selinux/
kernel_permissions.rs

1// Copyright 2024 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5use strum::VariantArray as _;
6use strum_macros::VariantArray;
7
8/// Declares an `enum` with a `name()` method that returns the name for the given variant.
9macro_rules! named_enum {
10    ($(#[$meta:meta])* $name:ident {
11        $($(#[$variant_meta:meta])* $variant:ident ($variant_name:literal),)*
12    }) => {
13        $(#[$meta])*
14        pub enum $name  {
15            $($(#[$variant_meta])* $variant,)*
16        }
17
18        impl $name {
19            pub fn name(&self) -> &'static str {
20                match self {
21                    $($name::$variant => $variant_name,)*
22                }
23            }
24        }
25    }
26}
27
28/// A well-known class in SELinux policy that has a particular meaning in policy enforcement
29/// hooks.
30#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq, VariantArray)]
31pub enum KernelClass {
32    // keep-sorted start
33    /// The SELinux "anon_inode" object class.
34    AnonFsNode,
35    /// The SELinux "binder" object class.
36    Binder,
37    /// The SELinux "blk_file" object class.
38    Block,
39    /// The SELinux "bpf" object class.
40    Bpf,
41    /// The SELinux "capability" object class.
42    Capability,
43    /// The SELinux "capability2" object class.
44    Capability2,
45    /// The SELinux "chr_file" object class.
46    Character,
47    /// The SELinux "dir" object class.
48    Dir,
49    /// The SELinux "fd" object class.
50    Fd,
51    /// The SELinux "fifo_file" object class.
52    Fifo,
53    /// The SELinux "file" object class.
54    File,
55    /// The SELinux "filesystem" object class.
56    FileSystem,
57    /// "icmp_socket" class enabled via the "extended_socket_class" policy capability.
58    IcmpSocket,
59    /// The SELinux "key_socket" object class.
60    KeySocket,
61    /// The SELinux "lnk_file" object class.
62    Link,
63    /// The SELinux "memfd_file" object class.
64    MemFdFile,
65    /// The SELinux "netlink_audit_socket" object class.
66    NetlinkAuditSocket,
67    /// The SELinux "netlink_connector_socket" object class.
68    NetlinkConnectorSocket,
69    /// The SELinux "netlink_crypto_socket" object class.
70    NetlinkCryptoSocket,
71    /// The SELinux "netlink_dnrt_socket" object class.
72    NetlinkDnrtSocket,
73    /// The SELinux "netlink_fib_lookup_socket" object class.
74    NetlinkFibLookupSocket,
75    /// The SELinux "netlink_firewall_socket" object class.
76    NetlinkFirewallSocket,
77    /// The SELinux "netlink_generic_socket" object class.
78    NetlinkGenericSocket,
79    /// The SELinux "netlink_ip6fw_socket" object class.
80    NetlinkIp6FwSocket,
81    /// The SELinux "netlink_iscsi_socket" object class.
82    NetlinkIscsiSocket,
83    /// The SELinux "netlink_kobject_uevent_socket" object class.
84    NetlinkKobjectUeventSocket,
85    /// The SELinux "netlink_netfilter_socket" object class.
86    NetlinkNetfilterSocket,
87    /// The SELinux "netlink_nflog_socket" object class.
88    NetlinkNflogSocket,
89    /// The SELinux "netlink_rdma_socket" object class.
90    NetlinkRdmaSocket,
91    /// The SELinux "netlink_route_socket" object class.
92    NetlinkRouteSocket,
93    /// The SELinux "netlink_scsitransport_socket" object class.
94    NetlinkScsitransportSocket,
95    /// The SELinux "netlink_selinux_socket" object class.
96    NetlinkSelinuxSocket,
97    /// The SELinux "netlink_socket" object class.
98    NetlinkSocket,
99    /// The SELinux "netlink_tcpdiag_socket" object class.
100    NetlinkTcpDiagSocket,
101    /// The SELinux "netlink_xfrm_socket" object class.
102    NetlinkXfrmSocket,
103    /// The SELinux "packet_socket" object class.
104    PacketSocket,
105    /// The SELinux "perf_event" object class.
106    PerfEvent,
107    /// The SELinux "process" object class.
108    Process,
109    /// The SELinux "process2" object class.
110    Process2,
111    /// The SELinux "qipcrtr_socket" object class.
112    QipcrtrSocket,
113    /// The SELinux "rawip_socket" object class.
114    RawIpSocket,
115    /// "sctp_socket" class enabled via the "extended_socket_class" policy capability.
116    SctpSocket,
117    /// The SELinux "security" object class.
118    Security,
119    /// The SELinux "sock_file" object class.
120    SockFile,
121    /// The SELinux "socket" object class.
122    Socket,
123    /// The SELinux "system" object class.
124    System,
125    /// The SELinux "tcp_socket" object class.
126    TcpSocket,
127    /// The SELinux "tun_socket" object class.
128    TunSocket,
129    /// The SELinux "udp_socket" object class.
130    UdpSocket,
131    /// The SELinux "unix_dgram_socket" object class.
132    UnixDgramSocket,
133    /// The SELinux "unix_stream_socket" object class.
134    UnixStreamSocket,
135    /// "vsock_socket" class enabled via the "extended_socket_class" policy capability.
136    VSockSocket,
137    // keep-sorted end
138}
139
140impl KernelClass {
141    /// Returns the name used to refer to this object class in the SELinux binary policy.
142    pub fn name(&self) -> &'static str {
143        match self {
144            // keep-sorted start
145            Self::AnonFsNode => "anon_inode",
146            Self::Binder => "binder",
147            Self::Block => "blk_file",
148            Self::Bpf => "bpf",
149            Self::Capability => "capability",
150            Self::Capability2 => "capability2",
151            Self::Character => "chr_file",
152            Self::Dir => "dir",
153            Self::Fd => "fd",
154            Self::Fifo => "fifo_file",
155            Self::File => "file",
156            Self::FileSystem => "filesystem",
157            Self::IcmpSocket => "icmp_socket",
158            Self::KeySocket => "key_socket",
159            Self::Link => "lnk_file",
160            Self::MemFdFile => "memfd_file",
161            Self::NetlinkAuditSocket => "netlink_audit_socket",
162            Self::NetlinkConnectorSocket => "netlink_connector_socket",
163            Self::NetlinkCryptoSocket => "netlink_crypto_socket",
164            Self::NetlinkDnrtSocket => "netlink_dnrt_socket",
165            Self::NetlinkFibLookupSocket => "netlink_fib_lookup_socket",
166            Self::NetlinkFirewallSocket => "netlink_firewall_socket",
167            Self::NetlinkGenericSocket => "netlink_generic_socket",
168            Self::NetlinkIp6FwSocket => "netlink_ip6fw_socket",
169            Self::NetlinkIscsiSocket => "netlink_iscsi_socket",
170            Self::NetlinkKobjectUeventSocket => "netlink_kobject_uevent_socket",
171            Self::NetlinkNetfilterSocket => "netlink_netfilter_socket",
172            Self::NetlinkNflogSocket => "netlink_nflog_socket",
173            Self::NetlinkRdmaSocket => "netlink_rdma_socket",
174            Self::NetlinkRouteSocket => "netlink_route_socket",
175            Self::NetlinkScsitransportSocket => "netlink_scsitransport_socket",
176            Self::NetlinkSelinuxSocket => "netlink_selinux_socket",
177            Self::NetlinkSocket => "netlink_socket",
178            Self::NetlinkTcpDiagSocket => "netlink_tcpdiag_socket",
179            Self::NetlinkXfrmSocket => "netlink_xfrm_socket",
180            Self::PacketSocket => "packet_socket",
181            Self::PerfEvent => "perf_event",
182            Self::Process => "process",
183            Self::Process2 => "process2",
184            Self::QipcrtrSocket => "qipcrtr_socket",
185            Self::RawIpSocket => "rawip_socket",
186            Self::SctpSocket => "sctp_socket",
187            Self::Security => "security",
188            Self::SockFile => "sock_file",
189            Self::Socket => "socket",
190            Self::System => "system",
191            Self::TcpSocket => "tcp_socket",
192            Self::TunSocket => "tun_socket",
193            Self::UdpSocket => "udp_socket",
194            Self::UnixDgramSocket => "unix_dgram_socket",
195            Self::UnixStreamSocket => "unix_stream_socket",
196            Self::VSockSocket => "vsock_socket",
197            // keep-sorted end
198        }
199    }
200}
201
202impl<T: Into<KernelClass>> ForClass<T> for KernelPermission {
203    fn for_class(&self, class: T) -> KernelPermission {
204        assert_eq!(self.class(), class.into());
205        *self
206    }
207}
208
209pub trait ForClass<T> {
210    /// Returns the `class`-affine `KernelPermission` value corresponding to this common permission.
