1 /************************************************************
3 Author: Eamon Walsh <ewalsh@tycho.nsa.gov>
5 Permission to use, copy, modify, distribute, and sell this software and its
6 documentation for any purpose is hereby granted without fee, provided that
7 this permission notice appear in supporting documentation. This permission
8 notice shall be included in all copies or substantial portions of the
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
12 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
14 AUTHOR BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
15 AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
16 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
18 ********************************************************/
20 #ifndef _XSELINUXINT_H
21 #define _XSELINUXINT_H
23 #include <selinux/selinux.h>
24 #include <selinux/avc.h>
27 #include "dixaccess.h"
28 #include "dixstruct.h"
39 #define COMMAND_LEN 64
41 /* subject state (clients and devices only) */
44 security_id_t dev_create_sid
;
45 security_id_t win_create_sid
;
46 security_id_t sel_create_sid
;
47 security_id_t prp_create_sid
;
48 security_id_t sel_use_sid
;
49 security_id_t prp_use_sid
;
50 struct avc_entry_ref aeref
;
51 char command
[COMMAND_LEN
];
65 extern DevPrivateKeyRec subjectKeyRec
;
67 #define subjectKey (&subjectKeyRec)
68 extern DevPrivateKeyRec objectKeyRec
;
70 #define objectKey (&objectKeyRec)
71 extern DevPrivateKeyRec dataKeyRec
;
73 #define dataKey (&dataKeyRec)
80 SELinuxAtomToSID(Atom atom
, int prop
, SELinuxObjectRec
** obj_rtn
);
84 SELinuxSelectionToSID(Atom selection
, SELinuxSubjectRec
* subj
,
85 security_id_t
* sid_rtn
, int *poly_rtn
);
89 SELinuxPropertyToSID(Atom property
, SELinuxSubjectRec
* subj
,
90 security_id_t
* sid_rtn
, int *poly_rtn
);
94 SELinuxEventToSID(unsigned type
, security_id_t sid_of_window
,
95 SELinuxObjectRec
* sid_return
);
98 SELinuxExtensionToSID(const char *name
, security_id_t
* sid_rtn
);
100 security_class_t
SELinuxTypeToClass(RESTYPE type
);
102 security_context_t
SELinuxDefaultClientLabel(void);
105 SELinuxLabelInit(void);
108 SELinuxLabelReset(void);
111 * Security module functions
115 SELinuxFlaskInit(void);
118 SELinuxFlaskReset(void);
121 * Private Flask definitions
124 /* Security class constants */
125 #define SECCLASS_X_DRAWABLE 1
126 #define SECCLASS_X_SCREEN 2
127 #define SECCLASS_X_GC 3
128 #define SECCLASS_X_FONT 4
129 #define SECCLASS_X_COLORMAP 5
130 #define SECCLASS_X_PROPERTY 6
131 #define SECCLASS_X_SELECTION 7
132 #define SECCLASS_X_CURSOR 8
133 #define SECCLASS_X_CLIENT 9
134 #define SECCLASS_X_POINTER 10
135 #define SECCLASS_X_KEYBOARD 11
136 #define SECCLASS_X_SERVER 12
137 #define SECCLASS_X_EXTENSION 13
138 #define SECCLASS_X_EVENT 14
139 #define SECCLASS_X_FAKEEVENT 15
140 #define SECCLASS_X_RESOURCE 16
142 #ifdef _XSELINUX_NEED_FLASK_MAP
143 /* Mapping from DixAccess bits to Flask permissions */
144 static struct security_class_mapping map
[] = {
146 {"read", /* DixReadAccess */
147 "write", /* DixWriteAccess */
148 "destroy", /* DixDestroyAccess */
149 "create", /* DixCreateAccess */
