selinux/new_policy/
policy_cap.rs

1// Copyright 2026 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5use super::error::ValidateError;
6use super::traits::{PolicyId, Validate};
7use super::{NewPolicy, bitmap};
8use strum::VariantArray as _;
9use strum_macros::VariantArray;
10
11/// Reference policy capability Ids.
12#[derive(Clone, Copy, Debug, Eq, Hash, Ord, PartialEq, PartialOrd, VariantArray)]
13pub enum PolicyCap {
14    NetworkPeerControls = 0,
15    OpenPerms = 1,
16    ExtendedSocketClass = 2,
17    AlwaysCheckNetwork = 3,
18    CgroupSeclabel = 4,
19    NnpNosuidTransition = 5,
20    GenfsSeclabelSymlinks = 6,
21    IoctlSkipCloexec = 7,
22    UserspaceInitialContext = 8,
23    NetlinkXperm = 9,
24    NetifWildcard = 10,
25    GenfsSeclabelWildcard = 11,
26    FunctionfsSeclabel = 12,
27    MemfdClass = 13,
28}
29
30impl PolicyCap {
31    pub fn name(&self) -> &str {
32        match self {
33            Self::NetworkPeerControls => "network_peer_controls",
34            Self::OpenPerms => "open_perms",
35            Self::ExtendedSocketClass => "extended_socket_class",
36            Self::AlwaysCheckNetwork => "always_check_network",
37            Self::CgroupSeclabel => "cgroup_seclabel",
38            Self::NnpNosuidTransition => "nnp_nosuid_transition",
39            Self::GenfsSeclabelSymlinks => "genfs_seclabel_symlinks",
40            Self::IoctlSkipCloexec => "ioctl_skip_cloexec",
41            Self::UserspaceInitialContext => "userspace_initial_context",
42            Self::NetlinkXperm => "netlink_xperm",
43            Self::NetifWildcard => "netif_wildcard",
44            Self::GenfsSeclabelWildcard => "genfs_seclabel_wildcard",
45            Self::FunctionfsSeclabel => "functionfs_seclabel",
46            Self::MemfdClass => "memfd_class",
47        }
48    }
49
50    pub fn by_name(name: &str) -> Option<Self> {
51        Self::VARIANTS.iter().find(|x| x.name() == name).copied()
52    }
53}
54
55/// Set of enabled policy capabilities.
56pub type PolicyCapSet = bitmap::IdSet<PolicyCap, true>;
57
58impl PolicyId for PolicyCap {
59    fn as_u32(&self) -> u32 {
60        *self as u32
61    }
62
63    fn from_u32(value: u32) -> Option<Self> {
64        Self::VARIANTS.get(value as usize).copied()
65    }
66}
67
68impl Validate for PolicyCap {
69    fn validate(&self, _policy: &NewPolicy) -> Result<(), ValidateError> {
70        Ok(())
71    }
72}
73
74#[cfg(test)]
75mod tests {
76    use super::*;
77
78    #[test]
79    fn policy_capabilities() {
80        for capability in PolicyCap::VARIANTS {
81            assert_eq!(Some(*capability), PolicyCap::by_name(capability.name()));
82        }
83    }
84}
selinux/new_policy/policy_cap.rs

selinux/new_policy/
policy_cap.rs
