selinux/policy/
policy_cap.rs

1// Copyright 2026 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5use strum::VariantArray as _;
6use strum_macros::VariantArray;
7
8use super::error::ValidateError;
9use super::traits::{PolicyId, Validate};
10use super::{Policy, bitmap};
11
12/// Reference policy capability Ids.
13#[derive(Clone, Copy, Debug, Eq, Hash, Ord, PartialEq, PartialOrd, VariantArray)]
14pub enum PolicyCap {
15    NetworkPeerControls = 0,
16    OpenPerms = 1,
17    ExtendedSocketClass = 2,
18    AlwaysCheckNetwork = 3,
19    CgroupSeclabel = 4,
20    NnpNosuidTransition = 5,
21    GenfsSeclabelSymlinks = 6,
22    IoctlSkipCloexec = 7,
23    UserspaceInitialContext = 8,
24    NetlinkXperm = 9,
25    NetifWildcard = 10,
26    GenfsSeclabelWildcard = 11,
27    FunctionfsSeclabel = 12,
28    MemfdClass = 13,
29}
30
31impl PolicyCap {
32    pub fn name(&self) -> &str {
33        match self {
34            Self::NetworkPeerControls => "network_peer_controls",
35            Self::OpenPerms => "open_perms",
36            Self::ExtendedSocketClass => "extended_socket_class",
37            Self::AlwaysCheckNetwork => "always_check_network",
38            Self::CgroupSeclabel => "cgroup_seclabel",
39            Self::NnpNosuidTransition => "nnp_nosuid_transition",
40            Self::GenfsSeclabelSymlinks => "genfs_seclabel_symlinks",
41            Self::IoctlSkipCloexec => "ioctl_skip_cloexec",
42            Self::UserspaceInitialContext => "userspace_initial_context",
43            Self::NetlinkXperm => "netlink_xperm",
44            Self::NetifWildcard => "netif_wildcard",
45            Self::GenfsSeclabelWildcard => "genfs_seclabel_wildcard",
46            Self::FunctionfsSeclabel => "functionfs_seclabel",
47            Self::MemfdClass => "memfd_class",
48        }
49    }
50
51    #[cfg(test)]
52    fn by_name(name: &str) -> Option<Self> {
53        Self::VARIANTS.iter().find(|x| x.name() == name).copied()
54    }
55}
56
57/// Set of enabled policy capabilities.
58pub type PolicyCapSet = bitmap::IdSet<PolicyCap, true>;
59
60impl PolicyId for PolicyCap {
61    fn as_u32(&self) -> u32 {
62        *self as u32
63    }
64
65    fn from_u32(value: u32) -> Option<Self> {
66        Self::VARIANTS.get(value as usize).copied()
67    }
68}
69
70impl Validate for PolicyCap {
71    fn validate(&self, _policy: &Policy) -> Result<(), ValidateError> {
72        Ok(())
73    }
74}
75
76#[cfg(test)]
77mod tests {
78    use super::*;
79
80    #[test]
81    fn policy_capabilities() {
82        for capability in PolicyCap::VARIANTS {
83            assert_eq!(Some(*capability), PolicyCap::by_name(capability.name()));
84        }
85    }
86}
selinux/policy/policy_cap.rs

selinux/policy/
policy_cap.rs
