SELinux: Auto-generate security_is_socket_class

The security_is_socket_class() is auto-generated by genheaders based on classmap.h to reduce maintenance effort when a new class is defined in SELinux kernel. The name for any socket class should be suffixed by "socket" and doesn't contain more than one substr of "socket". Signed-off-by: Harry Ciao <qingtao.cao@windriver.com> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov>

SELinux: Auto-generate security_is_socket_class
The security_is_socket_class() is auto-generated by genheaders based on classmap.h to reduce maintenance effort when a new class is defined in SELinux kernel. The name for any socket class should be suffixed by "socket" and doesn't contain more than one substr of "socket". Signed-off-by: Harry Ciao <qingtao.cao@windriver.com> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Harry Ciao · Eric Paris
1 parent 0b24dcb7f2
Showing 2 changed files with 24 additions and 0 deletions Side-by-side Diff
scripts/selinux/genheaders/genheaders.c
security/selinux/include/classmap.h
@@ -43,6 +43,8 @@
 	int i, j, k;
 	int isids_len;
 	FILE *fout;
+	const char *needle = "SOCKET";
+	char *substr;
  
 	progname = argv[0];
  
@@ -88,6 +90,24 @@
 		fprintf(fout, "%2d\n", i);
 	}
 	fprintf(fout, "\n#define SECINITSID_NUM %d\n", i-1);
+	fprintf(fout, "\nstatic inline bool security_is_socket_class(u16 kern_tclass)\n");
+	fprintf(fout, "{\n");
+	fprintf(fout, "\tbool sock = false;\n\n");
+	fprintf(fout, "\tswitch (kern_tclass) {\n");
+	for (i = 0; secclass_map[i].name; i++) {
+		struct security_class_mapping *map = &secclass_map[i];
+		substr = strstr(map->name, needle);
+		if (substr && strcmp(substr, needle) == 0)
+			fprintf(fout, "\tcase SECCLASS_%s:\n", map->name);
+	}
+	fprintf(fout, "\t\tsock = true;\n");
+	fprintf(fout, "\t\tbreak;\n");
+	fprintf(fout, "\tdefault:\n");
+	fprintf(fout, "\t\tbreak;\n");
+	fprintf(fout, "\t}\n\n");
+	fprintf(fout, "\treturn sock;\n");
+	fprintf(fout, "}\n");
+
 	fprintf(fout, "\n#endif\n");
 	fclose(fout);
  
@@ -12,6 +12,10 @@
 #define COMMON_IPC_PERMS "create", "destroy", "getattr", "setattr", "read", \
 	    "write", "associate", "unix_read", "unix_write"
  
+/*
+ * Note: The name for any socket class should be suffixed by "socket",
+ *	 and doesn't contain more than one substr of "socket".
+ */
 struct security_class_mapping secclass_map[] = {
 	{ "security",
 	  { "compute_av", "compute_create", "compute_member",
...	...	@@ -43,6 +43,8 @@
43	43	int i, j, k;
44	44	int isids_len;
45	45	FILE *fout;
	46	+ const char *needle = "SOCKET";
	47	+ char *substr;
46	48
47	49	progname = argv[0];
48	50
...	...	@@ -88,6 +90,24 @@
88	90	fprintf(fout, "%2d\n", i);
89	91	}
90	92	fprintf(fout, "\n#define SECINITSID_NUM %d\n", i-1);
	93	+ fprintf(fout, "\nstatic inline bool security_is_socket_class(u16 kern_tclass)\n");
	94	+ fprintf(fout, "{\n");
	95	+ fprintf(fout, "\tbool sock = false;\n\n");
	96	+ fprintf(fout, "\tswitch (kern_tclass) {\n");
	97	+ for (i = 0; secclass_map[i].name; i++) {
	98	+ struct security_class_mapping *map = &secclass_map[i];
	99	+ substr = strstr(map->name, needle);
	100	+ if (substr && strcmp(substr, needle) == 0)
	101	+ fprintf(fout, "\tcase SECCLASS_%s:\n", map->name);
	102	+ }
	103	+ fprintf(fout, "\t\tsock = true;\n");
	104	+ fprintf(fout, "\t\tbreak;\n");
	105	+ fprintf(fout, "\tdefault:\n");
	106	+ fprintf(fout, "\t\tbreak;\n");
	107	+ fprintf(fout, "\t}\n\n");
	108	+ fprintf(fout, "\treturn sock;\n");
	109	+ fprintf(fout, "}\n");
	110	+
91	111	fprintf(fout, "\n#endif\n");
92	112	fclose(fout);
93	113
...	...	@@ -12,6 +12,10 @@
12	12	#define COMMON_IPC_PERMS "create", "destroy", "getattr", "setattr", "read", \
13	13	"write", "associate", "unix_read", "unix_write"
14	14
	15	+/*
	16	+ * Note: The name for any socket class should be suffixed by "socket",
	17	+ * and doesn't contain more than one substr of "socket".
	18	+ */
15	19	struct security_class_mapping secclass_map[] = {
16	20	{ "security",
17	21	{ "compute_av", "compute_create", "compute_member",