These changes are the raw update to linux-4.4.6-rt14. Kernel sources

[kvmfornfv.git] / kernel / security / selinux / ss / avtab.h

diff --git a/kernel/security/selinux/ss/avtab.h b/kernel/security/selinux/ss/avtab.h
index adb451c..d946c9d 100644 (file)
--- a/kernel/security/selinux/ss/avtab.h
+++ b/kernel/security/selinux/ss/avtab.h
@@ -23,6 +23,7 @@
 #ifndef _SS_AVTAB_H_
 #define _SS_AVTAB_H_
 
+#include "security.h"
 #include <linux/flex_array.h>
 
 struct avtab_key {
@@ -37,13 +38,43 @@ struct avtab_key {
 #define AVTAB_MEMBER           0x0020
 #define AVTAB_CHANGE           0x0040
 #define AVTAB_TYPE             (AVTAB_TRANSITION | AVTAB_MEMBER | AVTAB_CHANGE)
+/* extended permissions */
+#define AVTAB_XPERMS_ALLOWED   0x0100
+#define AVTAB_XPERMS_AUDITALLOW        0x0200
+#define AVTAB_XPERMS_DONTAUDIT 0x0400
+#define AVTAB_XPERMS           (AVTAB_XPERMS_ALLOWED | \
+                               AVTAB_XPERMS_AUDITALLOW | \
+                               AVTAB_XPERMS_DONTAUDIT)
 #define AVTAB_ENABLED_OLD   0x80000000 /* reserved for used in cond_avtab */
 #define AVTAB_ENABLED          0x8000 /* reserved for used in cond_avtab */
        u16 specified;  /* what field is specified */
 };
 
+/*
+ * For operations that require more than the 32 permissions provided by the avc
+ * extended permissions may be used to provide 256 bits of permissions.
+ */
+struct avtab_extended_perms {
+/* These are not flags. All 256 values may be used */
+#define AVTAB_XPERMS_IOCTLFUNCTION     0x01
+#define AVTAB_XPERMS_IOCTLDRIVER       0x02
+       /* extension of the avtab_key specified */
+       u8 specified; /* ioctl, netfilter, ... */
+       /*
+        * if 256 bits is not adequate as is often the case with ioctls, then
+        * multiple extended perms may be used and the driver field
+        * specifies which permissions are included.
+        */
+       u8 driver;
+       /* 256 bits of permissions */
+       struct extended_perms_data perms;
+};
+
 struct avtab_datum {
-       u32 data; /* access vector or type value */
+       union {
+               u32 data; /* access vector or type value */
+               struct avtab_extended_perms *xperms;
+       } u;
 };
 
 struct avtab_node {