From 287f507657e162bc09b5c186bbd580901fbc942a Mon Sep 17 00:00:00 2001

From: Dan Walsh <dwalsh@redhat.com>

Date: Tue, 20 Sep 2011 15:47:28 -0400

Subject: [PATCH 6/6] Changes to support named file_trans rules

---

 libapol/include/apol/ftrule-query.h |  198 +++++++++++++++++++

 libapol/include/apol/policy-query.h |    1 +

 libapol/src/Makefile.am             |    1 +

 libapol/src/ftrule-query.c          |  363 +++++++++++++++++++++++++++++++++++

 libapol/src/libapol.map             |    1 +

 libqpol/include/qpol/ftrule_query.h |  116 +++++++++++

 libqpol/include/qpol/policy.h       |    1 +

 libqpol/src/Makefile.am             |    1 +

 libqpol/src/ftrule_query.c          |  277 ++++++++++++++++++++++++++

 libqpol/src/libqpol.map             |    1 +

 libqpol/src/module_compiler.c       |   12 ++

 libqpol/src/policy_define.c         |  186 ++++++++++++++++++-

 libqpol/src/policy_parse.y          |   13 +-

 libqpol/src/policy_scan.l           |    1 +

 secmds/sesearch.c                   |  101 ++++++++++

 15 files changed, 1270 insertions(+), 3 deletions(-)

 create mode 100644 libapol/include/apol/ftrule-query.h

 create mode 100644 libapol/src/ftrule-query.c

 create mode 100644 libqpol/include/qpol/ftrule_query.h

 create mode 100644 libqpol/src/ftrule_query.c

diff --git a/libapol/include/apol/ftrule-query.h b/libapol/include/apol/ftrule-query.h

new file mode 100644

index 0000000..119c52f

--- /dev/null

+++ b/libapol/include/apol/ftrule-query.h

@@ -0,0 +1,198 @@

+/**

+ * @file

+ *

+ * Routines to query filename_transition rules of a

+ * policy.  

+ *

+ * @author Jeremy A. Mowery jmowery@tresys.com

+ * @author Jason Tang  jtang@tresys.com

+ *

+ * Copyright (C) 2006-2007 Tresys Technology, LLC

+ *

+ *  This library is free software; you can redistribute it and/or

+ *  modify it under the terms of the GNU Lesser General Public

+ *  License as published by the Free Software Foundation; either

+ *  version 2.1 of the License, or (at your option) any later version.

+ *

+ *  This library is distributed in the hope that it will be useful,

+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of

+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

+ *  Lesser General Public License for more details.

+ *

+ *  You should have received a copy of the GNU Lesser General Public

+ *  License along with this library; if not, write to the Free Software

+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA

+ */

+

+#ifndef APOL_FILENAMERULE_QUERY_H

+#define APOL_FILENAMERULE_QUERY_H

+

+#ifdef	__cplusplus

+extern "C"

+{

+#endif

+

+#include "policy.h"

+#include "vector.h"

+#include <qpol/policy.h>

+

+	typedef struct apol_filename_trans_query apol_filename_trans_query_t;

+

+

+/******************** filename_transition queries ********************/

+

+/**

+ * Execute a query against all filename_transition rules within the

+ * policy.

+ *

+ * @param p Policy within which to look up filename_transition rules.

+ * @param r Structure containing parameters for query.	If this is

+ * NULL then return all filename_transition rules.

+ * @param v Reference to a vector of qpol_filename_trans_t.  The vector

+ * will be allocated by this function.  The caller must call

+ * apol_vector_destroy() afterwards.  This will be set to NULL upon no

+ * results or upon error.

+ *

+ * @return 0 on success (including none found), negative on error.