150 "getattr", /* DixGetAttrAccess */
151 "setattr", /* DixSetAttrAccess */
152 "list_property", /* DixListPropAccess */
153 "get_property", /* DixGetPropAccess */
154 "set_property", /* DixSetPropAccess */
155 "", /* DixGetFocusAccess */
156 "", /* DixSetFocusAccess */
157 "list_child", /* DixListAccess */
158 "add_child", /* DixAddAccess */
159 "remove_child", /* DixRemoveAccess */
160 "hide", /* DixHideAccess */
161 "show", /* DixShowAccess */
162 "blend", /* DixBlendAccess */
163 "override", /* DixGrabAccess */
164 "", /* DixFreezeAccess */
165 "", /* DixForceAccess */
166 "", /* DixInstallAccess */
167 "", /* DixUninstallAccess */
168 "send", /* DixSendAccess */
169 "receive", /* DixReceiveAccess */
170 "", /* DixUseAccess */
171 "manage", /* DixManageAccess */
174 {"", /* DixReadAccess */
175 "", /* DixWriteAccess */
176 "", /* DixDestroyAccess */
177 "", /* DixCreateAccess */
178 "getattr", /* DixGetAttrAccess */
179 "setattr", /* DixSetAttrAccess */
180 "saver_getattr", /* DixListPropAccess */
181 "saver_setattr", /* DixGetPropAccess */
182 "", /* DixSetPropAccess */
183 "", /* DixGetFocusAccess */
184 "", /* DixSetFocusAccess */
185 "", /* DixListAccess */
186 "", /* DixAddAccess */
187 "", /* DixRemoveAccess */
188 "hide_cursor", /* DixHideAccess */
189 "show_cursor", /* DixShowAccess */
190 "saver_hide", /* DixBlendAccess */
191 "saver_show", /* DixGrabAccess */
194 {"", /* DixReadAccess */
195 "", /* DixWriteAccess */
196 "destroy", /* DixDestroyAccess */
197 "create", /* DixCreateAccess */
198 "getattr", /* DixGetAttrAccess */
199 "setattr", /* DixSetAttrAccess */
200 "", /* DixListPropAccess */
201 "", /* DixGetPropAccess */
202 "", /* DixSetPropAccess */
203 "", /* DixGetFocusAccess */
204 "", /* DixSetFocusAccess */
205 "", /* DixListAccess */
206 "", /* DixAddAccess */
207 "", /* DixRemoveAccess */
208 "", /* DixHideAccess */
209 "", /* DixShowAccess */
210 "", /* DixBlendAccess */
211 "", /* DixGrabAccess */
212 "", /* DixFreezeAccess */
213 "", /* DixForceAccess */
214 "", /* DixInstallAccess */
215 "", /* DixUninstallAccess */
216 "", /* DixSendAccess */
217 "", /* DixReceiveAccess */
218 "use", /* DixUseAccess */
221 {"", /* DixReadAccess */
222 "", /* DixWriteAccess */
223 "destroy", /* DixDestroyAccess */
224 "create", /* DixCreateAccess */
225 "getattr", /* DixGetAttrAccess */
226 "", /* DixSetAttrAccess */
227 "", /* DixListPropAccess */
228 "", /* DixGetPropAccess */
229 "", /* DixSetPropAccess */
230 "", /* DixGetFocusAccess */
231 "", /* DixSetFocusAccess */
232 "", /* DixListAccess */
233 "add_glyph", /* DixAddAccess */
234 "remove_glyph", /* DixRemoveAccess */
235 "", /* DixHideAccess */
236 "", /* DixShowAccess */
237 "", /* DixBlendAccess */
238 "", /* DixGrabAccess */
239 "", /* DixFreezeAccess */
240 "", /* DixForceAccess */
241 "", /* DixInstallAccess */
242 "", /* DixUninstallAccess */
243 "", /* DixSendAccess */
244 "", /* DixReceiveAccess */
245 "use", /* DixUseAccess */
248 {"read", /* DixReadAccess */
249 "write", /* DixWriteAccess */
250 "destroy", /* DixDestroyAccess */
251 "create", /* DixCreateAccess */
