selinux/new_policy/
policy_cap.rs

1// Copyright 2026 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5use strum::VariantArray as _;
6use strum_macros::VariantArray;
7
8use super::error::ValidateError;
9use super::traits::{PolicyId, Validate};
10use super::{NewPolicy, bitmap};
11
12/// Reference policy capability Ids.
13#[derive(Clone, Copy, Debug, Eq, Hash, Ord, PartialEq, PartialOrd, VariantArray)]
14pub enum PolicyCap {
15    NetworkPeerControls = 0,
16    OpenPerms = 1,
17    ExtendedSocketClass = 2,
18    AlwaysCheckNetwork = 3,
19    CgroupSeclabel = 4,
20    NnpNosuidTransition = 5,
21    GenfsSeclabelSymlinks = 6,
22    IoctlSkipCloexec = 7,
23    UserspaceInitialContext = 8,
24    NetlinkXperm = 9,
25    NetifWildcard = 10,
26    GenfsSeclabelWildcard = 11,
27    FunctionfsSeclabel = 12,
28    MemfdClass = 13,
29}
30
31impl PolicyCap {
32    pub fn name(&self) -> &str {
33        match self {
34            Self::NetworkPeerControls => "network_peer_controls",
35            Self::OpenPerms => "open_perms",
36            Self::ExtendedSocketClass => "extended_socket_class",
37            Self::AlwaysCheckNetwork => "always_check_network",
38            Self::CgroupSeclabel => "cgroup_seclabel",
39            Self::NnpNosuidTransition => "nnp_nosuid_transition",
40            Self::GenfsSeclabelSymlinks => "genfs_seclabel_symlinks",
41            Self::IoctlSkipCloexec => "ioctl_skip_cloexec",
42            Self::UserspaceInitialContext => "userspace_initial_context",
43            Self::NetlinkXperm => "netlink_xperm",
44            Self::NetifWildcard => "netif_wildcard",
45            Self::GenfsSeclabelWildcard => "genfs_seclabel_wildcard",
46            Self::FunctionfsSeclabel => "functionfs_seclabel",
47            Self::MemfdClass => "memfd_class",
48        }
49    }
50
51    pub fn by_name(name: &str) -> Option<Self> {
52        Self::VARIANTS.iter().find(|x| x.name() == name).copied()
53    }
54}
55
56/// Set of enabled policy capabilities.
57pub type PolicyCapSet = bitmap::IdSet<PolicyCap, true>;
58
59impl PolicyId for PolicyCap {
60    fn as_u32(&self) -> u32 {
61        *self as u32
62    }
63
64    fn from_u32(value: u32) -> Option<Self> {
65        Self::VARIANTS.get(value as usize).copied()
66    }
67}
68
69impl Validate for PolicyCap {
70    fn validate(&self, _policy: &NewPolicy) -> Result<(), ValidateError> {
71        Ok(())
72    }
73}
74
75#[cfg(test)]
76mod tests {
77    use super::*;
78
79    #[test]
80    fn policy_capabilities() {
81        for capability in PolicyCap::VARIANTS {
82            assert_eq!(Some(*capability), PolicyCap::by_name(capability.name()));
83        }
84    }
85}
selinux/new_policy/policy_cap.rs

selinux/new_policy/
policy_cap.rs
