2006-04-12 03:09:10 +00:00
|
|
|
/* $Id$ */
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
|
/*
|
2007-04-11 08:12:51 +00:00
|
|
|
* Copyright (c) 1999, 2000, 2001, 2002, 2004, 2005, 2006, 2007
|
|
|
|
|
* NOVELL (All rights reserved)
|
2006-04-11 21:52:54 +00:00
|
|
|
*
|
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
|
* modify it under the terms of version 2 of the GNU General Public
|
|
|
|
|
* License published by the Free Software Foundation.
|
|
|
|
|
*
|
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
|
*
|
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
|
* along with this program; if not, contact Novell, Inc.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#include <netinet/in.h>
|
2008-04-06 18:55:46 +00:00
|
|
|
#include <sys/resource.h>
|
2006-04-11 21:52:54 +00:00
|
|
|
#include "pcre/internal.h"
|
|
|
|
|
#include "immunix.h"
|
2007-02-27 02:29:16 +00:00
|
|
|
#include "libapparmor_re/apparmor_re.h"
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
|
typedef enum pattern_t pattern_t;
|
|
|
|
|
|
|
|
|
|
struct flagval {
|
2008-06-09 11:48:13 +00:00
|
|
|
int hat;
|
2006-04-11 21:52:54 +00:00
|
|
|
int complain;
|
|
|
|
|
int audit;
|
2010-02-17 12:21:52 -08:00
|
|
|
int path;
|
2006-04-11 21:52:54 +00:00
|
|
|
};
|
|
|
|
|
|
2008-04-16 04:45:02 +00:00
|
|
|
struct named_transition {
|
|
|
|
|
int present;
|
|
|
|
|
char *namespace;
|
|
|
|
|
char *name;
|
|
|
|
|
};
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
struct cod_pattern {
|
|
|
|
|
char *regex; // posix regex
|
|
|
|
|
pcre *compiled; // compiled regex, size is compiled->size
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
struct cod_entry {
|
2007-11-16 09:18:48 +00:00
|
|
|
char *namespace;
|
2007-11-16 09:34:53 +00:00
|
|
|
char *name;
|
2007-11-16 09:37:31 +00:00
|
|
|
char *link_name;
|
2008-04-16 04:45:02 +00:00
|
|
|
char *nt_name;
|
2007-11-16 09:34:53 +00:00
|
|
|
struct codomain *codomain; /* Special codomain defined
|
2006-04-11 21:52:54 +00:00
|
|
|
* just for this executable */
|
2007-11-16 09:34:53 +00:00
|
|
|
int mode; /* mode is 'or' of AA_* bits */
|
Add Audit control to AppArmor through, the use of audit and deny
key words. Deny is also used to subtract permissions from the
profiles permission set.
the audit key word can be prepended to any file, network, or capability
rule, to force a selective audit when that rule is matched. Audit
permissions accumulate just like standard permissions.
eg.
audit /bin/foo rw,
will force an audit message when the file /bin/foo is opened for
read or write.
audit /etc/shadow w,
/etc/shadow r,
will force an audit message when /etc/shadow is opened for writing.
The audit message is per permission bit so only opening the file
for read access will not, force an audit message.
audit can also be used in block form instead of prepending audit
to every rule.
audit {
/bin/foo rw,
/etc/shadow w,
}
/etc/shadow r, # don't audit r access to /etc/shadow
the deny key word can be prepended to file, network and capability
rules, to result in a denial of permissions when matching that rule.
The deny rule specifically does 3 things
- it gives AppArmor the ability to remember what has been denied
so that the tools don't prompt for what has been denied in
previous profiling sessions.
- it subtracts globally from the allowed permissions. Deny permissions
accumulate in the the deny set just as allow permissions accumulate
then, the deny set is subtracted from the allow set.
