Struct Policy

pub struct Policy<PS: ParseStrategy>(/* private fields */);

Implementations

impl<PS: ParseStrategy> Policy<PS>

pub fn policy_version(&self) -> u32

The policy version stored in the underlying binary policy.

pub fn handle_unknown(&self) -> HandleUnknown

The way “unknown” policy decisions should be handed according to the underlying binary policy.

pub fn conditional_booleans<'a>(&'a self) -> Vec<(&'a [u8], bool)>

pub fn classes<'a>(&'a self) -> Vec<ClassInfo<'a>>

The set of class names and their respective class identifiers.

pub fn find_class_permissions_by_name( &self, class_name: &str, ) -> Result<Vec<(ClassPermissionId, Vec<u8>)>, ()>

Returns the set of permissions for the given class, including both the explicitly owned permissions and the inherited ones from common symbols. Each permission is a tuple of the permission identifier (in the scope of the given class) and the permission name.

pub fn fs_use_label_and_type( &self, fs_type: NullessByteStr<'_>, ) -> Option<FsUseLabelAndType>

If there is an fs_use statement for the given filesystem type, returns the associated SecurityContext and FsUseType.

pub fn genfscon_label_for_fs_and_path( &self, fs_type: NullessByteStr<'_>, node_path: NullessByteStr<'_>, class_id: Option<ClassId>, ) -> Option<SecurityContext>

If there is a genfscon statement for the given filesystem type, returns the associated SecurityContext.

pub fn initial_context(&self, id: InitialSid) -> SecurityContext

Returns the SecurityContext defined by this policy for the specified well-known (or “initial”) Id.

pub fn parse_security_context( &self, security_context: NullessByteStr<'_>, ) -> Result<SecurityContext, SecurityContextError>

Returns a SecurityContext with fields parsed from the supplied Security Context string.

pub fn validate_security_context( &self, security_context: &SecurityContext, ) -> Result<(), SecurityContextError>

Validates a SecurityContext against this policy’s constraints.

pub fn serialize_security_context( &self, security_context: &SecurityContext, ) -> Vec<u8>

Returns a byte string describing the supplied SecurityContext.

pub fn new_file_security_context( &self, source: &SecurityContext, target: &SecurityContext, class: &FsNodeClass, ) -> SecurityContext

Returns the security context that should be applied to a newly created file-like SELinux object according to source and target security contexts, as well as the new object’s class. This context should be used only if no filename-transition match is found, via [new_file_security_context_by_name()].

pub fn new_file_security_context_by_name( &self, source: &SecurityContext, target: &SecurityContext, class: &FsNodeClass, name: NullessByteStr<'_>, ) -> Option<SecurityContext>

Returns the security context that should be applied to a newly created file-like SELinux object according to source and target security contexts, as well as the new object’s class and name. If no filename-transition rule matches the supplied arguments then None is returned, and the caller should fall-back to filename-independent labeling via [new_file_security_context()]

pub fn new_security_context( &self, source: &SecurityContext, target: &SecurityContext, class: &KernelClass, ) -> SecurityContext

Returns the security context that should be applied to a newly created SELinux object according to source and target security contexts, as well as the new object’s class. Defaults to the source security context if the policy does not specify transitions or defaults for the source, target or class components.

Returns an error if the security context for such an object is not well-defined by this Policy.

pub fn compute_access_decision( &self, source_context: &SecurityContext, target_context: &SecurityContext, object_class: &KernelClass, ) -> AccessDecision

Computes the access vector that associates type source_type_name and target_type_name via an explicit allow [...]; statement in the binary policy, subject to any matching constraint statements. Computes AccessVector::NONE if no such statement exists.

Access decisions are currently based on explicit “allow” rules and “constrain” or “mlsconstrain” statements. A permission is allowed if it is allowed by an explicit “allow”, and if in addition, all matching constraints are satisfied.

pub fn compute_access_decision_custom( &self, source_context: &SecurityContext, target_context: &SecurityContext, target_class_name: &str, ) -> AccessDecision

Computes the access vector that associates type source_type_name and target_type_name via an explicit allow [...]; statement in the binary policy, subject to any matching constraint statements. Computes AccessVector::NONE if no such statement exists. This is the “custom” form of this API because target_class_name is associated with a crate::ObjectClass::Custom value.

pub fn compute_ioctl_access_decision( &self, source_context: &SecurityContext, target_context: &SecurityContext, object_class: &KernelClass, ioctl_prefix: u8, ) -> IoctlAccessDecision

Computes the ioctl extended permissions that should be allowed, audited when allowed, and audited when denied, for a given source context, target context, target class, and ioctl prefix byte.

pub fn compute_ioctl_access_decision_custom( &self, source_context: &SecurityContext, target_context: &SecurityContext, target_class_name: &str, ioctl_prefix: u8, ) -> IoctlAccessDecision

Computes the ioctl extended permissions that should be allowed, audited when allowed, and audited when denied, for a given source context, target context, target_class, and ioctl prefix byte. This is the “custom” form of this API because target_class_name is associated with a crate::ObjectClass::Custom value.

pub fn is_bounded_by(&self, bounded_type: TypeId, parent_type: TypeId) -> bool

pub fn is_permissive(&self, type_: TypeId) -> bool

Returns true if the policy has the marked the type/domain for permissive checks.

Trait Implementations

impl<PS: ParseStrategy> AccessVectorComputer for Policy<PS>

fn access_vector_from_permissions<P: ClassPermission + Into<KernelPermission> + Clone + 'static>( &self, permissions: &[P], ) -> Option<AccessVector>

Returns an AccessVector containing the supplied kernel permissions.

impl<PS: Debug + ParseStrategy> Debug for Policy<PS>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.