Orange Pi5 kernel

^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  1) /* SPDX-License-Identifier: GPL-2.0 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  3)  * A constraint is a condition that must be satisfied in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  4)  * order for one or more permissions to be granted.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  5)  * Constraints are used to impose additional restrictions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  6)  * beyond the type-based rules in `te' or the role-based
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  7)  * transition rules in `rbac'.  Constraints are typically
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  8)  * used to prevent a process from transitioning to a new user
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  9)  * identity or role unless it is in a privileged type.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10)  * Constraints are likewise typically used to prevent a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11)  * process from labeling an object with a different user
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12)  * identity.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14)  * Author : Stephen Smalley, <sds@tycho.nsa.gov>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #ifndef _SS_CONSTRAINT_H_
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #define _SS_CONSTRAINT_H_
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #include "ebitmap.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) #define CEXPR_MAXDEPTH 5
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) struct constraint_expr {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) #define CEXPR_NOT		1 /* not expr */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) #define CEXPR_AND		2 /* expr and expr */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) #define CEXPR_OR		3 /* expr or expr */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) #define CEXPR_ATTR		4 /* attr op attr */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) #define CEXPR_NAMES		5 /* attr op names */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) 	u32 expr_type;		/* expression type */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) #define CEXPR_USER 1		/* user */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) #define CEXPR_ROLE 2		/* role */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) #define CEXPR_TYPE 4		/* type */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) #define CEXPR_TARGET 8		/* target if set, source otherwise */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) #define CEXPR_XTARGET 16	/* special 3rd target for validatetrans rule */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) #define CEXPR_L1L2 32		/* low level 1 vs. low level 2 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) #define CEXPR_L1H2 64		/* low level 1 vs. high level 2 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) #define CEXPR_H1L2 128		/* high level 1 vs. low level 2 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) #define CEXPR_H1H2 256		/* high level 1 vs. high level 2 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) #define CEXPR_L1H1 512		/* low level 1 vs. high level 1 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) #define CEXPR_L2H2 1024		/* low level 2 vs. high level 2 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) 	u32 attr;		/* attribute */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) #define CEXPR_EQ     1		/* == or eq */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) #define CEXPR_NEQ    2		/* != */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) #define CEXPR_DOM    3		/* dom */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) #define CEXPR_DOMBY  4		/* domby  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) #define CEXPR_INCOMP 5		/* incomp */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) 	u32 op;			/* operator */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) 	struct ebitmap names;	/* names */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) 	struct type_set *type_names;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) 	struct constraint_expr *next;   /* next expression */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) struct constraint_node {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) 	u32 permissions;	/* constrained permissions */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) 	struct constraint_expr *expr;	/* constraint on permissions */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) 	struct constraint_node *next;	/* next constraint */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) #endif	/* _SS_CONSTRAINT_H_ */