- it quiets known rejects. The default audit behavior of deny rules
is to quiet known rejects so that audit logs are not flooded
with already known rejects. To have known rejects logged prepend
the audit keyword to the deny rule. Deny rules do not have a
block form.
eg.
deny /foo/bar rw,
audit deny /etc/shadow w,
audit {
deny owner /blah w,
deny other /foo w,
deny /etc/shadow w,
}
2008-03-13 17:39:03 +00:00
|
|
|
int audit; /* audit flags for mode */
|
2007-11-16 09:34:53 +00:00
|
|
|
int deny; /* TRUE or FALSE */
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2010-02-12 13:46:55 -08:00
|
|
|
int alias_ignore; /* ignore for alias processing */
|
|
|
|
|
|
2008-03-13 16:49:10 +00:00
|
|
|
int subset;
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
pattern_t pattern_type;
|
|
|
|
|
struct cod_pattern pat;
|
|
|
|
|
|
|
|
|
|
struct cod_entry *next;
|
|
|
|
|
};
|
|
|
|
|
|
2007-07-27 20:29:47 +00:00
|
|
|
/* supported AF protocols */
|
|
|
|
|
struct aa_network_entry {
|
|
|
|
|
unsigned int family;
|
|
|
|
|
unsigned int type;
|
|
|
|
|
unsigned int protocol;
|
|
|
|
|
|
|
|
|
|
struct aa_network_entry *next;
|
|
|
|
|
};
|
|
|
|
|
|
2008-04-06 18:55:46 +00:00
|
|
|
struct aa_rlimits {
|
|
|
|
|
unsigned int specified; /* limits that are set */
|
|
|
|
|
rlim_t limits[RLIMIT_NLIMITS];
|
|
|
|
|
};
|
|
|
|
|
|
2010-02-12 13:49:58 -08:00
|
|
|
struct alt_name {
|
|
|
|
|
char *name;
|
|
|
|
|
struct alt_name *next;
|
|
|
|
|
};
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
struct codomain {
|
2007-11-16 09:18:48 +00:00
|
|
|
char *namespace;
|
2006-04-11 21:52:54 +00:00
|
|
|
char *name; /* codomain name */
|
2010-02-12 13:49:58 -08:00
|
|
|
struct alt_name *altnames;
|
2009-07-30 06:09:19 +00:00
|
|
|
void *xmatch;
|
|
|
|
|
size_t xmatch_size;
|
|
|
|
|
int xmatch_len;
|
|
|
|
|
|
2009-03-12 16:05:19 +00:00
|
|
|
/* char *sub_name; */ /* subdomain name or NULL */
|
|
|
|
|
/* int default_deny; */ /* TRUE or FALSE */
|
2008-04-16 04:45:02 +00:00
|
|
|
int local;
|
|
|
|
|
int local_mode; /* true if local, not hat */
|
|
|
|
|
int local_audit;
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2007-06-26 21:09:46 +00:00
|
|
|
struct codomain *parent;
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
struct flagval flags;
|
|
|
|
|
|
2009-08-20 15:27:12 +00:00
|
|
|
uint64_t capabilities;
|
|
|
|
|
uint64_t audit_caps;
|
|
|
|
|
uint64_t deny_caps;
|
|
|
|
|
uint64_t quiet_caps;
|
|
|
|
|
uint64_t set_caps;
|
Add Audit control to AppArmor through, the use of audit and deny
key words. Deny is also used to subtract permissions from the
profiles permission set.
the audit key word can be prepended to any file, network, or capability
rule, to force a selective audit when that rule is matched. Audit
permissions accumulate just like standard permissions.
eg.
audit /bin/foo rw,
will force an audit message when the file /bin/foo is opened for
read or write.
audit /etc/shadow w,
/etc/shadow r,
will force an audit message when /etc/shadow is opened for writing.
The audit message is per permission bit so only opening the file
for read access will not, force an audit message.
audit can also be used in block form instead of prepending audit
to every rule.
audit {
/bin/foo rw,
/etc/shadow w,
}
/etc/shadow r, # don't audit r access to /etc/shadow
the deny key word can be prepended to file, network and capability
rules, to result in a denial of permissions when matching that rule.
The deny rule specifically does 3 things
- it gives AppArmor the ability to remember what has been denied
so that the tools don't prompt for what has been denied in
previous profiling sessions.
- it subtracts globally from the allowed permissions. Deny permissions
accumulate in the the deny set just as allow permissions accumulate
then, the deny set is subtracted from the allow set.