252 "getattr", /* DixGetAttrAccess */
253 "", /* DixSetAttrAccess */
254 "", /* DixListPropAccess */
255 "", /* DixGetPropAccess */
256 "", /* DixSetPropAccess */
257 "", /* DixGetFocusAccess */
258 "", /* DixSetFocusAccess */
259 "", /* DixListAccess */
260 "add_color", /* DixAddAccess */
261 "remove_color", /* DixRemoveAccess */
262 "", /* DixHideAccess */
263 "", /* DixShowAccess */
264 "", /* DixBlendAccess */
265 "", /* DixGrabAccess */
266 "", /* DixFreezeAccess */
267 "", /* DixForceAccess */
268 "install", /* DixInstallAccess */
269 "uninstall", /* DixUninstallAccess */
270 "", /* DixSendAccess */
271 "", /* DixReceiveAccess */
272 "use", /* DixUseAccess */
275 {"read", /* DixReadAccess */
276 "write", /* DixWriteAccess */
277 "destroy", /* DixDestroyAccess */
278 "create", /* DixCreateAccess */
279 "getattr", /* DixGetAttrAccess */
280 "setattr", /* DixSetAttrAccess */
281 "", /* DixListPropAccess */
282 "", /* DixGetPropAccess */
283 "", /* DixSetPropAccess */
284 "", /* DixGetFocusAccess */
285 "", /* DixSetFocusAccess */
286 "", /* DixListAccess */
287 "", /* DixAddAccess */
288 "", /* DixRemoveAccess */
289 "", /* DixHideAccess */
290 "", /* DixShowAccess */
291 "write", /* DixBlendAccess */
294 {"read", /* DixReadAccess */
295 "", /* DixWriteAccess */
296 "", /* DixDestroyAccess */
297 "setattr", /* DixCreateAccess */
298 "getattr", /* DixGetAttrAccess */
299 "setattr", /* DixSetAttrAccess */
302 {"read", /* DixReadAccess */
303 "write", /* DixWriteAccess */
304 "destroy", /* DixDestroyAccess */
305 "create", /* DixCreateAccess */
306 "getattr", /* DixGetAttrAccess */
307 "setattr", /* DixSetAttrAccess */
308 "", /* DixListPropAccess */
309 "", /* DixGetPropAccess */
310 "", /* DixSetPropAccess */
311 "", /* DixGetFocusAccess */
312 "", /* DixSetFocusAccess */
313 "", /* DixListAccess */
314 "", /* DixAddAccess */
315 "", /* DixRemoveAccess */
316 "", /* DixHideAccess */
317 "", /* DixShowAccess */
318 "", /* DixBlendAccess */
319 "", /* DixGrabAccess */
320 "", /* DixFreezeAccess */
321 "", /* DixForceAccess */
322 "", /* DixInstallAccess */
323 "", /* DixUninstallAccess */
324 "", /* DixSendAccess */
325 "", /* DixReceiveAccess */
326 "use", /* DixUseAccess */
329 {"", /* DixReadAccess */
330 "", /* DixWriteAccess */
331 "destroy", /* DixDestroyAccess */
332 "", /* DixCreateAccess */
333 "getattr", /* DixGetAttrAccess */
334 "setattr", /* DixSetAttrAccess */
335 "", /* DixListPropAccess */
336 "", /* DixGetPropAccess */
337 "", /* DixSetPropAccess */
338 "", /* DixGetFocusAccess */
339 "", /* DixSetFocusAccess */
340 "", /* DixListAccess */
341 "", /* DixAddAccess */
342 "", /* DixRemoveAccess */
343 "", /* DixHideAccess */
344 "", /* DixShowAccess */
345 "", /* DixBlendAccess */
346 "", /* DixGrabAccess */
347 "", /* DixFreezeAccess */
348 "", /* DixForceAccess */
349 "", /* DixInstallAccess */
350 "", /* DixUninstallAccess */
351 "", /* DixSendAccess */
352 "", /* DixReceiveAccess */
353 "", /* DixUseAccess */
354 "manage", /* DixManageAccess */
357 {"read", /* DixReadAccess */
358 "write", /* DixWriteAccess */
359 "destroy", /* DixDestroyAccess */
