617 	void *src; /* type, alias, or attribute */
618 	char *tgt_str;
619 	void *tgt; /* type, alias, or attribute */
620 	char *obj_str;
621 	struct cil_class *obj;
622 	char *result_str;
623 	void *result; /* type or alias */
624 };
625 
626 struct cil_roletransition {
627 	char *src_str;
628 	struct cil_role *src;
629 	char *tgt_str;
630 	void *tgt; /* type, alias, or attribute */
631 	char *obj_str;
632 	struct cil_class *obj;
633 	char *result_str;
634 	struct cil_role *result;
635 };
636 
637 struct cil_roleallow {
638 	char *src_str;
639 	void *src; /* role or attribute */
640 	char *tgt_str;
641 	void *tgt; /* role or attribute */
642 };
643 
644 struct cil_sens {
645 	struct cil_symtab_datum datum;
646 	struct cil_list *cats_list;
647 	uint32_t ordered;
648 };
649 
650 struct cil_sensorder {
651 	struct cil_list *sens_list_str;
652 };
653 
654 struct cil_cat {
655 	struct cil_symtab_datum datum;
656 	uint32_t ordered;
657 	int value;
658 };
659 
660 struct cil_cats {
661 	uint32_t evaluated;
662 	struct cil_list *str_expr;
663 	struct cil_list *datum_expr;
664 };
665 
666 struct cil_catset {
667 	struct cil_symtab_datum datum;
668 	struct cil_cats *cats;
669 };
670 
671 struct cil_catorder {
672 	struct cil_list *cat_list_str;
673 };
674 
675 struct cil_senscat {
676 	char *sens_str;
677 	struct cil_cats *cats;
678 };
679 
680 struct cil_level {
681 	struct cil_symtab_datum datum;
682 	char *sens_str;
683 	struct cil_sens *sens;
684 	struct cil_cats *cats;
685 };
686 
687 struct cil_levelrange {
688 	struct cil_symtab_datum datum;
689 	char *low_str;
690 	struct cil_level *low;
691 	char *high_str;
692 	struct cil_level *high;
693 };
694 
695 struct cil_context {
696 	struct cil_symtab_datum datum;
697 	char *user_str;
698 	struct cil_user *user;
699 	char *role_str;
700 	struct cil_role *role;
701 	char *type_str;
702 	void *type; /* type or alias */
703 	char *range_str;
704 	struct cil_levelrange *range;
705 };
706 
707 enum cil_filecon_types {
708 	CIL_FILECON_FILE = 1,
709 	CIL_FILECON_DIR,
710 	CIL_FILECON_CHAR,
711 	CIL_FILECON_BLOCK,
712 	CIL_FILECON_SOCKET,
713 	CIL_FILECON_PIPE,
714 	CIL_FILECON_SYMLINK,
715 	CIL_FILECON_ANY
716 };
717 
718 struct cil_filecon {
719 	char *path_str;
720 	enum cil_filecon_types type;
721 	char *context_str;
722 	struct cil_context *context;
723 };
724 
725 enum cil_protocol {
726 	CIL_PROTOCOL_UDP = 1,
727 	CIL_PROTOCOL_TCP,
728 	CIL_PROTOCOL_DCCP
729 };
730 
731 struct cil_portcon {
732 	enum cil_protocol proto;
733 	uint32_t port_low;
734 	uint32_t port_high;
735 	char *context_str;
736 	struct cil_context *context;
737 };
738 
739 struct cil_nodecon {
740 	char *addr_str;
741 	struct cil_ipaddr *addr;
742 	char *mask_str;
743 	struct cil_ipaddr *mask;
744 	char *context_str;
745 	struct cil_context *context;
746 };
747 
748 struct cil_ipaddr {
749 	struct cil_symtab_datum datum;
750 	int family;
751 	union {
752 		struct in_addr v4;
753 		struct in6_addr v6;
754 	} ip;
755 };
756 
757 struct cil_genfscon {
758 	char *fs_str;
759 	char *path_str;
760 	char *context_str;
761 	struct cil_context *context;
762 };
763 
764 struct cil_netifcon {
765 	char *interface_str;
766 	char *if_context_str;
767 	struct cil_context *if_context;
768 	char *packet_context_str;
769 	struct cil_context *packet_context;
770 	char *context_str;
771 };
772 
