security: update selinux

[GitHub/mt8127/android_kernel_alcatel_ttab.git] / security / selinux / include / security.h

diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 6d3885165d143a27fb218e785aa4a13ac7937045..eb25aa9fb313546ef2a867ddc699f17ef8716268 100644 (file)
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -33,13 +33,15 @@
 #define POLICYDB_VERSION_ROLETRANS     26
 #define POLICYDB_VERSION_NEW_OBJECT_DEFAULTS   27
 #define POLICYDB_VERSION_DEFAULT_TYPE  28
+#define POLICYDB_VERSION_CONSTRAINT_NAMES      29
+#define POLICYDB_VERSION_XPERMS_IOCTL  30
 
 /* Range of policy versions we understand*/
 #define POLICYDB_VERSION_MIN   POLICYDB_VERSION_BASE
 #ifdef CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX
 #define POLICYDB_VERSION_MAX   CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE
 #else
-#define POLICYDB_VERSION_MAX   POLICYDB_VERSION_DEFAULT_TYPE
+#define POLICYDB_VERSION_MAX   POLICYDB_VERSION_XPERMS_IOCTL
 #endif
 
 /* Mask for just the mount related flags */
@@ -102,11 +104,38 @@ struct av_decision {
        u32 flags;
 };
 
+#define XPERMS_ALLOWED 1
+#define XPERMS_AUDITALLOW 2
+#define XPERMS_DONTAUDIT 4
+
+#define security_xperm_set(perms, x) (perms[x >> 5] |= 1 << (x & 0x1f))
+#define security_xperm_test(perms, x) (1 & (perms[x >> 5] >> (x & 0x1f)))
+struct extended_perms_data {
+       u32 p[8];
+};
+
+struct extended_perms_decision {
+       u8 used;
+       u8 driver;
+       struct extended_perms_data *allowed;
+       struct extended_perms_data *auditallow;
+       struct extended_perms_data *dontaudit;
+};
+
+struct extended_perms {
+       u16 len;        /* length associated decision chain */
+       struct extended_perms_data drivers; /* flag drivers that are used */
+};
+
 /* definitions of av_decision.flags */
 #define AVD_FLAGS_PERMISSIVE   0x0001
 
 void security_compute_av(u32 ssid, u32 tsid,
-                        u16 tclass, struct av_decision *avd);
+                        u16 tclass, struct av_decision *avd,
+                        struct extended_perms *xperms);
+
+void security_compute_xperms_decision(u32 ssid, u32 tsid, u16 tclass,
+                        u8 driver, struct extended_perms_decision *xpermd);
 
 void security_compute_av_user(u32 ssid, u32 tsid,
                             u16 tclass, struct av_decision *avd);