360 "create", /* DixCreateAccess */
361 "getattr", /* DixGetAttrAccess */
362 "setattr", /* DixSetAttrAccess */
363 "list_property", /* DixListPropAccess */
364 "get_property", /* DixGetPropAccess */
365 "set_property", /* DixSetPropAccess */
366 "getfocus", /* DixGetFocusAccess */
367 "setfocus", /* DixSetFocusAccess */
368 "", /* DixListAccess */
369 "add", /* DixAddAccess */
370 "remove", /* DixRemoveAccess */
371 "", /* DixHideAccess */
372 "", /* DixShowAccess */
373 "", /* DixBlendAccess */
374 "grab", /* DixGrabAccess */
375 "freeze", /* DixFreezeAccess */
376 "force_cursor", /* DixForceAccess */
377 "", /* DixInstallAccess */
378 "", /* DixUninstallAccess */
379 "", /* DixSendAccess */
380 "", /* DixReceiveAccess */
381 "use", /* DixUseAccess */
382 "manage", /* DixManageAccess */
383 "", /* DixDebugAccess */
384 "bell", /* DixBellAccess */
387 {"read", /* DixReadAccess */
388 "write", /* DixWriteAccess */
389 "destroy", /* DixDestroyAccess */
390 "create", /* DixCreateAccess */
391 "getattr", /* DixGetAttrAccess */
392 "setattr", /* DixSetAttrAccess */
393 "list_property", /* DixListPropAccess */
394 "get_property", /* DixGetPropAccess */
395 "set_property", /* DixSetPropAccess */
396 "getfocus", /* DixGetFocusAccess */
397 "setfocus", /* DixSetFocusAccess */
398 "", /* DixListAccess */
399 "add", /* DixAddAccess */
400 "remove", /* DixRemoveAccess */
401 "", /* DixHideAccess */
402 "", /* DixShowAccess */
403 "", /* DixBlendAccess */
404 "grab", /* DixGrabAccess */
405 "freeze", /* DixFreezeAccess */
406 "force_cursor", /* DixForceAccess */
407 "", /* DixInstallAccess */
408 "", /* DixUninstallAccess */
409 "", /* DixSendAccess */
410 "", /* DixReceiveAccess */
411 "use", /* DixUseAccess */
412 "manage", /* DixManageAccess */
413 "", /* DixDebugAccess */
414 "bell", /* DixBellAccess */
417 {"record", /* DixReadAccess */
418 "", /* DixWriteAccess */
419 "", /* DixDestroyAccess */
420 "", /* DixCreateAccess */
421 "getattr", /* DixGetAttrAccess */
422 "setattr", /* DixSetAttrAccess */
423 "", /* DixListPropAccess */
424 "", /* DixGetPropAccess */
425 "", /* DixSetPropAccess */
426 "", /* DixGetFocusAccess */
427 "", /* DixSetFocusAccess */
428 "", /* DixListAccess */
429 "", /* DixAddAccess */
430 "", /* DixRemoveAccess */
431 "", /* DixHideAccess */
432 "", /* DixShowAccess */
433 "", /* DixBlendAccess */
434 "grab", /* DixGrabAccess */
435 "", /* DixFreezeAccess */
436 "", /* DixForceAccess */
437 "", /* DixInstallAccess */
438 "", /* DixUninstallAccess */
439 "", /* DixSendAccess */
440 "", /* DixReceiveAccess */
441 "", /* DixUseAccess */
442 "manage", /* DixManageAccess */
443 "debug", /* DixDebugAccess */
446 {"", /* DixReadAccess */
447 "", /* DixWriteAccess */
448 "", /* DixDestroyAccess */
449 "", /* DixCreateAccess */
450 "query", /* DixGetAttrAccess */
451 "", /* DixSetAttrAccess */
452 "", /* DixListPropAccess */
453 "", /* DixGetPropAccess */
454 "", /* DixSetPropAccess */
455 "", /* DixGetFocusAccess */
456 "", /* DixSetFocusAccess */
457 "", /* DixListAccess */
458 "", /* DixAddAccess */
459 "", /* DixRemoveAccess */