773 struct cil_pirqcon {
774 	uint32_t pirq;
775 	char *context_str;
776 	struct cil_context *context;
777 };
778 
779 struct cil_iomemcon {
780 	uint64_t iomem_low;
781 	uint64_t iomem_high;
782 	char *context_str;
783 	struct cil_context *context;
784 };
785 
786 struct cil_ioportcon {
787 	uint32_t ioport_low;
788 	uint32_t ioport_high;
789 	char *context_str;
790 	struct cil_context *context;
791 };
792 
793 struct cil_pcidevicecon {
794 	uint32_t dev;
795 	char *context_str;
796 	struct cil_context *context;
797 };
798 
799 struct cil_devicetreecon {
800 	char *path;
801 	char *context_str;
802 	struct cil_context *context;
803 };
804 
805 
806 /* Ensure that CIL uses the same values as sepol services.h */
807 enum cil_fsuse_types {
808 	CIL_FSUSE_XATTR = SECURITY_FS_USE_XATTR,
809 	CIL_FSUSE_TASK = SECURITY_FS_USE_TASK,
810 	CIL_FSUSE_TRANS = SECURITY_FS_USE_TRANS
811 };
812 
813 struct cil_fsuse {
814 	enum cil_fsuse_types type;
815 	char *fs_str;
816 	char *context_str;
817 	struct cil_context *context;
818 };
819 
820 #define CIL_MLS_LEVELS "l1 l2 h1 h2"
821 #define CIL_CONSTRAIN_KEYS "t1 t2 r1 r2 u1 u2"
822 #define CIL_MLSCONSTRAIN_KEYS CIL_MLS_LEVELS CIL_CONSTRAIN_KEYS
823 #define CIL_CONSTRAIN_OPER "== != eq dom domby incomp not and or"
824 struct cil_constrain {
825 	struct cil_list *classperms;
826 	struct cil_list *str_expr;
827 	struct cil_list *datum_expr;
828 };
829 
830 struct cil_validatetrans {
831 	char *class_str;
832 	struct cil_class *class;
833 	struct cil_list *str_expr;
834 	struct cil_list *datum_expr;
835 };
836 
837 struct cil_param {
838 	char *str;
839 	enum cil_flavor flavor;
840 };
841 
842 struct cil_macro {
843 	struct cil_symtab_datum datum;
844 	symtab_t symtab[CIL_SYM_NUM];
845 	struct cil_list *params;
846 };
847 
848 struct cil_args {
849 	char *arg_str;
850 	struct cil_symtab_datum *arg;
851 	char *param_str;
852 	enum cil_flavor flavor;
853 };
854 
855 struct cil_call {
856 	char *macro_str;
857 	struct cil_macro *macro;
858 	struct cil_tree *args_tree;
859 	struct cil_list *args;
860 	int copied;
861 };
862 
863 #define CIL_TRUE	1
864 #define CIL_FALSE	0
865 
866 struct cil_condblock {
867 	enum cil_flavor flavor;
868 	symtab_t symtab[CIL_SYM_NUM];
869 };
870 
871 struct cil_booleanif {
872 	struct cil_list *str_expr;
873 	struct cil_list *datum_expr;
874 	int preserved_tunable;
875 };
876 
877 struct cil_tunableif {
878 	struct cil_list *str_expr;
879 	struct cil_list *datum_expr;
880 };
881 
882 struct cil_policycap {
883 	struct cil_symtab_datum datum;
884 };
885 
886 struct cil_bounds {
887 	char *parent_str;
888 	char *child_str;
889 };
890 
891 /* Ensure that CIL uses the same values as sepol policydb.h */
892 enum cil_default_object {
893 	CIL_DEFAULT_SOURCE = DEFAULT_SOURCE,
894 	CIL_DEFAULT_TARGET = DEFAULT_TARGET,
895 };
896 
897 /* Default labeling behavior for users, roles, and types */
898 struct cil_default {
899 	enum cil_flavor flavor;
900 	struct cil_list *class_strs;
901 	struct cil_list *class_datums;
902 	enum cil_default_object object;
903 };
904 
905 /* Ensure that CIL uses the same values as sepol policydb.h */
906 enum cil_default_object_range {
907 	CIL_DEFAULT_SOURCE_LOW      = DEFAULT_SOURCE_LOW,
908 	CIL_DEFAULT_SOURCE_HIGH     = DEFAULT_SOURCE_HIGH,
909 	CIL_DEFAULT_SOURCE_LOW_HIGH = DEFAULT_SOURCE_LOW_HIGH,
