selinux-commits Mailing List for Security-enhanced Linux (Page 7)

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 422-6466

Revision: 2800
          http://selinux.svn.sourceforge.net/selinux/?rev=2800&view=rev
Author:   ewalsh
Date:     2008-02-08 10:03:06 -0800 (Fri, 08 Feb 2008)

Log Message:
-----------
Author: Eamon Walsh
Email: ew...@ty...
Subject: libselinux: avc_compute_member convenience function
Date: Thu, 07 Feb 2008 17:42:31 -0500

avc_compute_member function, same as security_compute_member but takes 
userspace AVC SID's.  Includes man page.

Signed-off-by: Eamon Walsh <ew...@ty...>
Acked-by: Stephen Smalley <sd...@ty...>

Modified Paths:
--------------
    trunk/libselinux/include/selinux/avc.h
    trunk/libselinux/man/man3/avc_compute_create.3
    trunk/libselinux/src/avc.c

Added Paths:
-----------
    trunk/libselinux/man/man3/avc_compute_member.3

Modified: trunk/libselinux/include/selinux/avc.h
===================================================================

--- trunk/libselinux/include/selinux/avc.h	2008-02-08 16:18:54 UTC (rev 2799)
+++ trunk/libselinux/include/selinux/avc.h	2008-02-08 18:03:06 UTC (rev 2800)
@@ -322,6 +322,24 @@
 		       security_id_t tsid,
 		       security_class_t tclass, security_id_t * newsid);
 
+/**
+ * avc_compute_member - Compute SID for polyinstantation.
+ * @ssid: source security identifier
+ * @tsid: target security identifier
+ * @tclass: target security class
+ * @newsid: pointer to SID reference
+ *
+ * Call the security server to obtain a context for labeling an
+ * object instance.  Look up the context in the SID table, making
+ * a new entry if not found.  Increment the reference counter
+ * for the SID.  Store a pointer to the SID structure into the
+ * memory referenced by @newsid, returning %0 on success or -%1 on
+ * error with @errno set.  
+ */
+int avc_compute_member(security_id_t ssid,
+		       security_id_t tsid,
+		       security_class_t tclass, security_id_t * newsid);
+
 /* 
  * security event callback facility
  */

Modified: trunk/libselinux/man/man3/avc_compute_create.3
===================================================================
--- trunk/libselinux/man/man3/avc_compute_create.3	2008-02-08 16:18:54 UTC (rev 2799)
+++ trunk/libselinux/man/man3/avc_compute_create.3	2008-02-08 18:03:06 UTC (rev 2800)
@@ -3,7 +3,7 @@
 .\" Author: Eamon Walsh (ew...@ty...) 2007
 .TH "avc_compute_create" "3" "30 Mar 2007" "" "SELinux API documentation"
 .SH "NAME"
-avc_compute_create \- obtain SELinux label for new object.
+avc_compute_create, avc_compute_member \- obtain SELinux label for new object.
 .SH "SYNOPSIS"
 .B #include <selinux/selinux.h>
 
@@ -12,15 +12,25 @@
 .BI "int avc_compute_create(security_id_t " ssid ", security_id_t " tsid ,
 .in +\w'int avc_compute_create('u
 .BI "security_class_t " tclass ", security_id_t *" newsid ");"
+.sp
 .in
+.BI "int avc_compute_member(security_id_t " ssid ", security_id_t " tsid ,
+.in +\w'int avc_compute_member('u
+.BI "security_class_t " tclass ", security_id_t *" newsid ");"
+.in
 .SH "DESCRIPTION"
 .B avc_compute_create
 is used to compute a SID to use for labeling a new object in a particular class based on a SID pair.  This call is identical to
 .BR security_compute_create ,
 but does not require converting from userspace SID's to contexts and back again.
 
-.B avc_compute_create
-returns a SID for the computed context in the memory referenced by
+.B avc_compute_member
+is used to compute a SID to use for labeling a polyinstantiated object instance of a particular class based on a SID pair.  This call is identical to
+.BR security_compute_member ,
+but does not require converting from userspace SID's to contexts and back again.
+
+These functions
+return a SID for the computed context in the memory referenced by
 .IR sid ,
 incrementing its reference count by 1.
 

Added: trunk/libselinux/man/man3/avc_compute_member.3
===================================================================
--- trunk/libselinux/man/man3/avc_compute_member.3	                        (rev 0)
+++ trunk/libselinux/man/man3/avc_compute_member.3	2008-02-08 18:03:06 UTC (rev 2800)
@@ -0,0 +1 @@
+.so man3/avc_compute_create.3

Modified: trunk/libselinux/src/avc.c
===================================================================
--- trunk/libselinux/src/avc.c	2008-02-08 16:18:54 UTC (rev 2799)
+++ trunk/libselinux/src/avc.c	2008-02-08 18:03:06 UTC (rev 2800)
@@ -906,6 +906,31 @@
 	return rc;
 }
 
+int avc_compute_member(security_id_t ssid,  security_id_t tsid,
+		       security_class_t tclass, security_id_t *newsid)
+{
+	int rc;
+	*newsid = NULL;
+	avc_get_lock(avc_lock);
+	if (ssid->refcnt > 0 && tsid->refcnt > 0) {
+		security_context_t ctx = NULL;
+		rc = security_compute_member_raw(ssid->ctx, tsid->ctx, tclass,
+						 &ctx);
+		if (rc)
+			goto out;
+		rc = sidtab_context_to_sid(&avc_sidtab, ctx, newsid);
+		if (!rc)
+			(*newsid)->refcnt++;
+		freecon(ctx);
+	} else {
+		errno = EINVAL;	/* bad reference count */
+		rc = -1;
+	}
+out:
+	avc_release_lock(avc_lock);
+	return rc;
+}
+
 int avc_add_callback(int (*callback) (uint32_t event, security_id_t ssid,
 				      security_id_t tsid,
 				      security_class_t tclass,


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.




2006	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug (24)	Sep (38)	Oct (29)	Nov (40)	Dec (4)
2007	Jan (88)	Feb (66)	Mar (44)	Apr (104)	May (35)	Jun (34)	Jul (12)	Aug (42)	Sep (84)	Oct (34)	Nov (30)	Dec (22)
2008	Jan (60)	Feb (54)	Mar (32)	Apr (14)	May (16)	Jun (26)	Jul (22)	Aug (12)	Sep	Oct	Nov	Dec

selinux-commits Mailing List for Security-enhanced Linux (Page 7)

selinux-commits — Commits to the subversion repo