211    /// This is used to allow hooks to resolve e.g. common "sys_nice" permission access based on the
212    /// "allow" rules for the correct target object class.
213    fn for_class(&self, class: T) -> KernelPermission;
214}
215
216/// Covers the set of classes that inherit from the common "cap" symbol (e.g. "capability" for
217/// now and "cap_userns" after Starnix gains user namespacing support).
218#[derive(Copy, Clone, Debug, Eq, Hash, PartialEq)]
219pub enum CapClass {
220    // keep-sorted start
221    /// The SELinux "capability" object class.
222    Capability,
223    // keep-sorted end
224}
225
226impl From<CapClass> for KernelClass {
227    fn from(cap_class: CapClass) -> Self {
228        match cap_class {
229            // keep-sorted start
230            CapClass::Capability => Self::Capability,
231            // keep-sorted end
232        }
233    }
234}
235
236/// Covers the set of classes that inherit from the common "cap2" symbol (e.g. "capability2" for
237/// now and "cap2_userns" after Starnix gains user namespacing support).
238#[derive(Copy, Clone, Debug, Eq, Hash, PartialEq)]
239pub enum Cap2Class {
240    // keep-sorted start
241    /// The SELinux "capability2" object class.
242    Capability2,
243    // keep-sorted end
244}
245
246impl From<Cap2Class> for KernelClass {
247    fn from(cap2_class: Cap2Class) -> Self {
248        match cap2_class {
249            // keep-sorted start
250            Cap2Class::Capability2 => Self::Capability2,
251            // keep-sorted end
252        }
253    }
254}
255
256/// A well-known file-like class in SELinux policy that has a particular meaning in policy
257/// enforcement hooks.
258#[derive(Copy, Clone, Debug, Eq, Hash, PartialEq)]
259pub enum FileClass {
260    // keep-sorted start
261    /// The SELinux "anon_inode" object class.
262    AnonFsNode,
263    /// The SELinux "blk_file" object class.
264    Block,
265    /// The SELinux "chr_file" object class.
266    Character,
267    /// The SELinux "dir" object class.
268    Dir,
269    /// The SELinux "fifo_file" object class.
270    Fifo,
271    /// The SELinux "file" object class.
272    File,
273    /// The SELinux "lnk_file" object class.
274    Link,
275    /// The SELinux "memfd_file" object class.
276    MemFdFile,
277    /// The SELinux "sock_file" object class.
278    SockFile,
279    // keep-sorted end
280}
281
282impl From<FileClass> for KernelClass {
283    fn from(file_class: FileClass) -> Self {
284        match file_class {
285            // keep-sorted start
286            FileClass::AnonFsNode => Self::AnonFsNode,
287            FileClass::Block => Self::Block,
288            FileClass::Character => Self::Character,
289            FileClass::Dir => Self::Dir,
290            FileClass::Fifo => Self::Fifo,
291            FileClass::File => Self::File,
292            FileClass::Link => Self::Link,
293            FileClass::MemFdFile => Self::MemFdFile,
294            FileClass::SockFile => Self::SockFile,
295            // keep-sorted end
296        }
297    }
298}
299
300/// Distinguishes socket-like kernel object classes defined in SELinux policy.
301#[derive(Copy, Clone, Debug, Eq, Hash, PartialEq)]
302pub enum SocketClass {
303    // keep-sorted start
304    Icmp,
305    Key,
306    Netlink,
307    NetlinkAudit,
308    NetlinkConnector,
309    NetlinkCrypto,
310    NetlinkDnrt,
311    NetlinkFibLookup,
312    NetlinkFirewall,
313    NetlinkGeneric,
314    NetlinkIp6Fw,
315    NetlinkIscsi,
316    NetlinkKobjectUevent,
317    NetlinkNetfilter,
318    NetlinkNflog,
319    NetlinkRdma,
320    NetlinkRoute,
321    NetlinkScsitransport,
322    NetlinkSelinux,
323    NetlinkTcpDiag,
324    NetlinkXfrm,
325    Packet,
326    Qipcrtr,
327    RawIp,
328    Sctp,
329    /// Generic socket class applied to all socket-like objects for which no more specific
330    /// class is defined.
331    Socket,
332    Tcp,
333    Tun,
334    Udp,
335    UnixDgram,
336    UnixStream,
337    Vsock,
338    // keep-sorted end
339}
340
341impl From<SocketClass> for KernelClass {
342    fn from(socket_class: SocketClass) -> Self {
343        match socket_class {
344            // keep-sorted start
345            SocketClass::Icmp => Self::IcmpSocket,
346            SocketClass::Key => Self::KeySocket,
347            SocketClass::Netlink => Self::NetlinkSocket,
348            SocketClass::NetlinkAudit => Self::NetlinkAuditSocket,
349            SocketClass::NetlinkConnector => Self::NetlinkConnectorSocket,
350            SocketClass::NetlinkCrypto => Self::NetlinkCryptoSocket,
351            SocketClass::NetlinkDnrt => Self::NetlinkDnrtSocket,
352            SocketClass::NetlinkFibLookup => Self::NetlinkFibLookupSocket,
353            SocketClass::NetlinkFirewall => Self::NetlinkFirewallSocket,
354            SocketClass::NetlinkGeneric => Self::NetlinkGenericSocket,
355            SocketClass::NetlinkIp6Fw => Self::NetlinkIp6FwSocket,
356            SocketClass::NetlinkIscsi => Self::NetlinkIscsiSocket,
357            SocketClass::NetlinkKobjectUevent => Self::NetlinkKobjectUeventSocket,
358            SocketClass::NetlinkNetfilter => Self::NetlinkNetfilterSocket,
359            SocketClass::NetlinkNflog => Self::NetlinkNflogSocket,
360            SocketClass::NetlinkRdma => Self::NetlinkRdmaSocket,
361            SocketClass::NetlinkRoute => Self::NetlinkRouteSocket,
362            SocketClass::NetlinkScsitransport => Self::NetlinkScsitransportSocket,
363            SocketClass::NetlinkSelinux => Self::NetlinkSelinuxSocket,
364            SocketClass::NetlinkTcpDiag => Self::NetlinkTcpDiagSocket,
365            SocketClass::NetlinkXfrm => Self::NetlinkXfrmSocket,
366            SocketClass::Packet => Self::PacketSocket,
367            SocketClass::Qipcrtr => Self::QipcrtrSocket,
368            SocketClass::RawIp => Self::RawIpSocket,
369            SocketClass::Sctp => Self::SctpSocket,
370            SocketClass::Socket => Self::Socket,
371            SocketClass::Tcp => Self::TcpSocket,
372            SocketClass::Tun => Self::TunSocket,
373            SocketClass::Udp => Self::UdpSocket,
374            SocketClass::UnixDgram => Self::UnixDgramSocket,
375            SocketClass::UnixStream => Self::UnixStreamSocket,
376            SocketClass::Vsock => Self::VSockSocket,
377            // keep-sorted end
378        }
379    }
380}
381
382/// Container for a security class that could be associated with a [`crate::vfs::FsNode`], to allow
383/// permissions common to both file-like and socket-like classes to be generated easily by hooks.