+ */

+	extern int apol_filename_trans_get_by_query(const apol_policy_t * p, const apol_filename_trans_query_t * r, apol_vector_t ** v);

+

+/**

+ * Allocate and return a new filename trans query structure.  All fields

+ * are initialized, such that running this blank query results in

+ * returning all filename_transitions within the policy.  The caller must

+ * call apol_filename_trans_query_destroy() upon the return value

+ * afterwards.

+ *

+ * @return An initialized filename trans query structure, or NULL upon

+ * error.

+ */

+	extern apol_filename_trans_query_t *apol_filename_trans_query_create(void);

+

+/**

+ * Deallocate all memory associated with the referenced filename trans

+ * query, and then set it to NULL.  This function does nothing if the

+ * query is already NULL.

+ *

+ * @param r Reference to a filename trans query structure to destroy.

+ */

+	extern void apol_filename_trans_query_destroy(apol_filename_trans_query_t ** r);

+

+/**

+ * Set a filename_trans query to return rules whose source symbol matches

+ * symbol.  Symbol may be a type or attribute; if it is an alias then

+ * the query will convert it to its primary prior to searching.  If

+ * is_indirect is non-zero then the search will be done indirectly.

+ * If the symbol is a type, then the query matches rules with one of

+ * the type's attributes.  If the symbol is an attribute, then it

+ * matches rule with any of the attribute's types.

+ *

+ * @param p Policy handler, to report errors.

+ * @param t TE rule query to set.

+ * @param symbol Limit query to rules with this symbol as their

+ * source, or NULL to unset this field.

+ * @param is_indirect If non-zero, perform indirect matching.

+ *

+ * @return 0 on success, negative on error.

+ */

+	extern int apol_filename_trans_query_set_source(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *symbol,

+						int is_indirect);

+

+/**

+ * Set a filename trans query to return rules with a particular target

+ * symbol.  Symbol may be a type or attribute; if it is an alias then

+ * the query will convert it to its primary prior to searching.  If

+ * is_indirect is non-zero then the search will be done indirectly.

+ * If the symbol is a type, then the query matches rules with one of

+ * the type's attributes.  If the symbol is an attribute, then it

+ * matches rule with any of the attribute's types.

+ *

+ * @param p Policy handler, to report errors.

+ * @param r Role trans query to set.

+ * @param symbol Limit query to rules with this type or attribute as

+ * their target, or NULL to unset this field.

+ * @param is_indirect If non-zero, perform indirect matching.

+ *

+ * @return 0 on success, negative on error.

+ */

+	extern int apol_filename_trans_query_set_target(const apol_policy_t * p, apol_filename_trans_query_t * r, const char *symbol,

+						    int is_indirect);

+

+/**

+ * Set a filename trans query to return rules with a particular default

+ * filename.  This field is ignored if

+ * apol_filename_trans_query_set_source_any() is set to non-zero.

+ *

+ * @param p Policy handler, to report errors.

+ * @param r Role trans query to set.

+ * @param filename Limit query to rules with this filename as their default, or

+ * NULL to unset this field.

+ *

+ * @return 0 on success, negative on error.

+ */

+	extern int apol_filename_trans_query_set_default(const apol_policy_t * p, apol_filename_trans_query_t * r, const char *filename);

+

+/**

+ * Set at filename_trans query to return rules with this object (non-common)

+ * class.  If more than one class are appended to the query, the

+ * rule's class must be one of those appended.  (I.e., the rule's

+ * class must be a member of the query's classes.)  Pass a NULL to

+ * clear all classes.  Note that this performs straight string

+ * comparison, ignoring the regex flag.

+

+ *

+ * @param p Policy handler, to report errors.

+ * @param t TE rule query to set.

+ * @param obj_class Name of object class to add to search set.

+ *

+ * @return 0 on success, negative on error.

+ */

+	extern int apol_filename_trans_query_append_class(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *obj_class);

+

+/**

+ * Set a filename trans query to treat the source filename as any.  That is,

+ * use the same symbol for either source or default of a

+ * filename_transition rule.  This flag does nothing if the source filename is

+ * not set.  Note that a filename_transition's target is a type, so thus

+ * this flag does not affect its searching.

