security: update selinux

[GitHub/mt8127/android_kernel_alcatel_ttab.git] / security / selinux / ss / avtab.h

diff --git a/security/selinux/ss/avtab.h b/security/selinux/ss/avtab.h
index 63ce2f9e441da5ed929c3341228bde3a8652f1e4..8133523ca679b04fc538a8244f1e597f363bf5e7 100644 (file)
--- a/security/selinux/ss/avtab.h
+++ b/security/selinux/ss/avtab.h
@@ -23,6 +23,8 @@
 #ifndef _SS_AVTAB_H_
 #define _SS_AVTAB_H_
 
+#include "security.h"
+
 struct avtab_key {
        u16 source_type;        /* source type */
        u16 target_type;        /* target type */
@@ -35,13 +37,43 @@ struct avtab_key {
 #define AVTAB_MEMBER           0x0020
 #define AVTAB_CHANGE           0x0040
 #define AVTAB_TYPE             (AVTAB_TRANSITION | AVTAB_MEMBER | AVTAB_CHANGE)
+/* extended permissions */
+#define AVTAB_XPERMS_ALLOWED   0x0100
+#define AVTAB_XPERMS_AUDITALLOW        0x0200
+#define AVTAB_XPERMS_DONTAUDIT 0x0400
+#define AVTAB_XPERMS           (AVTAB_XPERMS_ALLOWED | \
+                               AVTAB_XPERMS_AUDITALLOW | \
+                               AVTAB_XPERMS_DONTAUDIT)
 #define AVTAB_ENABLED_OLD   0x80000000 /* reserved for used in cond_avtab */
 #define AVTAB_ENABLED          0x8000 /* reserved for used in cond_avtab */
        u16 specified;  /* what field is specified */
 };
 
+/*
+ * For operations that require more than the 32 permissions provided by the avc
+ * extended permissions may be used to provide 256 bits of permissions.
+ */
+struct avtab_extended_perms {
+/* These are not flags. All 256 values may be used */
+#define AVTAB_XPERMS_IOCTLFUNCTION     0x01
+#define AVTAB_XPERMS_IOCTLDRIVER       0x02
+       /* extension of the avtab_key specified */
+       u8 specified; /* ioctl, netfilter, ... */
+       /*
+        * if 256 bits is not adequate as is often the case with ioctls, then
+        * multiple extended perms may be used and the driver field
+        * specifies which permissions are included.
+        */
+       u8 driver;
+       /* 256 bits of permissions */
+       struct extended_perms_data perms;
+};
+
 struct avtab_datum {
-       u32 data; /* access vector or type value */
+       union {
+               u32 data; /* access vector or type value */
+               struct avtab_extended_perms *xperms;
+       } u;
 };
 
 struct avtab_node {