384#[derive(Copy, Clone, Debug, Eq, Hash, PartialEq)]
385pub enum FsNodeClass {
386    File(FileClass),
387    Socket(SocketClass),
388}
389
390impl From<FsNodeClass> for KernelClass {
391    fn from(class: FsNodeClass) -> Self {
392        match class {
393            FsNodeClass::File(file_class) => file_class.into(),
394            FsNodeClass::Socket(sock_class) => sock_class.into(),
395        }
396    }
397}
398
399impl From<FileClass> for FsNodeClass {
400    fn from(file_class: FileClass) -> Self {
401        FsNodeClass::File(file_class)
402    }
403}
404
405impl From<SocketClass> for FsNodeClass {
406    fn from(sock_class: SocketClass) -> Self {
407        FsNodeClass::Socket(sock_class)
408    }
409}
410
411pub trait ClassPermission {
412    fn class(&self) -> KernelClass;
413    fn id(&self) -> u8;
414}
415
416macro_rules! permission_enum {
417    ($(#[$meta:meta])* $name:ident {
418        $($(#[$variant_meta:meta])* $variant:ident($inner:ident)),*,
419    }) => {
420        $(#[$meta])*
421        pub enum $name {
422            $($(#[$variant_meta])* $variant($inner)),*
423        }
424
425        $(impl From<$inner> for $name {
426            fn from(v: $inner) -> Self {
427                Self::$variant(v)
428            }
429        })*
430
431        impl ClassPermission for $name {
432            fn class(&self) -> KernelClass {
433                match self {
434                    $($name::$variant(_) => KernelClass::$variant),*
435                }
436            }
437            fn id(&self) -> u8 {
438                match self {
439                    $($name::$variant(v) => v.id()),*
440                }
441            }
442        }
443
444        impl $name {
445            pub fn name(&self) -> &'static str {
446                match self {
447                    $($name::$variant(v) => v.name()),*
448                }
449            }
450
451            pub fn all_variants() -> impl Iterator<Item=Self> {
452                let iter = [].iter().map(Clone::clone);
453                $(let variant_iter = $inner::VARIANTS.iter().map(Clone::clone).map($name::from);
454                let iter = iter.chain(variant_iter);)*
455                iter
456            }
457        }
458    }
459}
460
461permission_enum! {
462    /// A well-known `(class, permission)` pair in SELinux policy that has a particular meaning in
463    /// policy enforcement hooks.
464    #[derive(Clone, Copy, Debug, Eq, Hash, PartialEq)]
465    KernelPermission {
466        // keep-sorted start
467        /// Permissions for the well-known SELinux "anon_inode" file-like object class.
468        AnonFsNode(AnonFsNodePermission),
469        /// Permissions for the well-known SELinux "binder" file-like object class.
470        Binder(BinderPermission),
471        /// Permissions for the well-known SELinux "blk_file" file-like object class.
472        Block(BlockFilePermission),
473        /// Permissions for the well-known SELinux "bpf" file-like object class.
474        Bpf(BpfPermission),
475        /// Permissions for the well-known SELinux "capability" object class.
476        Capability(CapabilityPermission),
477        /// Permissions for the well-known SELinux "capability2" object class.
478        Capability2(Capability2Permission),
479        /// Permissions for the well-known SELinux "chr_file" file-like object class.
480        Character(CharacterFilePermission),
481        /// Permissions for the well-known SELinux "dir" file-like object class.
482        Dir(DirPermission),
483        /// Permissions for the well-known SELinux "fd" object class.
484        Fd(FdPermission),
485        /// Permissions for the well-known SELinux "fifo_file" file-like object class.
486        Fifo(FifoFilePermission),
487        /// Permissions for the well-known SELinux "file" object class.
488        File(FilePermission),
489        /// Permissions for the well-known SELinux "filesystem" object class.
490        FileSystem(FileSystemPermission),
491        /// "icmp_socket" class permissions, enabled by "extended_socket_class" policy capability.
492        IcmpSocket(IcmpSocketPermission),
493        /// Permissions for the well-known SELinux "packet_socket" object class.
494        KeySocket(KeySocketPermission),
495        /// Permissions for the well-known SELinux "lnk_file" file-like object class.
496        Link(LinkFilePermission),
497        /// Permissions for the well-known SELinux "memfd_file" file-like object class.
498        MemFdFile(MemFdFilePermission),
499        /// Permissions for the well-known SELinux "netlink_audit_socket" file-like object class.
500        NetlinkAuditSocket(NetlinkAuditSocketPermission),
501        /// Permissions for the well-known SELinux "netlink_connector_socket" file-like object class.
502        NetlinkConnectorSocket(NetlinkConnectorSocketPermission),
503        /// Permissions for the well-known SELinux "netlink_crypto_socket" file-like object class.
504        NetlinkCryptoSocket(NetlinkCryptoSocketPermission),
505        /// Permissions for the well-known SELinux "netlink_dnrt_socket" file-like object class.
506        NetlinkDnrtSocket(NetlinkDnrtSocketPermission),
507        /// Permissions for the well-known SELinux "netlink_fib_lookup_socket" file-like object class.
508        NetlinkFibLookupSocket(NetlinkFibLookupSocketPermission),
509        /// Permissions for the well-known SELinux "netlink_firewall_socket" file-like object class.
510        NetlinkFirewallSocket(NetlinkFirewallSocketPermission),
511        /// Permissions for the well-known SELinux "netlink_generic_socket" file-like object class.
512        NetlinkGenericSocket(NetlinkGenericSocketPermission),
513        /// Permissions for the well-known SELinux "netlink_ip6fw_socket" file-like object class.
514        NetlinkIp6FwSocket(NetlinkIp6FwSocketPermission),
515        /// Permissions for the well-known SELinux "netlink_iscsi_socket" file-like object class.
516        NetlinkIscsiSocket(NetlinkIscsiSocketPermission),
517        /// Permissions for the well-known SELinux "netlink_kobject_uevent_socket" file-like object class.
518        NetlinkKobjectUeventSocket(NetlinkKobjectUeventSocketPermission),
519        /// Permissions for the well-known SELinux "netlink_netfilter_socket" file-like object class.
520        NetlinkNetfilterSocket(NetlinkNetfilterSocketPermission),
521        /// Permissions for the well-known SELinux "netlink_nflog_socket" file-like object class.
522        NetlinkNflogSocket(NetlinkNflogSocketPermission),
523        /// Permissions for the well-known SELinux "netlink_rdma_socket" file-like object class.