+ *

+ * @param p Policy handler, to report errors.

+ * @param r Role trans query to set.

+ * @param is_any Non-zero to use source symbol for source or default

+ * field, 0 to keep source as only source.

+ *

+ * @return Always 0.

+ */

+	extern int apol_filename_trans_query_set_source_any(const apol_policy_t * p, apol_filename_trans_query_t * r, int is_any);

+

+/**

+ * Set a filename trans query to use regular expression searching for

+ * source, target, and default fields.  Strings will be treated as

+ * regexes instead of literals.  For the target type, matching will

+ * occur against the type name or any of its aliases.

+ *

+ * @param p Policy handler, to report errors.

+ * @param r Role trans query to set.

+ * @param is_regex Non-zero to enable regex searching, 0 to disable.

+ *

+ * @return Always 0.

+ */

+	extern int apol_filename_trans_query_set_regex(const apol_policy_t * p, apol_filename_trans_query_t * r, int is_regex);

+

+/**

+ *  Render a filename_transition rule to a string.

+ *

+ *  @param policy Policy handler, to report errors.

+ *  @param rule The rule to render.

+ *

+ *  @return A newly malloc()'d string representation of the rule, or NULL on

+ *  failure; if the call fails, errno will be set. The caller is responsible

+ *  for calling free() on the returned string.

+ */

+	extern char *apol_filename_trans_render(const apol_policy_t * policy, const qpol_filename_trans_t * rule);

+

+#ifdef	__cplusplus

+}

+#endif

+

+#endif

diff --git a/libapol/include/apol/policy-query.h b/libapol/include/apol/policy-query.h

index 315f70e..665e4cb 100644

--- a/libapol/include/apol/policy-query.h

+++ b/libapol/include/apol/policy-query.h

@@ -71,6 +71,7 @@ extern "C"

 #include "terule-query.h"

 #include "condrule-query.h"

 #include "rbacrule-query.h"

+#include "ftrule-query.h"

 #include "range_trans-query.h"

 #include "constraint-query.h"

diff --git a/libapol/src/Makefile.am b/libapol/src/Makefile.am

index 3fa4f06..baaa4f6 100644

--- a/libapol/src/Makefile.am

+++ b/libapol/src/Makefile.am

@@ -40,6 +40,7 @@ libapol_a_SOURCES = \

 	render.c \

 	role-query.c \

 	terule-query.c \

+	ftrule-query.c \

 	type-query.c \

 	types-relation-analysis.c \

 	user-query.c \

diff --git a/libapol/src/ftrule-query.c b/libapol/src/ftrule-query.c

new file mode 100644

index 0000000..dc248de

--- /dev/null

+++ b/libapol/src/ftrule-query.c

@@ -0,0 +1,363 @@

+/**

+ * @file

+ *

+ * Provides a way for setools to make queries about type enforcement

+ * filename_transs within a policy.  The caller obtains a query object, fills in

+ * its parameters, and then runs the query; it obtains a vector of

+ * results.  Searches are conjunctive -- all fields of the search

+ * query must match for a datum to be added to the results query.

+ *

+ * @author Jeremy A. Mowery jmowery@tresys.com

+ * @author Jason Tang  jtang@tresys.com

+ *

+ * Copyright (C) 2006-2007 Tresys Technology, LLC

+ *

+ *  This library is free software; you can redistribute it and/or

+ *  modify it under the terms of the GNU Lesser General Public

+ *  License as published by the Free Software Foundation; either

+ *  version 2.1 of the License, or (at your option) any later version.

+ *

+ *  This library is distributed in the hope that it will be useful,

+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of

+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

+ *  Lesser General Public License for more details.

