SELinux: export object class and permission definitions

Moves the definition of the 3 structs containing object class and
permission definitions from avc.c to avc_ss.h so that the security
server can access them for validation on policy load. This also adds
a new struct type, defined_classes_perms_t, suitable for allowing the
security server to access these data structures from the avc.

Signed-off-by: Chad Sellers <csellers@tresys.com>
Acked-by:  Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>

diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index a300702da5276a41a5c86a68e389f5ebcacdc058..74c0319c417e1e143bb7cd468c9744d8fabf88bb 100644 (file)
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -32,12 +32,7 @@
 #include "avc.h"
 #include "avc_ss.h"
 
-static const struct av_perm_to_string
-{
-  u16 tclass;
-  u32 value;
-  const char *name;
-} av_perm_to_string[] = {
+static const struct av_perm_to_string av_perm_to_string[] = {
 #define S_(c, v, s) { c, v, s },
 #include "av_perm_to_string.h"
 #undef S_
@@ -57,17 +52,21 @@ static const char *class_to_string[] = {
 #undef TE_
 #undef S_
 
-static const struct av_inherit
-{
-    u16 tclass;
-    const char **common_pts;
-    u32 common_base;
-} av_inherit[] = {
+static const struct av_inherit av_inherit[] = {
 #define S_(c, i, b) { c, common_##i##_perm_to_string, b },
 #include "av_inherit.h"
 #undef S_
 };
 
+const struct selinux_class_perm selinux_class_perm = {
+       av_perm_to_string,
+       ARRAY_SIZE(av_perm_to_string),
+       class_to_string,
+       ARRAY_SIZE(class_to_string),
+       av_inherit,
+       ARRAY_SIZE(av_inherit)
+};
+
 #define AVC_CACHE_SLOTS                        512
 #define AVC_DEF_CACHE_THRESHOLD                512
 #define AVC_CACHE_RECLAIM              16

diff --git a/security/selinux/include/avc_ss.h b/security/selinux/include/avc_ss.h
index 450a2831e2e32c2cf5f58f42eab831a7654dd0af..ff869e8b6f4a044852234c78b6e412000eac8153 100644 (file)
--- a/security/selinux/include/avc_ss.h
+++ b/security/selinux/include/avc_ss.h
@@ -10,5 +10,29 @@
 
 int avc_ss_reset(u32 seqno);
 
+struct av_perm_to_string
+{
+       u16 tclass;
+       u32 value;
+       const char *name;
+};
+
+struct av_inherit
+{
+       u16 tclass;
+       const char **common_pts;
+       u32 common_base;
+};
+
+struct selinux_class_perm
+{
+       const struct av_perm_to_string *av_perm_to_string;
+       u32 av_pts_len;
+       const char **class_to_string;
+       u32 cts_len;
+       const struct av_inherit *av_inherit;
+       u32 av_inherit_len;
+};
+
 #endif /* _SELINUX_AVC_SS_H_ */