Struct PermissionCheck 

pub struct PermissionCheck<'a> { /* private fields */ }

Implements the has_permission() API, based on supplied SecurityServer and AccessVectorCache implementations.

Implementations

impl<'a> PermissionCheck<'a>

pub fn has_permission<P: ClassPermission + Into<KernelPermission> + Clone + 'static>( &self, source_sid: SecurityId, target_sid: SecurityId, permission: P, ) -> PermissionCheckResult

Returns whether the source_sid has the specified permission on target_sid. The result indicates both whether permission is permitted, and whether the caller should audit log the query.

pub fn has_extended_permission<P: ClassPermission + Into<KernelPermission> + Clone + 'static>( &self, xperms_kind: XpermsKind, source_sid: SecurityId, target_sid: SecurityId, permission: P, xperm: u16, ) -> PermissionCheckResult

Returns whether the source_sid has both a base permission (i.e. ioctl or nlmsg) and the specified extended permission on target_sid, and whether the decision should be audited.

A request is allowed if the base permission is allowed and either the numeric extended permission of this xperms_kind is included in an allowxperm statement, or extended permissions of this kind are not filtered for this domain.

A granted request is audited if the base permission is auditallow and the extended permission is auditallowxperm.

A denied request is audited if the base permission is dontaudit or the extended permission is dontauditxperm.

pub fn security_server(&self) -> &SecurityServer

pub fn compute_new_fs_node_sid( &self, source_sid: SecurityId, target_sid: SecurityId, fs_node_class: FsNodeClass, fs_node_name: NullessByteStr<'_>, ) -> Result<SecurityId, Error>

Returns the SID with which to label a new file_class instance created by subject_sid, with target_sid as its parent, taking into account role & type transition rules, and filename-transition rules. If a filename-transition rule matches the fs_node_name then that will be used, otherwise the filename-independent computation will be applied.

pub fn compute_access_decision( &self, source_sid: SecurityId, target_sid: SecurityId, target_class: ObjectClass, ) -> AccessDecision

Returns the raw AccessDecision for a specified source, target and class.