+ *

+ *  You should have received a copy of the GNU Lesser General Public

+ *  License along with this library; if not, write to the Free Software

+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA

+ */

+

+#include "policy-query-internal.h"

+

+#include <errno.h>

+#include <string.h>

+

+struct apol_filename_trans_query

+{

+	char *source, *target, *default_type, *name;

+	apol_vector_t *classes;

+	unsigned int flags;

+};

+

+

+/******************** filename_transition queries ********************/

+

+int apol_filename_trans_get_by_query(const apol_policy_t * p, const apol_filename_trans_query_t * t, apol_vector_t ** v)

+{

+	apol_vector_t *source_list = NULL, *target_list = NULL, *class_list = NULL, *default_list = NULL;

+	int retval = -1, source_as_any = 0, is_regex = 0, append_filename_trans;

+	char *bool_name = NULL;

+	*v = NULL;

+	unsigned int flags = 0;

+	qpol_iterator_t *iter = NULL, *type_iter = NULL;

+

+	if (t != NULL) {

+		flags = t->flags;

+		is_regex = t->flags & APOL_QUERY_REGEX;

+		if (t->source != NULL &&

+		    (source_list =

+		     apol_query_create_candidate_type_list(p, t->source, is_regex,

+							   t->flags & APOL_QUERY_SOURCE_INDIRECT,

+							   ((t->flags & (APOL_QUERY_SOURCE_TYPE | APOL_QUERY_SOURCE_ATTRIBUTE)) /

+							    APOL_QUERY_SOURCE_TYPE))) == NULL) {

+			goto cleanup;

+		}

+

+		if ((t->flags & APOL_QUERY_SOURCE_AS_ANY) && t->source != NULL) {

+			default_list = target_list = source_list;

+			source_as_any = 1;

+		} else {

+			if (t->target != NULL &&

+			    (target_list =

+			     apol_query_create_candidate_type_list(p, t->target, is_regex,

+								   t->flags & APOL_QUERY_TARGET_INDIRECT,

+								   ((t->

+								     flags & (APOL_QUERY_TARGET_TYPE | APOL_QUERY_TARGET_ATTRIBUTE))

+								    / APOL_QUERY_TARGET_TYPE))) == NULL) {

+				goto cleanup;

+			}

+			if (t->default_type != NULL &&

+			    (default_list =

+			     apol_query_create_candidate_type_list(p, t->default_type, is_regex, 0,

+								   APOL_QUERY_SYMBOL_IS_TYPE)) == NULL) {

+				goto cleanup;

+			}

+		}

+		if (t->classes != NULL &&

+		    apol_vector_get_size(t->classes) > 0 &&

+		    (class_list = apol_query_create_candidate_class_list(p, t->classes)) == NULL) {

+			goto cleanup;

+		}

+	}

+

+	if (qpol_policy_get_filename_trans_iter(p->p, &iter) < 0) {

+		return -1;

+	}

+

+	if ((*v = apol_vector_create(NULL)) == NULL) {

+		ERR(p, "%s", strerror(errno));

+		goto cleanup;

+	}

+

+	for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) {

+		qpol_filename_trans_t *filename_trans;

+		if (qpol_iterator_get_item(iter, (void **)&filename_trans) < 0) {

+			goto cleanup;

+		}

+		int match_source = 0, match_target = 0, match_default = 0, match_bool = 0;

+		size_t i;

+

+		if (source_list == NULL) {

+			match_source = 1;

+		} else {

+			const qpol_type_t *source_type;

+			if (qpol_filename_trans_get_source_type(p->p, filename_trans, &source_type) < 0) {

+				goto cleanup;

+			}

+			if (apol_vector_get_index(source_list, source_type, NULL, NULL, &i) == 0) {

+				match_source = 1;

+			}

+		}

+

+		/* if source did not match, but treating source symbol

+		 * as any field, then delay rejecting this filename_trans until

+		 * the target and default have been checked */

+		if (!source_as_any && !match_source) {

+			continue;

+		}

+

+		if (target_list == NULL || (source_as_any && match_source)) {

+			match_target = 1;