524        NetlinkRdmaSocket(NetlinkRdmaSocketPermission),
525        /// Permissions for the well-known SELinux "netlink_route_socket" file-like object class.
526        NetlinkRouteSocket(NetlinkRouteSocketPermission),
527        /// Permissions for the well-known SELinux "netlink_scsitransport_socket" file-like object class.
528        NetlinkScsitransportSocket(NetlinkScsitransportSocketPermission),
529        /// Permissions for the well-known SELinux "netlink_selinux_socket" file-like object class.
530        NetlinkSelinuxSocket(NetlinkSelinuxSocketPermission),
531        /// Permissions for the well-known SELinux "netlink_socket" file-like object class.
532        NetlinkSocket(NetlinkSocketPermission),
533        /// Permissions for the well-known SELinux "netlink_tcpdiag_socket" file-like object class.
534        NetlinkTcpDiagSocket(NetlinkTcpDiagSocketPermission),
535        /// Permissions for the well-known SELinux "netlink_xfrm_socket" file-like object class.
536        NetlinkXfrmSocket(NetlinkXfrmSocketPermission),
537        /// Permissions for the well-known SELinux "packet_socket" object class.
538        PacketSocket(PacketSocketPermission),
539        /// Permissions for the well-known SELinux "perf_event" object class.
540        PerfEvent(PerfEventPermission),
541        /// Permissions for the well-known SELinux "process" object class.
542        Process(ProcessPermission),
543        /// Permissions for the well-known SELinux "process2" object class.
544        Process2(Process2Permission),
545        /// Permissions for the well-known SELinux "qipcrtr_socket" object class.
546        QipcrtrSocket(QipcrtrSocketPermission),
547        /// Permissions for the well-known SELinux "rawip_socket" object class.
548        RawIpSocket(RawIpSocketPermission),
549        /// "sctp_socket" class permissions, enabled by "extended_socket_class" policy capability.
550        SctpSocket(SctpSocketPermission),
551        /// Permissions for access to parts of the "selinuxfs" used to administer and query SELinux.
552        Security(SecurityPermission),
553        /// Permissions for the well-known SELinux "sock_file" file-like object class.
554        SockFile(SockFilePermission),
555        /// Permissions for the well-known SELinux "socket" object class.
556        Socket(SocketPermission),
557        /// Permissions for the well-known SELinux "system" object class.
558        System(SystemPermission),
559        /// Permissions for the well-known SELinux "tcp_socket" object class.
560        TcpSocket(TcpSocketPermission),
561        /// Permissions for the well-known SELinux "tun_socket" object class.
562        TunSocket(TunSocketPermission),
563        /// Permissions for the well-known SELinux "udp_socket" object class.
564        UdpSocket(UdpSocketPermission),
565        /// Permissions for the well-known SELinux "unix_dgram_socket" object class.
566        UnixDgramSocket(UnixDgramSocketPermission),
567        /// Permissions for the well-known SELinux "unix_stream_socket" object class.
568        UnixStreamSocket(UnixStreamSocketPermission),
569        /// "vsock_socket" class permissions, enabled by "extended_socket_class" policy capability.
570        VSockSocket(VsockSocketPermission),
571        // keep-sorted end
572    }
573}
574
575/// Helper used to declare the set of named permissions associated with an SELinux class.
576/// The `ClassType` trait is implemented on the declared `enum`, enabling values to be wrapped into
577/// the generic `KernelPermission` container.
578/// If an "extends" type is specified then a `Common` enum case is added, encapsulating the values
579/// of that underlying permission type. This is used to represent e.g. SELinux "dir" class deriving
580/// a basic set of permissions from the common "file" symbol.
581macro_rules! class_permission_enum {
582    ($(#[$meta:meta])* $name:ident $(for $kernel_class:ident)? {
583        $($(#[$variant_meta:meta])* $variant:ident ($variant_name:literal),)*
584    }) => {
585        named_enum! {
586            #[derive(Clone, Copy, Debug, Eq, Hash, PartialEq, VariantArray)]
587            #[repr(u8)]
588            $(#[$meta])* $name {
589                $($(#[$variant_meta])* $variant ($variant_name),)*
590            }
591        }
592
593        $(impl ClassPermission for $name {
594            fn class(&self) -> KernelClass {
595                KernelClass::$kernel_class
596            }
597            fn id(&self) -> u8 {
598                *self as u8
599            }
600        })?
601    }
602}
603
604/// Permissions common to all cap-like object classes (e.g. "capability" for now and
605/// "cap_userns" after Starnix gains user namespacing support). These are combined with a
606/// specific `CapabilityClass` by policy enforcement hooks, to obtain class-affine permission
607/// values to check.
608macro_rules! cap_class_permission_enum {
609    ($(#[$meta:meta])* $name:ident $(for $kernel_class:ident)? {
610        $($(#[$variant_meta:meta])* $variant:ident ($variant_name:literal),)*
611    }) => {
612        class_permission_enum! {
613            $(#[$meta])* $ name $(for $kernel_class)? {
614                // keep-sorted start
615
616                AuditControl("audit_control"),
617                AuditWrite("audit_write"),
618                Chown("chown"),
619                DacOverride("dac_override"),
620                DacReadSearch("dac_read_search"),
621                Fowner("fowner"),
622                Fsetid("fsetid"),
623                IpcLock("ipc_lock"),
624                IpcOwner("ipc_owner"),
625                Kill("kill"),
626                Lease("lease"),
627                LinuxImmutable("linux_immutable"),
628                Mknod("mknod"),
629                NetAdmin("net_admin"),
630                NetBindService("net_bind_service"),
631                NetBroadcast("net_broadcast"),
632                NetRaw("net_raw"),
633                Setfcap("setfcap"),
634                Setgid("setgid"),
635                Setpcap("setpcap"),
636                Setuid("setuid"),
637                SysAdmin("sys_admin"),
638                SysBoot("sys_boot"),
639                SysChroot("sys_chroot"),
640                SysModule("sys_module"),
641                SysNice("sys_nice"),
642                SysPacct("sys_pacct"),
643                SysPtrace("sys_ptrace"),
644                SysRawio("sys_rawio"),
645                SysResource("sys_resource"),
646                SysTime("sys_time"),
647                SysTtyConfig("sys_tty_config"),
648
649                // keep-sorted end
650
651                // Additional permissions specific to the derived class.
652                $($(#[$variant_meta])* $variant ($variant_name),)*
653            }
654        }
655    }
656}
657
658cap_class_permission_enum! {
659    CapabilityPermission for Capability {}
660}
661
662cap_class_permission_enum! {
663    CommonCapPermission {}
664}
665
666impl ForClass<CapClass> for CommonCapPermission {
667    /// Returns the `class`-affine `KernelPermission` value corresponding to this common permission.
668    /// This is used to allow hooks to resolve e.g. common "sys_nice" permission access based on the
669    /// "allow" rules for the correct target object class.
670    fn for_class(&self, class: CapClass) -> KernelPermission {
671        match class {
672            CapClass::Capability => CapabilityPermission::from(*self).into(),
673        }
674    }
675}
676
677impl From<CommonCapPermission> for CapabilityPermission {
678    fn from(other: CommonCapPermission) -> Self {
679        // SAFETY: CapabilityPermission's values include all of CommonCapPermission.
680        unsafe { std::mem::transmute(other) }
681    }
682}
683
684/// Permissions common to all cap2-like object classes (e.g. "capability2" for now and
685/// "cap2_userns" after Starnix gains user namespacing support). These are combined with a
686/// specific `Capability2Class` by policy enforcement hooks, to obtain class-affine permission
687/// values to check.
