selinux/new_policy/
permissions.rs

1// Copyright 2026 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5use std::num::NonZeroU8;
6
7use selinux_policy_derive::{HasName, HasPolicyId, Validate};
8
9use super::NewPolicy;
10use super::error::{ParseError, SerializeError, ValidateError};
11use super::id_type::IdType;
12use super::parser::{PolicyCursor, PolicyWriter};
13use super::traits::{Parse, PolicyId, Serialize, Validate};
14
15/// Tag type for type safety of policy permission identifiers.
16#[derive(Copy, Clone, Debug, Hash, Eq, PartialEq)]
17pub struct PermissionTag;
18
19/// Identifies a permission within an object class (class-relative, 1-indexed).
20pub type PermissionId = IdType<NonZeroU8, PermissionTag>;
21
22/// Parsed SELinux permission, containing a type-safe ID and a name.
23#[derive(Debug, Validate, HasName, HasPolicyId)]
24pub struct Permission {
25    id: PermissionId,
26    name: Box<[u8]>,
27}
28
29impl Parse for Permission {
30    fn parse(cursor: &mut PolicyCursor<'_>) -> Result<Self, ParseError> {
31        let length = u32::parse(cursor)? as usize;
32        let id_val = u32::parse(cursor)?;
33
34        // Validate permission ID range (1..=32) during parsing
35        if id_val == 0 || id_val > 32 {
36            return Err(ParseError::InvalidId { value: id_val });
37        }
38
39        let name = Box::from(cursor.read_bytes(length)?);
40        let id = PermissionId::from_u32(id_val).ok_or(ParseError::InvalidId { value: id_val })?;
41
42        Ok(Self { id, name })
43    }
44}
45
46impl Serialize for Permission {
47    fn serialize(&self, writer: &mut PolicyWriter<'_>) -> Result<(), SerializeError> {
48        let length = self.name.len() as u32;
49        length.serialize(writer)?;
50        self.id.as_u32().serialize(writer)?;
51        writer.write_bytes(&self.name);
52        Ok(())
53    }
54}
55
56impl Validate for PermissionId {
57    fn validate(&self, _policy: &NewPolicy) -> Result<(), ValidateError> {
58        Ok(())
59    }
60}
selinux/new_policy/permissions.rs

selinux/new_policy/
permissions.rs