+		} else {

+			const qpol_type_t *target_type;

+			if (qpol_filename_trans_get_target_type(p->p, filename_trans, &target_type) < 0) {

+				goto cleanup;

+			}

+			if (apol_vector_get_index(target_list, target_type, NULL, NULL, &i) == 0) {

+				match_target = 1;

+			}

+		}

+

+		if (!source_as_any && !match_target) {

+			continue;

+		}

+

+		if (default_list == NULL || (source_as_any && match_source) || (source_as_any && match_target)) {

+			match_default = 1;

+		} else {

+			const qpol_type_t *default_type;

+			if (qpol_filename_trans_get_default_type(p->p, filename_trans, &default_type) < 0) {

+				goto cleanup;

+			}

+			if (apol_vector_get_index(default_list, default_type, NULL, NULL, &i) == 0) {

+				match_default = 1;

+			}

+		}

+

+		if (!source_as_any && !match_default) {

+			continue;

+		}

+		/* at least one thing must match if source_as_any was given */

+		if (source_as_any && (!match_source && !match_target && !match_default)) {

+			continue;

+		}

+

+		if (class_list != NULL) {

+			const qpol_class_t *obj_class;

+			if (qpol_filename_trans_get_object_class(p->p, filename_trans, &obj_class) < 0) {

+				goto cleanup;

+			}

+			if (apol_vector_get_index(class_list, obj_class, NULL, NULL, &i) < 0) {

+				continue;

+			}

+		}

+

+		if (apol_vector_append(*v, filename_trans)) {

+			ERR(p, "%s", strerror(ENOMEM));

+			goto cleanup;

+		}

+	}

+

+	retval = 0;

+      cleanup:

+	if (retval != 0) {

+		apol_vector_destroy(v);

+	}

+	apol_vector_destroy(&source_list);

+	if (!source_as_any) {

+		apol_vector_destroy(&target_list);

+		apol_vector_destroy(&default_list);

+	}

+	apol_vector_destroy(&class_list);

+	return retval;

+}

+

+apol_filename_trans_query_t *apol_filename_trans_query_create(void)

+{

+	apol_filename_trans_query_t *t = calloc(1, sizeof(apol_filename_trans_query_t));

+	if (t != NULL) {

+		t->flags =

+			(APOL_QUERY_SOURCE_TYPE | APOL_QUERY_SOURCE_ATTRIBUTE | APOL_QUERY_TARGET_TYPE |

+			 APOL_QUERY_TARGET_ATTRIBUTE);

+	}

+	return t;

+}

+

+void apol_filename_trans_query_destroy(apol_filename_trans_query_t ** r)

+{

+	if (r != NULL && *r != NULL) {

+		free((*r)->source);

+		free((*r)->target);

+		free((*r)->default_type);

+		free((*r)->name);

+		free(*r);

+		*r = NULL;

+	}

+}

+

+int apol_filename_trans_query_set_source(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *filename, int is_indirect)

+{

+	apol_query_set_flag(p, &t->flags, is_indirect, APOL_QUERY_TARGET_INDIRECT);

+	return apol_query_set(p, &t->source, NULL, filename);

+}

+

+int apol_filename_trans_query_set_target(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *type, int is_indirect)

+{

+	apol_query_set_flag(p, &t->flags, is_indirect, APOL_QUERY_TARGET_INDIRECT);

+	return apol_query_set(p, &t->target, NULL, type);

+}

+

+int apol_filename_trans_query_set_default(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *symbol)

+{

+	return apol_query_set(p, &t->default_type, NULL, symbol);

+}

+

+int apol_filename_trans_query_append_class(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *obj_class)

+{

+	char *s = NULL;

+	if (obj_class == NULL) {

+		apol_vector_destroy(&t->classes);

+	} else if ((s = strdup(obj_class)) == NULL || (t->classes == NULL && (t->classes = apol_vector_create(free)) == NULL)