910 	CIL_DEFAULT_TARGET_LOW      = DEFAULT_TARGET_LOW,
911 	CIL_DEFAULT_TARGET_HIGH     = DEFAULT_TARGET_HIGH,
912 	CIL_DEFAULT_TARGET_LOW_HIGH = DEFAULT_TARGET_LOW_HIGH,
913 };
914 
915 /* Default labeling behavior for range */
916 struct cil_defaultrange {
917 	struct cil_list *class_strs;
918 	struct cil_list *class_datums;
919 	enum cil_default_object_range object_range;
920 };
921 
922 struct cil_handleunknown {
923 	int handle_unknown;
924 };
925 
926 struct cil_mls {
927 	int value;
928 };
929 
930 struct cil_src_info {
931 	int is_cil;
932 	char *path;
933 };
934 
935 void cil_db_init(struct cil_db **db);
936 void cil_db_destroy(struct cil_db **db);
937 
938 void cil_root_init(struct cil_root **root);
939 void cil_root_destroy(struct cil_root *root);
940 
941 void cil_destroy_data(void **data, enum cil_flavor flavor);
942 
943 int cil_flavor_to_symtab_index(enum cil_flavor flavor, enum cil_sym_index *index);
944 const char * cil_node_to_string(struct cil_tree_node *node);
945 
946 int cil_userprefixes_to_string(struct cil_db *db, char **out, size_t *size);
947 int cil_selinuxusers_to_string(struct cil_db *db, char **out, size_t *size);
948 int cil_filecons_to_string(struct cil_db *db, char **out, size_t *size);
949 
950 void cil_symtab_array_init(symtab_t symtab[], int symtab_sizes[CIL_SYM_NUM]);
951 void cil_symtab_array_destroy(symtab_t symtab[]);
952 void cil_destroy_ast_symtabs(struct cil_tree_node *root);
953 int cil_get_symtab(struct cil_tree_node *ast_node, symtab_t **symtab, enum cil_sym_index sym_index);
954 
955 void cil_sort_init(struct cil_sort **sort);
956 void cil_sort_destroy(struct cil_sort **sort);
957 void cil_netifcon_init(struct cil_netifcon **netifcon);
958 void cil_context_init(struct cil_context **context);
959 void cil_level_init(struct cil_level **level);
960 void cil_levelrange_init(struct cil_levelrange **lvlrange);
961 void cil_sens_init(struct cil_sens **sens);
962 void cil_block_init(struct cil_block **block);
963 void cil_blockinherit_init(struct cil_blockinherit **inherit);
964 void cil_blockabstract_init(struct cil_blockabstract **abstract);
965 void cil_in_init(struct cil_in **in);
966 void cil_class_init(struct cil_class **class);
967 void cil_classorder_init(struct cil_classorder **classorder);
968 void cil_classcommon_init(struct cil_classcommon **classcommon);
969 void cil_sid_init(struct cil_sid **sid);
970 void cil_sidcontext_init(struct cil_sidcontext **sidcontext);
971 void cil_sidorder_init(struct cil_sidorder **sidorder);
972 void cil_userrole_init(struct cil_userrole **userrole);
973 void cil_userprefix_init(struct cil_userprefix **userprefix);
974 void cil_selinuxuser_init(struct cil_selinuxuser **selinuxuser);
975 void cil_roleattribute_init(struct cil_roleattribute **attribute);
976 void cil_roleattributeset_init(struct cil_roleattributeset **attrset);
977 void cil_roletype_init(struct cil_roletype **roletype);
978 void cil_typeattribute_init(struct cil_typeattribute **attribute);
979 void cil_typeattributeset_init(struct cil_typeattributeset **attrset);
980 void cil_alias_init(struct cil_alias **alias);
981 void cil_aliasactual_init(struct cil_aliasactual **aliasactual);
982 void cil_typepermissive_init(struct cil_typepermissive **typeperm);
983 void cil_name_init(struct cil_name **name);
984 void cil_nametypetransition_init(struct cil_nametypetransition **nametypetrans);