688macro_rules! cap2_class_permission_enum {
689    ($(#[$meta:meta])* $name:ident $(for $kernel_class:ident)? {
690        $($(#[$variant_meta:meta])* $variant:ident ($variant_name:literal),)*
691    }) => {
692        class_permission_enum! {
693            $(#[$meta])* $ name $(for $kernel_class)? {
694                // keep-sorted start
695
696                AuditRead("audit_read"),
697                BlockSuspend("block_suspend"),
698                Bpf("bpf"),
699                MacAdmin("mac_admin"),
700                MacOverride("mac_override"),
701                Perfmon("perfmon"),
702                Syslog("syslog"),
703                WakeAlarm("wake_alarm"),
704
705                // keep-sorted end
706
707                // Additional permissions specific to the derived class.
708                $($(#[$variant_meta])* $variant ($variant_name),)*
709            }
710        }
711    }
712}
713
714cap2_class_permission_enum! {
715    /// Permissions for the kernel "capability" class.
716    Capability2Permission for Capability2 {}
717}
718
719cap2_class_permission_enum! {
720    /// Common symbol inherited by "capability2" and "capuser2" classes.
721    CommonCap2Permission {}
722}
723
724impl ForClass<Cap2Class> for CommonCap2Permission {
725    /// Returns the `class`-affine `KernelPermission` value corresponding to this common permission.
726    /// This is used to allow hooks to resolve e.g. common "mac_admin" permission access based on
727    /// the "allow" rules for the correct target object class.
728    fn for_class(&self, class: Cap2Class) -> KernelPermission {
729        match class {
730            Cap2Class::Capability2 => Capability2Permission::from(*self).into(),
731        }
732    }
733}
734
735impl From<CommonCap2Permission> for Capability2Permission {
736    fn from(other: CommonCap2Permission) -> Self {
737        // SAFETY: Capability2Permission's values include all of CommonCap2Permission.
738        unsafe { std::mem::transmute(other) }
739    }
740}
741
742/// Permissions meaningful for all [`crate::vfs::FsNode`]s, whether file- or socket-like.
743///
744/// This extra layer of common permissions is not reflected in the hierarchy defined by the
745/// SELinux Reference Policy. Because even common permissions are mapped per-class, by name, to
746/// the policy equivalents, the implementation and policy notions of common permissions need not
747/// be identical.
748macro_rules! fs_node_class_permission_enum {
749    ($(#[$meta:meta])* $name:ident $(for $kernel_class:ident)? {
750        $($(#[$variant_meta:meta])* $variant:ident ($variant_name:literal),)*
751    }) => {
752        class_permission_enum! {
753            $(#[$meta])* $ name $(for $kernel_class)? {
754                // keep-sorted start
755                /// Permission to append to a file or socket.
756                Append("append"),
757                /// Pseudo-permission used in `dontaudit` access-rules to allow access checks to be made
758                /// between specific sources & targets without generating audit logs.
759                AuditAccess("audit_access"),
760                /// Permission to create a file or socket.
761                Create("create"),
762                /// Permission to query attributes, including uid, gid and extended attributes.
763                GetAttr("getattr"),
764                /// Permission to execute ioctls on the file or socket.
765                Ioctl("ioctl"),
766                /// Permission to set and unset file or socket locks.
767                Lock("lock"),
768                /// Permission to map a file.
769                Map("map"),
770                /// Permission to read content from a file or socket, as well as reading or following links.
771                Read("read"),
772                /// Permission checked against the existing label when updating a node's security label.
773                RelabelFrom("relabelfrom"),
774                /// Permission checked against the new label when updating a node's security label.
775                RelabelTo("relabelto"),
776                /// Permission to modify attributes, including uid, gid and extended attributes.
777                SetAttr("setattr"),
778                /// Permission to write contents to the file or socket.
779                Write("write"),
780                // keep-sorted end
781
782                // Additional permissions specific to the derived class.
783                $($(#[$variant_meta])* $variant ($variant_name),)*
784            }
785        }
786    }
787}
788
789fs_node_class_permission_enum! {
790    CommonFsNodePermission {}
791}
792
793impl<T: Into<FsNodeClass>> ForClass<T> for CommonFsNodePermission {
794    /// Returns the `class`-affine `KernelPermission` value corresponding to this common permission.
795    /// This is used to allow hooks to resolve e.g. common "read" permission access based on the
796    /// "allow" rules for the correct target object class.
797    fn for_class(&self, class: T) -> KernelPermission {
798        match class.into() {
799            FsNodeClass::File(file_class) => {
800                CommonFilePermission::from(*self).for_class(file_class)
801            }
802            FsNodeClass::Socket(sock_class) => {
803                CommonSocketPermission::from(*self).for_class(sock_class)
804            }
805        }
806    }
807}
808
809impl From<CommonFsNodePermission> for CommonFilePermission {
810    fn from(other: CommonFsNodePermission) -> Self {
811        // SAFETY: CommonFilePermission's values include all of CommonFsNodePermission.
812        unsafe { std::mem::transmute(other) }
813    }
814}
815
816impl From<CommonFsNodePermission> for CommonSocketPermission {
817    fn from(other: CommonFsNodePermission) -> Self {
818        // SAFETY: CommonSocketPermission's values include all of CommonFsNodePermission.
819        unsafe { std::mem::transmute(other) }
820    }
821}
822
823/// Permissions common to all socket-like object classes. These are combined with a specific
824/// `SocketClass` by policy enforcement hooks, to obtain class-affine permission values.
825macro_rules! socket_class_permission_enum {
826    ($(#[$meta:meta])* $name:ident $(for $kernel_class:ident)? {
827        $($(#[$variant_meta:meta])* $variant:ident ($variant_name:literal),)*
828    }) => {
829        fs_node_class_permission_enum! {
830            $(#[$meta])* $ name $(for $kernel_class)? {
831                // keep-sorted start
832                /// Permission to accept a connection.
833                Accept("accept"),
834                /// Permission to bind to a name.
835                Bind("bind"),
836                /// Permission to initiate a connection.
837                Connect("connect"),
838                /// Permission to get socket options.
839                GetOpt("getopt"),
840                /// Permission to listen for connections.
841                Listen("listen"),
842                /// Permission to send datagrams to the socket.
843                SendTo("sendto"),
844                /// Permission to set socket options.
845                SetOpt("setopt"),
846                /// Permission to terminate connection.
847                Shutdown("shutdown"),
848                // keep-sorted end
849
850                // Additional permissions specific to the derived class.
851                $($(#[$variant_meta])* $variant ($variant_name),)*
852            }
853        }
854
855        $(impl From<CommonSocketPermission> for $name {
856            fn from(other: CommonSocketPermission) -> Self {
857                // SAFETY: $name's values include all of CommonSocketPermission.
858                let result: $name = unsafe { std::mem::transmute(other) };
859                debug_assert_eq!(result.class(), KernelClass::$kernel_class);
860                result
861            }
862        })?
863    }
864}
865
866socket_class_permission_enum! {
867    CommonSocketPermission {}
868}
869
870impl ForClass<SocketClass> for CommonSocketPermission {
871    /// Returns the `class`-affine `KernelPermission` value corresponding to this common permission.
872    /// This is used to allow hooks to resolve e.g. common "read" permission access based on the
873    /// "allow" rules for the correct target object class.
