Struct Policy

pub struct Policy<PS: ParseStrategy>(/* private fields */);

Implementations

impl<PS: ParseStrategy> Policy<PS>

pub fn policy_version(&self) -> u32

The policy version stored in the underlying binary policy.

pub fn handle_unknown(&self) -> HandleUnknown

The way “unknown” policy decisions should be handed according to the underlying binary policy.

pub fn conditional_booleans<'a>(&'a self) -> Vec<(&'a [u8], bool)>

pub fn classes<'a>(&'a self) -> Vec<ClassInfo<'a>>

The set of class names and their respective class identifiers.

pub fn find_class_permissions_by_name( &self, class_name: &str, ) -> Result<Vec<(u32, Vec<u8>)>, ()>

Returns the set of permissions for the given class, including both the explicitly owned permissions and the inherited ones from common symbols. Each permission is a tuple of the permission identifier and it’s name.

pub fn fs_use_label_and_type( &self, fs_type: NullessByteStr<'_>, ) -> Option<FsUseLabelAndType>

If there is an fs_use statement for the given filesystem type, returns the associated SecurityContext and FsUseType.

pub fn genfscon_label_for_fs_and_path( &self, fs_type: NullessByteStr<'_>, node_path: NullessByteStr<'_>, class_id: Option<ClassId>, ) -> Option<SecurityContext>

If there is a genfscon statement for the given filesystem type, returns the associated SecurityContext.

pub fn initial_context(&self, id: InitialSid) -> SecurityContext

Returns the SecurityContext defined by this policy for the specified well-known (or “initial”) Id.

pub fn parse_security_context( &self, security_context: NullessByteStr<'_>, ) -> Result<SecurityContext, SecurityContextError>

Returns a SecurityContext with fields parsed from the supplied Security Context string.

pub fn validate_security_context( &self, security_context: &SecurityContext, ) -> Result<(), SecurityContextError>

Validates a SecurityContext against this policy’s constraints.

pub fn serialize_security_context( &self, security_context: &SecurityContext, ) -> Vec<u8>

Returns a byte string describing the supplied SecurityContext.

pub fn new_file_security_context( &self, source: &SecurityContext, target: &SecurityContext, class: &FileClass, ) -> SecurityContext

Returns the security context that should be applied to a newly created file-like SELinux object according to source and target security contexts, as well as the new object’s class. Returns an error if the security context for such an object is not well-defined by this Policy.

pub fn new_security_context( &self, source: &SecurityContext, target: &SecurityContext, class: &ObjectClass, ) -> SecurityContext

Returns the security context that should be applied to a newly created SELinux object according to source and target security contexts, as well as the new object’s class. Defaults to the source security context if the policy does not specify transitions or defaults for the source, target or class components.

Returns an error if the security context for such an object is not well-defined by this Policy.

pub fn compute_explicitly_allowed( &self, source_type: TypeId, target_type: TypeId, object_class: ObjectClass, ) -> AccessDecision

Computes the access vector that associates type source_type_name and target_type_name via an explicit allow [...]; statement in the binary policy. Computes AccessVector::NONE if no such statement exists.

pub fn compute_explicitly_allowed_custom( &self, source_type: TypeId, target_type: TypeId, target_class_name: &str, ) -> AccessDecision

Computes the access vector that associates type source_type_name and target_type_name via an explicit allow [...]; statement in the binary policy. Computes AccessVector::NONE if no such statement exists. This is the “custom” form of this API because target_class_name is associated with a crate::AbstractObjectClass::Custom value.

pub fn is_bounded_by(&self, bounded_type: TypeId, parent_type: TypeId) -> bool

pub fn is_permissive(&self, type_: TypeId) -> bool

Returns true if the policy has the marked the type/domain for permissive checks.

Trait Implementations

impl<PS: ParseStrategy> AccessVectorComputer for Policy<PS>

fn access_vector_from_permissions<P: ClassPermission + Into<Permission> + Clone + 'static>( &self, permissions: &[P], ) -> Option<AccessVector>

Returns an AccessVector containing the supplied kernel permissions.

impl<PS: Debug + ParseStrategy> Debug for Policy<PS>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.