+		   || apol_vector_append(t->classes, s) < 0) {

+		ERR(p, "%s", strerror(errno));

+		free(s);

+		return -1;

+	}

+	return 0;

+}

+

+int apol_filename_trans_query_set_name(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *filename)

+{

+	return apol_query_set(p, &t->name, NULL, filename);

+}

+

+int apol_filename_trans_query_set_source_any(const apol_policy_t * p, apol_filename_trans_query_t * t, int is_any)

+{

+	return apol_query_set_flag(p, &t->flags, is_any, APOL_QUERY_SOURCE_AS_ANY);

+}

+

+int apol_filename_trans_query_set_regex(const apol_policy_t * p, apol_filename_trans_query_t * t, int is_regex)

+{

+	return apol_query_set_regex(p, &t->flags, is_regex);

+}

+

+char *apol_filename_trans_render(const apol_policy_t * policy, const qpol_filename_trans_t * filename_trans)

+{

+	char *tmp = NULL;

+	const char *tmp_name = NULL;

+	const char *filename_trans_type_str;

+	int error = 0;

+	size_t tmp_sz = 0;

+	uint32_t filename_trans_type = 0;

+	const qpol_type_t *type = NULL;

+	const qpol_class_t *obj_class = NULL;

+

+	if (!policy || !filename_trans) {

+		ERR(policy, "%s", strerror(EINVAL));

+		errno = EINVAL;

+		return NULL;

+	}

+

+	/* source type */

+	if (qpol_filename_trans_get_source_type(policy->p, filename_trans, &type)) {

+		error = errno;

+		goto err;

+	}

+	if (qpol_type_get_name(policy->p, type, &tmp_name)) {

+		error = errno;

+		goto err;

+	}

+	if (apol_str_appendf(&tmp, &tmp_sz, "transition_type %s ", tmp_name)) {

+		error = errno;

+		ERR(policy, "%s", strerror(error));

+		goto err;

+	}

+

+	/* target type */

+	if (qpol_filename_trans_get_target_type(policy->p, filename_trans, &type)) {

+		error = errno;

+		goto err;

+	}

+	if (qpol_type_get_name(policy->p, type, &tmp_name)) {

+		error = errno;

+		goto err;

+	}

+	if (apol_str_appendf(&tmp, &tmp_sz, "%s : ", tmp_name)) {

+		error = errno;

+		ERR(policy, "%s", strerror(error));

+		goto err;

+	}

+

+	/* object class */

+	if (qpol_filename_trans_get_object_class(policy->p, filename_trans, &obj_class)) {

+		error = errno;

+		goto err;

+	}

+	if (qpol_class_get_name(policy->p, obj_class, &tmp_name)) {

+		error = errno;

+		goto err;

+	}

+	if (apol_str_appendf(&tmp, &tmp_sz, "%s ", tmp_name)) {

+		error = errno;

+		ERR(policy, "%s", strerror(error));

+		goto err;

+	}

+

+	/* default type */

+	if (qpol_filename_trans_get_default_type(policy->p, filename_trans, &type)) {

+		error = errno;

+		goto err;

+	}

+	if (qpol_type_get_name(policy->p, type, &tmp_name)) {

+		error = errno;

+		goto err;

+	}

+	if (apol_str_appendf(&tmp, &tmp_sz, "%s", tmp_name)) {

+		error = errno;

+		ERR(policy, "%s", strerror(error));

+		goto err;

+	}

+

+	if (qpol_filename_trans_get_filename(policy->p, filename_trans, &tmp_name)) {

+		error = errno;

+		goto err;

+	}

+

+	if (apol_str_appendf(&tmp, &tmp_sz, " %s", tmp_name)) {

+		error = errno;

+		ERR(policy, "%s", strerror(error));

+		goto err;

+	}

+

+	if (apol_str_appendf(&tmp, &tmp_sz, ";")) {

+		error = errno;