874    fn for_class(&self, class: SocketClass) -> KernelPermission {
875        match class {
876            SocketClass::Key => KeySocketPermission::from(*self).into(),
877            SocketClass::Netlink => NetlinkSocketPermission::from(*self).into(),
878            SocketClass::NetlinkAudit => NetlinkAuditSocketPermission::from(*self).into(),
879            SocketClass::NetlinkConnector => NetlinkConnectorSocketPermission::from(*self).into(),
880            SocketClass::NetlinkCrypto => NetlinkCryptoSocketPermission::from(*self).into(),
881            SocketClass::NetlinkDnrt => NetlinkDnrtSocketPermission::from(*self).into(),
882            SocketClass::NetlinkFibLookup => NetlinkFibLookupSocketPermission::from(*self).into(),
883            SocketClass::NetlinkFirewall => NetlinkFirewallSocketPermission::from(*self).into(),
884            SocketClass::NetlinkGeneric => NetlinkGenericSocketPermission::from(*self).into(),
885            SocketClass::NetlinkIp6Fw => NetlinkIp6FwSocketPermission::from(*self).into(),
886            SocketClass::NetlinkIscsi => NetlinkIscsiSocketPermission::from(*self).into(),
887            SocketClass::NetlinkKobjectUevent => {
888                NetlinkKobjectUeventSocketPermission::from(*self).into()
889            }
890            SocketClass::NetlinkNetfilter => NetlinkNetfilterSocketPermission::from(*self).into(),
891            SocketClass::NetlinkNflog => NetlinkNflogSocketPermission::from(*self).into(),
892            SocketClass::NetlinkRdma => NetlinkRdmaSocketPermission::from(*self).into(),
893            SocketClass::NetlinkRoute => NetlinkRouteSocketPermission::from(*self).into(),
894            SocketClass::NetlinkScsitransport => {
895                NetlinkScsitransportSocketPermission::from(*self).into()
896            }
897            SocketClass::NetlinkSelinux => NetlinkSelinuxSocketPermission::from(*self).into(),
898            SocketClass::NetlinkTcpDiag => NetlinkTcpDiagSocketPermission::from(*self).into(),
899            SocketClass::NetlinkXfrm => NetlinkXfrmSocketPermission::from(*self).into(),
900            SocketClass::Packet => PacketSocketPermission::from(*self).into(),
901            SocketClass::Qipcrtr => QipcrtrSocketPermission::from(*self).into(),
902            SocketClass::RawIp => RawIpSocketPermission::from(*self).into(),
903            SocketClass::Sctp => SctpSocketPermission::from(*self).into(),
904            SocketClass::Socket => SocketPermission::from(*self).into(),
905            SocketClass::Tcp => TcpSocketPermission::from(*self).into(),
906            SocketClass::Tun => TunSocketPermission::from(*self).into(),
907            SocketClass::Udp => UdpSocketPermission::from(*self).into(),
908            SocketClass::UnixDgram => UnixDgramSocketPermission::from(*self).into(),
909            SocketClass::UnixStream => UnixStreamSocketPermission::from(*self).into(),
910            SocketClass::Vsock => VsockSocketPermission::from(*self).into(),
911            SocketClass::Icmp => IcmpSocketPermission::from(*self).into(),
912        }
913    }
914}
915
916socket_class_permission_enum! {
917    KeySocketPermission for KeySocket {
918    }
919}
920
921socket_class_permission_enum! {
922    NetlinkSocketPermission for NetlinkSocket {}
923}
924
925socket_class_permission_enum! {
926    NetlinkRouteSocketPermission for NetlinkRouteSocket {
927        // keep-sorted start
928        /// Permission for nlmsg xperms.
929        Nlmsg("nlmsg"),
930        /// Permission to read the kernel routing table.
931        NlmsgRead("nlmsg_read"),
932        /// Permission to write to the kernel routing table.
933        NlmsgWrite("nlmsg_write"),
934        // keep-sorted end
935    }
936}
937
938socket_class_permission_enum! {
939    NetlinkFirewallSocketPermission for NetlinkFirewallSocket {
940    }
941}
942
943socket_class_permission_enum! {
944    NetlinkTcpDiagSocketPermission for NetlinkTcpDiagSocket {
945        // keep-sorted start
946        /// Permission for nlmsg xperms.
947        Nlmsg("nlmsg"),
948        /// Permission to request information about a protocol.
949        NlmsgRead("nlmsg_read"),
950        /// Permission to write netlink message.
951        NlmsgWrite("nlmsg_write"),
952        // keep-sorted end
953    }
954}
955
956socket_class_permission_enum! {
957    NetlinkNflogSocketPermission for NetlinkNflogSocket {
958    }
959}
960
961socket_class_permission_enum! {
962    NetlinkXfrmSocketPermission  for NetlinkXfrmSocket {
963        // keep-sorted start
964        /// Permission for nlmsg xperms.
965        Nlmsg("nlmsg"),
966        /// Permission to get IPSec configuration information.
967        NlmsgRead("nlmsg_read"),
968        /// Permission to set IPSec configuration information.
969        NlmsgWrite("nlmsg_write"),
970        // keep-sorted end
971    }
972}
973
974socket_class_permission_enum! {
975    NetlinkSelinuxSocketPermission for NetlinkSelinuxSocket {
976    }
977}
978
979socket_class_permission_enum! {
980    NetlinkIscsiSocketPermission for NetlinkIscsiSocket {
981    }
982}
983
984socket_class_permission_enum! {
985    NetlinkAuditSocketPermission for NetlinkAuditSocket {
986        // keep-sorted start
987        /// Permission for nlmsg xperms.
988        Nlmsg("nlmsg"),
989        /// Permission to query status of audit service.
990        NlmsgRead("nlmsg_read"),
991        /// Permission to list auditing configuration rules.
992        NlmsgReadPriv("nlmsg_readpriv"),
993        /// Permission to send userspace audit messages to the audit service.
994        NlmsgRelay("nlmsg_relay"),
995        /// Permission to control TTY auditing.
996        NlmsgTtyAudit("nlmsg_tty_audit"),
997        /// Permission to update the audit service configuration.
998        NlmsgWrite("nlmsg_write"),
999        // keep-sorted end
1000    }
1001}
1002
1003socket_class_permission_enum! {
1004    NetlinkFibLookupSocketPermission for NetlinkFibLookupSocket {
1005    }
1006}
1007
1008socket_class_permission_enum! {
1009    NetlinkConnectorSocketPermission for NetlinkConnectorSocket {
1010    }
1011}
1012
1013socket_class_permission_enum! {
1014    NetlinkNetfilterSocketPermission for NetlinkNetfilterSocket {
1015    }
1016}
1017
1018socket_class_permission_enum! {
1019    NetlinkIp6FwSocketPermission for NetlinkIp6FwSocket {
1020    }
1021}
1022
1023socket_class_permission_enum! {
1024    NetlinkDnrtSocketPermission for NetlinkDnrtSocket {
1025    }
1026}
1027
1028socket_class_permission_enum! {
1029    NetlinkKobjectUeventSocketPermission for NetlinkKobjectUeventSocket {
1030    }
1031}
1032
1033socket_class_permission_enum! {
1034    NetlinkGenericSocketPermission for NetlinkGenericSocket {
1035    }
1036}
1037
1038socket_class_permission_enum! {
1039    NetlinkScsitransportSocketPermission for NetlinkScsitransportSocket {
1040    }
1041}
1042
1043socket_class_permission_enum! {
1044    NetlinkRdmaSocketPermission for NetlinkRdmaSocket {
1045    }
1046}
1047
1048socket_class_permission_enum! {
1049    NetlinkCryptoSocketPermission for NetlinkCryptoSocket {
1050    }
1051}
1052
1053socket_class_permission_enum! {
1054    PacketSocketPermission for PacketSocket {
1055    }
1056}
1057
1058socket_class_permission_enum! {
1059    QipcrtrSocketPermission for QipcrtrSocket {
1060    }
1061}
1062
1063socket_class_permission_enum! {
1064    RawIpSocketPermission for RawIpSocket {
1065    }
1066}
1067
1068socket_class_permission_enum! {
1069    SctpSocketPermission for SctpSocket {
1070        // keep-sorted start
1071        /// Permission to create an SCTP association.