985 void cil_rangetransition_init(struct cil_rangetransition **rangetrans);
986 void cil_bool_init(struct cil_bool **cilbool);
987 void cil_boolif_init(struct cil_booleanif **bif);
988 void cil_condblock_init(struct cil_condblock **cb);
989 void cil_tunable_init(struct cil_tunable **ciltun);
990 void cil_tunif_init(struct cil_tunableif **tif);
991 void cil_avrule_init(struct cil_avrule **avrule);
992 void cil_permissionx_init(struct cil_permissionx **permx);
993 void cil_type_rule_init(struct cil_type_rule **type_rule);
994 void cil_roletransition_init(struct cil_roletransition **roletrans);
995 void cil_roleallow_init(struct cil_roleallow **role_allow);
996 void cil_catset_init(struct cil_catset **catset);
997 void cil_cats_init(struct cil_cats **cats);
998 void cil_senscat_init(struct cil_senscat **senscat);
999 void cil_filecon_init(struct cil_filecon **filecon);
1000 void cil_portcon_init(struct cil_portcon **portcon);
1001 void cil_nodecon_init(struct cil_nodecon **nodecon);
1002 void cil_genfscon_init(struct cil_genfscon **genfscon);
1003 void cil_pirqcon_init(struct cil_pirqcon **pirqcon);
1004 void cil_iomemcon_init(struct cil_iomemcon **iomemcon);
1005 void cil_ioportcon_init(struct cil_ioportcon **ioportcon);
1006 void cil_pcidevicecon_init(struct cil_pcidevicecon **pcidevicecon);
1007 void cil_devicetreecon_init(struct cil_devicetreecon **devicetreecon);
1008 void cil_fsuse_init(struct cil_fsuse **fsuse);
1009 void cil_constrain_init(struct cil_constrain **constrain);
1010 void cil_validatetrans_init(struct cil_validatetrans **validtrans);
1011 void cil_ipaddr_init(struct cil_ipaddr **ipaddr);
1012 void cil_perm_init(struct cil_perm **perm);
1013 void cil_classpermission_init(struct cil_classpermission **cp);
1014 void cil_classpermissionset_init(struct cil_classpermissionset **cps);
1015 void cil_classperms_set_init(struct cil_classperms_set **cp_set);
1016 void cil_classperms_init(struct cil_classperms **cp);
1017 void cil_classmapping_init(struct cil_classmapping **mapping);
1018 void cil_user_init(struct cil_user **user);
1019 void cil_userlevel_init(struct cil_userlevel **usrlvl);
1020 void cil_userrange_init(struct cil_userrange **userrange);
1021 void cil_role_init(struct cil_role **role);
1022 void cil_type_init(struct cil_type **type);
1023 void cil_cat_init(struct cil_cat **cat);
1024 void cil_catorder_init(struct cil_catorder **catorder);
1025 void cil_sensorder_init(struct cil_sensorder **sensorder);
1026 void cil_args_init(struct cil_args **args);
1027 void cil_call_init(struct cil_call **call);
1028 void cil_optional_init(struct cil_optional **optional);
1029 void cil_param_init(struct cil_param **param);
1030 void cil_macro_init(struct cil_macro **macro);
1031 void cil_policycap_init(struct cil_policycap **policycap);
1032 void cil_bounds_init(struct cil_bounds **bounds);
1033 void cil_default_init(struct cil_default **def);
1034 void cil_defaultrange_init(struct cil_defaultrange **def);
1035 void cil_handleunknown_init(struct cil_handleunknown **unk);
1036 void cil_mls_init(struct cil_mls **mls);
1037 void cil_src_info_init(struct cil_src_info **info);
1038 void cil_userattribute_init(struct cil_userattribute **attribute);
1039 void cil_userattributeset_init(struct cil_userattributeset **attrset);
1040 
1041 #endif
1042