+		ERR(policy, "%s", strerror(error));

+		goto err;

+	}

+	return tmp;

+

+      err:

+	free(tmp);

+	errno = error;

+	return NULL;

+}

diff --git a/libapol/src/libapol.map b/libapol/src/libapol.map

index 4894374..7657a2d 100644

--- a/libapol/src/libapol.map

+++ b/libapol/src/libapol.map

@@ -34,6 +34,7 @@ VERS_4.0{

 		apol_protocol_to_str;

 		apol_qpol_context_render;

 		apol_range_trans_*;

+		apol_filename_trans_*;

 		apol_relabel_*;

 		apol_role_*;

 		apol_role_allow_*;

diff --git a/libqpol/include/qpol/ftrule_query.h b/libqpol/include/qpol/ftrule_query.h

new file mode 100644

index 0000000..1f533a4

--- /dev/null

+++ b/libqpol/include/qpol/ftrule_query.h

@@ -0,0 +1,116 @@

+/**

+ *  @file

+ *  Defines public interface for iterating over FTRULE rules.

+ *

+ *  @author Kevin Carr kcarr@tresys.com

+ *  @author Jeremy A. Mowery jmowery@tresys.com

+ *  @author Jason Tang jtang@tresys.com

+ *

+ *  Copyright (C) 2006-2007 Tresys Technology, LLC

+ *

+ *  This library is free software; you can redistribute it and/or

+ *  modify it under the terms of the GNU Lesser General Public

+ *  License as published by the Free Software Foundation; either

+ *  version 2.1 of the License, or (at your option) any later version.

+ *

+ *  This library is distributed in the hope that it will be useful,

+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of

+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

+ *  Lesser General Public License for more details.

+ *

+ *  You should have received a copy of the GNU Lesser General Public

+ *  License along with this library; if not, write to the Free Software

+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA

+ */

+

+#ifndef QPOL_FTRULERULE_QUERY

+#define QPOL_FTRULERULE_QUERY

+

+#ifdef	__cplusplus

+extern "C"

+{

+#endif

+

+#include <qpol/policy.h>

+#include <qpol/iterator.h>

+

+	typedef struct qpol_filename_trans qpol_filename_trans_t;

+

+/**

+ *  Get an iterator over all filename transition rules in the policy.

+ *  @param policy Policy from which to create the iterator.

+ *  @param iter Iterator over items of type qpol_filename_trans_t returned.

+ *  The caller is responsible for calling qpol_iterator_destroy()

+ *  to free memory used by this iterator.

+ *  It is important to note that this iterator is only valid as long as

+ *  the policy is unmodifed.

+ *  @returm 0 on success and < 0 on failure; if the call fails,

+ *  errno will be set and *iter will be NULL.

+ */

+	extern int qpol_policy_get_filename_trans_iter(const qpol_policy_t * policy, qpol_iterator_t ** iter);

+

+/**

+ *  Get the source type from a filename transition rule.

+ *  @param policy The policy from which the rule comes.

+ *  @param rule The rule from which to get the source type.

+ *  @param source Pointer in which to store the source type.

+ *  The caller should not free this pointer.

+ *  @return 0 on success and < 0 on failure; if the call fails,

+ *  errno will be set and *source will be NULL.

+ */

+	extern int qpol_filename_trans_get_source_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,

+						   const qpol_type_t ** source);

+

+/**

+ *  Get the target type from a filename transition rule.

+ *  @param policy The policy from which the rule comes.

+ *  @param rule The rule from which to get the target type.

+ *  @param target Pointer in which to store the target type.

+ *  The caller should not free this pointer.

+ *  @return 0 on success and < 0 on failure; if the call fails,

+ *  errno will be set and *target will be NULL.

+ */

+	extern int qpol_filename_trans_get_target_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,

+						   const qpol_type_t ** target);

+

+/**

+ *  Get the default type from a type rule.