1072        Associate("associate"),
1073        /// Permission to `connect()` or `connectx()` an SCTP socket.
1074        NameConnect("name_connect"),
1075        /// Permission to `bind()` or `bindx()` an SCTP socket.
1076        NodeBind("node_bind"),
1077        // keep-sorted end
1078    }
1079}
1080
1081socket_class_permission_enum! {
1082    SocketPermission for Socket {
1083    }
1084}
1085
1086socket_class_permission_enum! {
1087    TcpSocketPermission for TcpSocket {
1088    }
1089}
1090
1091socket_class_permission_enum! {
1092    TunSocketPermission for TunSocket {
1093    }
1094}
1095
1096socket_class_permission_enum! {
1097    UdpSocketPermission for UdpSocket {
1098    }
1099}
1100
1101socket_class_permission_enum! {
1102    UnixStreamSocketPermission for UnixStreamSocket {
1103        // keep-sorted start
1104        /// Permission to connect a streaming Unix-domain socket.
1105        ConnectTo("connectto"),
1106        // keep-sorted end
1107    }
1108}
1109
1110socket_class_permission_enum! {
1111    UnixDgramSocketPermission for UnixDgramSocket {
1112    }
1113}
1114
1115socket_class_permission_enum! {
1116    VsockSocketPermission for VSockSocket {
1117    }
1118}
1119
1120socket_class_permission_enum! {
1121    IcmpSocketPermission for IcmpSocket {
1122        // keep-sorted start
1123        /// Permission to `bind()` an ICMP socket.
1124        NodeBind("node_bind"),
1125        // keep-sorted end
1126    }
1127}
1128
1129/// Permissions common to all file-like object classes (e.g. "lnk_file", "dir"). These are
1130/// combined with a specific `FileClass` by policy enforcement hooks, to obtain class-affine
1131/// permission values to check.
1132macro_rules! file_class_permission_enum {
1133    ($(#[$meta:meta])* $name:ident $(for $kernel_class:ident)? {
1134        $($(#[$variant_meta:meta])* $variant:ident ($variant_name:literal),)*
1135    }) => {
1136        fs_node_class_permission_enum! {
1137        $(#[$meta])* $name $(for $kernel_class)? {
1138            // keep-sorted start
1139
1140            /// Permission to execute a file with domain transition.
1141            Execute("execute"),
1142            /// Permissions to create hard link.
1143            Link("link"),
1144            /// Permission to use as mount point; only useful for directories and files.
1145            MountOn("mounton"),
1146            /// Permission to open a file.
1147            Open("open"),
1148            /// Permission to rename a file.
1149            Rename("rename"),
1150            /// Permission to delete a file or remove a hard link.
1151            Unlink("unlink"),
1152            // keep-sorted end
1153
1154            // Additional permissions specific to the derived class.
1155            $($(#[$variant_meta])* $variant ($variant_name),)*
1156        }}
1157
1158        $(impl From<CommonFilePermission> for $name {
1159            fn from(other: CommonFilePermission) -> Self {
1160                // SAFETY: $name's values include all of CommonFilePermission.
1161                let result: $name = unsafe { std::mem::transmute(other) };
1162                debug_assert_eq!(result.class(), KernelClass::$kernel_class);
1163                result
1164            }
1165        })?
1166    }
1167}
1168
1169file_class_permission_enum! {
1170    CommonFilePermission {}
1171}
1172
1173impl ForClass<FileClass> for CommonFilePermission {
1174    /// Returns the `class`-affine `KernelPermission` value corresponding to this common permission.
1175    /// This is used to allow hooks to resolve e.g. common "read" permission access based on the
1176    /// "allow" rules for the correct target object class.
1177    fn for_class(&self, class: FileClass) -> KernelPermission {
1178        match class {
1179            FileClass::AnonFsNode => AnonFsNodePermission::from(*self).into(),
1180            FileClass::Block => BlockFilePermission::from(*self).into(),
1181            FileClass::Character => CharacterFilePermission::from(*self).into(),
1182            FileClass::Dir => DirPermission::from(*self).into(),
1183            FileClass::Fifo => FifoFilePermission::from(*self).into(),
1184            FileClass::File => FilePermission::from(*self).into(),
1185            FileClass::Link => LinkFilePermission::from(*self).into(),
1186            FileClass::SockFile => SockFilePermission::from(*self).into(),
1187            FileClass::MemFdFile => MemFdFilePermission::from(*self).into(),
1188        }
1189    }
1190}
1191
1192file_class_permission_enum! {
1193    AnonFsNodePermission for AnonFsNode {
1194    }
1195}
1196
1197class_permission_enum! {
1198    BinderPermission for Binder {
1199        // keep-sorted start
1200        /// Permission to perform a binder IPC to a given target process.
1201        Call("call"),
1202        /// Permission to use a Binder connection created with a different security context.
1203        Impersonate("impersonate"),
1204        /// Permission to set oneself as a context manager.
1205        SetContextMgr("set_context_mgr"),
1206        /// Permission to transfer Binder objects as part of a Binder transaction.
1207        Transfer("transfer"),
1208        // keep-sorted end
1209    }
1210}
1211
1212file_class_permission_enum! {
1213    BlockFilePermission for Block {
1214    }
1215}
1216
1217file_class_permission_enum! {
1218    CharacterFilePermission for Character {
1219    }
1220}
1221
1222file_class_permission_enum! {
1223    DirPermission for Dir {
1224        // keep-sorted start
1225        /// Permission to add a file to the directory.
1226        AddName("add_name"),
1227        /// Permission to remove a directory.
1228        RemoveDir("rmdir"),
1229        /// Permission to remove an entry from a directory.
1230        RemoveName("remove_name"),
1231        /// Permission to change parent directory.
1232        Reparent("reparent"),
1233        /// Search access to the directory.
1234        Search("search"),
1235        // keep-sorted end
1236    }
1237}
1238
1239class_permission_enum! {
1240    FdPermission for Fd {
1241        // keep-sorted start
1242        /// Permission to use file descriptors copied/retained/inherited from another security
1243        /// context. This permission is generally used to control whether an `exec*()` call from a
1244        /// cloned process that retained a copy of the file descriptor table should succeed.
1245        Use("use"),
1246        // keep-sorted end
1247    }
1248}
1249
1250class_permission_enum! {
1251    BpfPermission for Bpf {
1252        // keep-sorted start
1253        /// Permission to create a map.
1254        MapCreate("map_create"),
1255        /// Permission to read from a map.
1256        MapRead("map_read"),
1257        /// Permission to write on a map.
1258        MapWrite("map_write"),
1259        /// Permission to load a program.
1260        ProgLoad("prog_load"),
1261        /// Permission to run a program.
