Struct PermissionCheck 

pub struct PermissionCheck<'a> { /* private fields */ }

Implements the has_permission() API, based on supplied SecurityServer and AccessVectorCache implementations.

Implementations

impl<'a> PermissionCheck<'a>

pub fn has_permission<P: ClassPermission + Into<KernelPermission> + Clone + 'static>( &self, source_sid: SecurityId, target_sid: SecurityId, permission: P, ) -> PermissionCheckResult

Returns whether the source_sid has the specified permission on target_sid. The result indicates both whether permission is permitted, and whether the caller should audit log the query.

pub fn has_extended_permission<P: ClassPermission + Into<KernelPermission> + Clone + 'static>( &self, xperms_kind: XpermsKind, source_sid: SecurityId, target_sid: SecurityId, permission: P, xperm: u16, ) -> PermissionCheckResult

Returns whether the source_sid has both a base permission (i.e. ioctl or nlmsg) and the specified extended permission on target_sid, and whether the decision should be audited.

A request is allowed if the base permission is allowed and either the numeric extended permission of this xperms_kind is included in an allowxperm statement, or extended permissions of this kind are not filtered for this domain.

A granted request is audited if the base permission is auditallow and the extended permission is auditallowxperm.

A denied request is audited if the base permission is dontaudit or the extended permission is dontauditxperm.

pub fn security_server(&self) -> &SecurityServer

pub fn compute_create_sid( &self, source_sid: SecurityId, target_sid: SecurityId, target_class: KernelClass, name: &[u8], ) -> Result<SecurityId, Error>

Returns the SID with which to label a new target_class instance created by source_sid in a container labeled target_sid, taking into account role, type, and optional filename transition rules. Callers pass an empty slice (&[]) for name to express nameless transitions.

pub fn compute_access_decision( &self, source_sid: SecurityId, target_sid: SecurityId, target_class: KernelClass, ) -> KernelAccessDecision

Returns the raw AccessDecision for a specified source, target and class.