460 "", /* DixHideAccess */
461 "", /* DixShowAccess */
462 "", /* DixBlendAccess */
463 "", /* DixGrabAccess */
464 "", /* DixFreezeAccess */
465 "", /* DixForceAccess */
466 "", /* DixInstallAccess */
467 "", /* DixUninstallAccess */
468 "", /* DixSendAccess */
469 "", /* DixReceiveAccess */
470 "use", /* DixUseAccess */
473 {"", /* DixReadAccess */
474 "", /* DixWriteAccess */
475 "", /* DixDestroyAccess */
476 "", /* DixCreateAccess */
477 "", /* DixGetAttrAccess */
478 "", /* DixSetAttrAccess */
479 "", /* DixListPropAccess */
480 "", /* DixGetPropAccess */
481 "", /* DixSetPropAccess */
482 "", /* DixGetFocusAccess */
483 "", /* DixSetFocusAccess */
484 "", /* DixListAccess */
485 "", /* DixAddAccess */
486 "", /* DixRemoveAccess */
487 "", /* DixHideAccess */
488 "", /* DixShowAccess */
489 "", /* DixBlendAccess */
490 "", /* DixGrabAccess */
491 "", /* DixFreezeAccess */
492 "", /* DixForceAccess */
493 "", /* DixInstallAccess */
494 "", /* DixUninstallAccess */
495 "send", /* DixSendAccess */
496 "receive", /* DixReceiveAccess */
498 {"x_synthetic_event",
499 {"", /* DixReadAccess */
500 "", /* DixWriteAccess */
501 "", /* DixDestroyAccess */
502 "", /* DixCreateAccess */
503 "", /* DixGetAttrAccess */
504 "", /* DixSetAttrAccess */
505 "", /* DixListPropAccess */
506 "", /* DixGetPropAccess */
507 "", /* DixSetPropAccess */
508 "", /* DixGetFocusAccess */
509 "", /* DixSetFocusAccess */
510 "", /* DixListAccess */
511 "", /* DixAddAccess */
512 "", /* DixRemoveAccess */
513 "", /* DixHideAccess */
514 "", /* DixShowAccess */
515 "", /* DixBlendAccess */
516 "", /* DixGrabAccess */
517 "", /* DixFreezeAccess */
518 "", /* DixForceAccess */
519 "", /* DixInstallAccess */
520 "", /* DixUninstallAccess */
521 "send", /* DixSendAccess */
522 "receive", /* DixReceiveAccess */
525 {"read", /* DixReadAccess */
526 "write", /* DixWriteAccess */
527 "write", /* DixDestroyAccess */
528 "write", /* DixCreateAccess */
529 "read", /* DixGetAttrAccess */
530 "write", /* DixSetAttrAccess */
531 "read", /* DixListPropAccess */
532 "read", /* DixGetPropAccess */
533 "write", /* DixSetPropAccess */
534 "read", /* DixGetFocusAccess */
535 "write", /* DixSetFocusAccess */
536 "read", /* DixListAccess */
537 "write", /* DixAddAccess */
538 "write", /* DixRemoveAccess */
539 "write", /* DixHideAccess */
540 "read", /* DixShowAccess */
541 "read", /* DixBlendAccess */
542 "write", /* DixGrabAccess */
543 "write", /* DixFreezeAccess */
544 "write", /* DixForceAccess */
545 "write", /* DixInstallAccess */
546 "write", /* DixUninstallAccess */
547 "write", /* DixSendAccess */
548 "read", /* DixReceiveAccess */
549 "read", /* DixUseAccess */
550 "write", /* DixManageAccess */
551 "read", /* DixDebugAccess */
552 "write", /* DixBellAccess */
557 /* x_resource "read" bits from the list above */
558 #define SELinuxReadMask (DixReadAccess|DixGetAttrAccess|DixListPropAccess| \
559 DixGetPropAccess|DixGetFocusAccess|DixListAccess| \
560 DixShowAccess|DixBlendAccess|DixReceiveAccess| \
561 DixUseAccess|DixDebugAccess)
563 #endif /* _XSELINUX_NEED_FLASK_MAP */
564 #endif /* _XSELINUXINT_H */