1262        ProgRun("prog_run"),
1263        // keep-sorted end
1264    }
1265}
1266
1267class_permission_enum! {
1268    PerfEventPermission for PerfEvent {
1269        // keep-sorted start
1270        /// Permission to monitor the cpu.
1271        Cpu("cpu"),
1272        /// Permission to monitor the kernel.
1273        Kernel("kernel"),
1274        /// Permission to open a perf event.
1275        Open("open"),
1276        /// Permission to read a perf event.
1277        Read("read"),
1278        /// Permission to set tracepoints.
1279        Tracepoint("tracepoint"),
1280        /// Permission to write a perf event.
1281        Write("write"),
1282        // keep-sorted end
1283    }
1284}
1285
1286file_class_permission_enum! {
1287    FifoFilePermission for Fifo {
1288    }
1289}
1290
1291file_class_permission_enum! {
1292    FilePermission for File {
1293        // keep-sorted start
1294        /// Permission to use a file as an entry point into the new domain on transition.
1295        Entrypoint("entrypoint"),
1296        /// Permission to use a file as an entry point to the calling domain without performing a
1297        /// transition.
1298        ExecuteNoTrans("execute_no_trans"),
1299        // keep-sorted end
1300    }
1301}
1302
1303class_permission_enum! {
1304    FileSystemPermission for FileSystem {
1305        // keep-sorted start
1306        /// Permission to associate a file to the filesystem.
1307        Associate("associate"),
1308        /// Permission to get filesystem attributes.
1309        GetAttr("getattr"),
1310        /// Permission mount a filesystem.
1311        Mount("mount"),
1312        /// Permission to remount a filesystem with different flags.
1313        Remount("remount"),
1314        /// Permission to unmount a filesystem.
1315        Unmount("unmount"),
1316        // keep-sorted end
1317    }
1318}
1319
1320file_class_permission_enum! {
1321    LinkFilePermission for Link {
1322    }
1323}
1324
1325file_class_permission_enum! {
1326    MemFdFilePermission for MemFdFile {
1327    }
1328}
1329
1330file_class_permission_enum! {
1331    SockFilePermission for SockFile {
1332    }
1333}
1334
1335class_permission_enum! {
1336    ProcessPermission for Process {
1337        // keep-sorted start
1338        /// Permission to dynamically transition a process to a different security domain.
1339        DynTransition("dyntransition"),
1340        /// Permission to execute arbitrary code from the heap.
1341        ExecHeap("execheap"),
1342        /// Permission to execute arbitrary code from memory.
1343        ExecMem("execmem"),
1344        /// Permission to execute arbitrary code from the stack.
1345        ExecStack("execstack"),
1346        /// Permission to fork the current running process.
1347        Fork("fork"),
1348        /// Permission to get Linux capabilities of a process.
1349        GetCap("getcap"),
1350        /// Permission to get the process group ID.
1351        GetPgid("getpgid"),
1352        /// Permission to get the resource limits on a process.
1353        GetRlimit("getrlimit"),
1354        /// Permission to get scheduling policy currently applied to a process.
1355        GetSched("getsched"),
1356        /// Permission to get the session ID.
1357        GetSession("getsession"),
1358        /// Permission to exec into a new security domain without setting the AT_SECURE entry in the
1359        /// executable's auxiliary vector.
1360        NoAtSecure("noatsecure"),
1361        /// Permission to trace a process.
1362        Ptrace("ptrace"),
1363        /// Permission to inherit the parent process's resource limits on exec.
1364        RlimitInh("rlimitinh"),
1365        /// Permission to set Linux capabilities of a process.
1366        SetCap("setcap"),
1367        /// Permission to set the calling task's current Security Context.
1368        /// The "dyntransition" permission separately limits which Contexts "setcurrent" may be used to transition to.
1369        SetCurrent("setcurrent"),
1370        /// Permission to set the Security Context used by `exec()`.
1371        SetExec("setexec"),
1372        /// Permission to set the Security Context used when creating filesystem objects.
1373        SetFsCreate("setfscreate"),
1374        /// Permission to set the Security Context used when creating kernel keyrings.
1375        SetKeyCreate("setkeycreate"),
1376        /// Permission to set the process group ID.
1377        SetPgid("setpgid"),
1378        /// Permission to set the resource limits on a process.
1379        SetRlimit("setrlimit"),
1380        /// Permission to set scheduling policy for a process.
1381        SetSched("setsched"),
1382        /// Permission to set the Security Context used when creating new labeled sockets.
1383        SetSockCreate("setsockcreate"),
1384        /// Permission to share resources (e.g. FD table, address-space, etc) with a process.
1385        Share("share"),
1386        /// Permission to send SIGCHLD to a process.
1387        SigChld("sigchld"),
1388        /// Permission to inherit the parent process's signal state.
1389        SigInh("siginh"),
1390        /// Permission to send SIGKILL to a process.
1391        SigKill("sigkill"),
1392        /// Permission to send SIGSTOP to a process.
1393        SigStop("sigstop"),
1394        /// Permission to send a signal other than SIGKILL, SIGSTOP, or SIGCHLD to a process.
1395        Signal("signal"),
1396        /// Permission to transition to a different security domain.
1397        Transition("transition"),
1398        // keep-sorted end
1399    }
1400}
1401
1402class_permission_enum! {
1403    Process2Permission for Process2 {
1404        // keep-sorted start
1405        /// Permission to transition to an unbounded domain when no-new-privileges is set.
1406        NnpTransition("nnp_transition"),
1407        /// Permission to transition domain when executing from a no-SUID mounted filesystem.
1408        NosuidTransition("nosuid_transition"),
1409        // keep-sorted end
1410    }
1411}
1412
1413class_permission_enum! {
1414    SecurityPermission for Security {
1415        // keep-sorted start
1416        /// Permission to validate Security Context using the "context" API.
1417        CheckContext("check_context"),
1418        /// Permission to compute access vectors via the "access" API.
1419        ComputeAv("compute_av"),
1420        /// Permission to compute security contexts based on `type_transition` rules via "create".
1421        ComputeCreate("compute_create"),
1422        /// Permission to compute security contexts based on `type_member` rules via "member".
1423        ComputeMember("compute_member"),
1424        /// Permission to compute security contexts based on `type_change` rules via "relabel".
1425        ComputeRelabel("compute_relabel"),
1426        /// Permission to compute user decisions via "user".
1427        ComputeUser("compute_user"),
1428        /// Permission to load a new binary policy into the kernel via the "load" API.
1429        LoadPolicy("load_policy"),
1430        /// Permission to commit booleans to control conditional elements of the policy.
1431        SetBool("setbool"),
1432        /// Permission to change the way permissions are validated for `mmap()` operations.
1433        SetCheckReqProt("setcheckreqprot"),
1434        /// Permission to switch the system between permissive and enforcing modes, via "enforce".
1435        SetEnforce("setenforce"),
1436        // keep-sorted end
1437     }
1438}
1439
1440class_permission_enum! {
1441    SystemPermission for System {
1442        // keep-sorted start
1443        /// Permission to use the syslog(2) CONSOLE action types.
1444        SyslogConsole("syslog_console"),
1445        /// Permission to use other syslog(2) action types.
1446        SyslogMod("syslog_mod"),
1447        /// Permission to use the syslog(2) READ_ALL related action types.
1448        SyslogRead("syslog_read"),
1449        // keep-sorted end
1450     }
1451}
selinux/kernel_permissions.rs

selinux/
kernel_permissions.rs
