Struct SecurityServer

pub struct SecurityServer { /* private fields */ }

Implementations

impl SecurityServer

pub fn new() -> Arc<Self>

pub fn new_with_exceptions(exceptions_config: String) -> Arc<Self>

pub fn as_permission_check<'a>(&'a self) -> PermissionCheck<'a>

Converts a shared pointer to SecurityServer to a PermissionCheck without consuming the pointer.

pub fn security_context_to_sid( &self, security_context: NullessByteStr<'_>, ) -> Result<SecurityId, Error>

Returns the security ID mapped to security_context, creating it if it does not exist.

All objects with the same security context will have the same SID associated.

pub fn sid_to_security_context(&self, sid: SecurityId) -> Option<Vec<u8>>

Returns the Security Context string for the requested sid. This is used only where Contexts need to be stringified to expose to userspace, as is the case for e.g. the /proc/*/attr/ filesystem and security.selinux extended attribute values.

pub fn load_policy(&self, binary_policy: Vec<u8>) -> Result<(), Error>

Applies the supplied policy to the security server.

pub fn get_binary_policy(&self) -> Vec<u8>

Returns the active policy in binary form.

pub fn has_policy(&self) -> bool

Returns true if a policy has been loaded.

pub fn set_enforcing(&self, enforcing: bool)

Set to enforcing mode if enforce is true, permissive mode otherwise.

pub fn is_enforcing(&self) -> bool

pub fn deny_unknown(&self) -> bool

Returns true if the policy requires unknown class / permissions to be denied. Defaults to true until a policy is loaded.

pub fn reject_unknown(&self) -> bool

Returns true if the policy requires unknown class / permissions to be rejected. Defaults to false until a policy is loaded.

pub fn conditional_booleans(&self) -> Vec<String>

Returns the list of names of boolean conditionals defined by the loaded policy.

pub fn get_boolean(&self, name: &str) -> Result<(bool, bool), ()>

Returns the active and pending values of a policy boolean, if it exists.

pub fn set_pending_boolean(&self, name: &str, value: bool) -> Result<(), ()>

Sets the pending value of a boolean, if it is defined in the policy.

pub fn commit_pending_booleans(&self)

Commits all pending changes to conditional booleans.

pub fn avc_cache_stats(&self) -> CacheStats

Returns a snapshot of the AVC usage statistics.

pub fn class_names(&self) -> Result<Vec<Vec<u8>>, ()>

Returns the list of all class names.

pub fn class_id_by_name(&self, name: &str) -> Result<ClassId, ()>

Returns the class identifier of a class, if it exists.

pub fn class_permissions_by_name( &self, name: &str, ) -> Result<Vec<(ClassPermissionId, Vec<u8>)>, ()>

Returns the set of permissions associated with a class. Each permission is represented as a tuple of the permission ID (in the scope of its associated class) and the permission name.

pub fn resolve_fs_label( &self, fs_type: NullessByteStr<'_>, mount_options: &FileSystemMountOptions, ) -> FileSystemLabel

Determines the appropriate FileSystemLabel for a mounted filesystem given this security server’s loaded policy, the name of the filesystem type (“ext4” or “tmpfs”, for example), and the security-relevant mount options passed for the mount operation.

pub fn genfscon_label_for_fs_and_path( &self, fs_type: NullessByteStr<'_>, node_path: NullessByteStr<'_>, class_id: Option<ClassId>, ) -> Option<SecurityId>

If there is a genfscon statement for the given filesystem type, returns the [SecurityContext] that should be used for a node in path node_path. When node_path is the root path (“/”) the label additionally corresponds to the FileSystem label.

pub fn is_bounded_by( &self, bounded_sid: SecurityId, parent_sid: SecurityId, ) -> bool

Returns true if the bounded_sid is bounded by the parent_sid. Bounds relationships are mostly enforced by policy tooling, so this only requires validating that the policy entry for the TypeId of bounded_sid has the TypeId of parent_sid specified in its bounds.

pub fn set_status_publisher( &self, status_holder: Box<dyn SeLinuxStatusPublisher>, )

Assign a SeLinuxStatusPublisher to be used for pushing updates to the security server’s policy status. This should be invoked exactly once when selinuxfs is initialized.

Panics

This will panic on debug builds if it is invoked multiple times.

pub fn compute_new_sid( &self, source_sid: SecurityId, target_sid: SecurityId, target_class: KernelClass, ) -> Result<SecurityId, Error>

Returns the security identifier (SID) with which to label a new object of target_class, based on the specified source & target security SIDs. For file-like classes the compute_new_fs_node_sid*() APIs should be used instead.

Trait Implementations

impl AccessVectorComputer for SecurityServer

fn access_vector_from_permissions<P: ClassPermission + Into<KernelPermission> + Clone + 'static>( &self, permissions: &[P], ) -> Option<AccessVector>

Returns an AccessVector containing the supplied kernel permissions.