Struct PolicyIndex 

pub struct PolicyIndex { /* private fields */ }

An index for facilitating fast lookup of common abstractions inside parsed binary policy data structures. Typically, data is indexed by an enum that describes a well-known value and the index stores the offset of the data in the binary policy to avoid scanning a collection to find an element that contains a matching string. For example, the policy contains a collection of classes that are identified by string names included in each collection entry. However, policy_index.classes(KernelClass::Process).unwrap() yields the offset in the policy’s collection of classes where the “process” class resides.

Implementations

impl PolicyIndex

pub fn new(parsed_policy: ParsedPolicy) -> Result<Self, Error>

Constructs a PolicyIndex that indexes over well-known policy elements.

[Class]es and [Permission]s used by the kernel are amongst the indexed elements. The policy’s handle_unknown() configuration determines whether the policy can be loaded even if it omits classes or permissions expected by the kernel, and whether to allow or deny those permissions if so.

pub fn kernel_permission_to_access_vector<P: Into<KernelPermission>>( &self, permission: P, ) -> Option<AccessVector>

Returns the policy entry for a well-known kernel object class permission.

pub fn compute_create_context_with_name( &self, source: &SecurityContext, target: &SecurityContext, class: ObjectClass, name: NullessByteStr<'_>, ) -> Option<SecurityContext>

Returns the security context that should be applied to a newly created SELinux object according to source and target security contexts, as well as the new object’s class.

If no filename-transition rule matches the supplied arguments then None is returned, and the caller should fall-back to filename-independent labeling via [compute_create_context()]

pub fn compute_create_context( &self, source: &SecurityContext, target: &SecurityContext, class: ObjectClass, ) -> SecurityContext

Returns the security context that should be applied to a newly created SELinux object according to source and target security contexts, as well as the new object’s class.

Computation follows the “create” algorithm for labeling newly created objects:

• user is taken from the source.
• role, type and range are taken from the matching transition rules, if any.
• role, type and range fall-back to the source or target values according to policy.

If no transitions apply, and the policy does not explicitly specify defaults then the role, type and range values have defaults chosen based on the class:

• For “process”, and socket-like classes, role, type and range are taken from the source.
• Otherwise role is “object_r”, type is taken from target and range is set to the low level of the source range.

Methods from Deref<Target = ParsedPolicy>

pub fn has_policycap(&self, policy_cap: PolicyCap) -> bool

Returns true if the specified capability is in the policy’s enabled capabilities set.

pub fn validate(&self) -> Result<(), Error>

Trait Implementations

impl Debug for PolicyIndex

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Deref for PolicyIndex

type Target = ParsedPolicy

The resulting type after dereferencing.

fn deref(&self) -> &Self::Target

Dereferences the value.