selinux/policy/
permissions.rs

1// Copyright 2026 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5use std::num::NonZeroU8;
6
7use fuchsia_rcu::RcuDroppable;
8use selinux_policy_derive::{HasName, HasPolicyId, Validate};
9
10use super::Policy;
11use super::error::{ParseError, SerializeError, ValidateError};
12use super::id_type::IdType;
13use super::parser::{PolicyCursor, PolicyWriter};
14use super::traits::{Parse, PolicyId, Serialize, Validate};
15
16/// Tag type for type safety of policy permission identifiers.
17#[derive(Copy, Clone, Debug, Hash, Eq, PartialEq, RcuDroppable)]
18pub struct PermissionTag;
19
20/// Identifies a permission within an object class (class-relative, 1-indexed).
21pub type PermissionId = IdType<NonZeroU8, PermissionTag>;
22
23/// Parsed SELinux permission, containing a type-safe ID and a name.
24#[derive(Debug, Validate, HasName, HasPolicyId)]
25pub struct Permission {
26    id: PermissionId,
27    name: Box<[u8]>,
28}
29
30impl Parse for Permission {
31    fn parse(cursor: &mut PolicyCursor<'_>) -> Result<Self, ParseError> {
32        let length = u32::parse(cursor)? as usize;
33        let id_val = u32::parse(cursor)?;
34
35        // Validate permission ID range (1..=32) during parsing.
36        let id = PermissionId::from_u32(id_val)
37            .filter(|id| id.as_u32() <= 32)
38            .ok_or(ParseError::InvalidId { value: id_val })?;
39
40        let name = Box::from(cursor.read_bytes(length)?);
41
42        Ok(Self { id, name })
43    }
44}
45
46impl Serialize for Permission {
47    fn serialize(&self, writer: &mut PolicyWriter<'_>) -> Result<(), SerializeError> {
48        let length = self.name.len() as u32;
49        length.serialize(writer)?;
50        self.id.as_u32().serialize(writer)?;
51        writer.write_bytes(&self.name);
52        Ok(())
53    }
54}
55
56impl Validate for PermissionId {
57    fn validate(&self, _policy: &Policy) -> Result<(), ValidateError> {
58        Ok(())
59    }
60}
selinux/policy/permissions.rs

selinux/policy/
permissions.rs