- it quiets known rejects. The default audit behavior of deny rules
is to quiet known rejects so that audit logs are not flooded
with already known rejects. To have known rejects logged prepend
the audit keyword to the deny rule. Deny rules do not have a
block form.
eg.
deny /foo/bar rw,
audit deny /etc/shadow w,
audit {
deny owner /blah w,
deny other /foo w,
deny /etc/shadow w,
}
2008-03-13 17:39:03 +00:00
|
|
|
|
2007-07-27 20:29:47 +00:00
|
|
|
unsigned int *network_allowed; /* array of type masks
|
|
|
|
|
* indexed by AF_FAMILY */
|
Add Audit control to AppArmor through, the use of audit and deny
key words. Deny is also used to subtract permissions from the
profiles permission set.
the audit key word can be prepended to any file, network, or capability
rule, to force a selective audit when that rule is matched. Audit
permissions accumulate just like standard permissions.
eg.
audit /bin/foo rw,
will force an audit message when the file /bin/foo is opened for
read or write.
audit /etc/shadow w,
/etc/shadow r,
will force an audit message when /etc/shadow is opened for writing.
The audit message is per permission bit so only opening the file
for read access will not, force an audit message.
audit can also be used in block form instead of prepending audit
to every rule.
audit {
/bin/foo rw,
/etc/shadow w,
}
/etc/shadow r, # don't audit r access to /etc/shadow
the deny key word can be prepended to file, network and capability
rules, to result in a denial of permissions when matching that rule.
The deny rule specifically does 3 things
- it gives AppArmor the ability to remember what has been denied
so that the tools don't prompt for what has been denied in
previous profiling sessions.
- it subtracts globally from the allowed permissions. Deny permissions
accumulate in the the deny set just as allow permissions accumulate
then, the deny set is subtracted from the allow set.
- it quiets known rejects. The default audit behavior of deny rules
is to quiet known rejects so that audit logs are not flooded
with already known rejects. To have known rejects logged prepend
the audit keyword to the deny rule. Deny rules do not have a
block form.
eg.
deny /foo/bar rw,
audit deny /etc/shadow w,
audit {
deny owner /blah w,
deny other /foo w,
deny /etc/shadow w,
}
2008-03-13 17:39:03 +00:00
|
|
|
unsigned int *audit_network;
|
|
|
|
|
unsigned int *deny_network;
|
|
|
|
|
unsigned int *quiet_network;
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2008-04-06 18:55:46 +00:00
|
|
|
struct aa_rlimits rlimits;
|
|
|
|
|
|
2008-04-16 04:45:02 +00:00
|
|
|
char *exec_table[AA_EXEC_COUNT];
|
2006-04-11 21:52:54 +00:00
|
|
|
struct cod_entry *entries;
|
|
|
|
|
void *hat_table;
|
|
|
|
|
//struct codomain *next;
|
2007-02-27 02:29:16 +00:00
|
|
|
|
|
|
|
|
aare_ruleset_t *dfarules;
|
|
|
|
|
int dfarule_count;
|
|
|
|
|
void *dfa;
|
|
|
|
|
size_t dfa_size;
|
2008-04-06 18:55:46 +00:00
|
|
|
};
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
|
struct sd_hat {
|
|
|
|
|
char *hat_name;
|
|
|
|
|
unsigned int hat_magic;
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
/* describe an ip address */
|
|
|
|
|
struct ipv4_desc {
|
|
|
|
|
struct in_addr addr;
|
|
|
|
|
unsigned long mask;
|
|
|
|
|
unsigned short port[2];
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
struct ipv4_endpoints {
|
|
|
|
|
struct ipv4_desc * src;
|
|
|
|
|
struct ipv4_desc * dest;
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
struct var_string {
|
|
|
|
|
char *prefix;
|
|
|
|
|
char *var;
|
|
|
|
|
char *suffix;
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
#define COD_READ_CHAR 'r'
|
|
|
|
|
#define COD_WRITE_CHAR 'w'
|
2007-07-27 20:31:38 +00:00
|
|
|
#define COD_APPEND_CHAR 'a'
|
2006-04-11 21:52:54 +00:00
|
|
|
#define COD_EXEC_CHAR 'x'
|
|
|
|
|
#define COD_LINK_CHAR 'l'
|
2007-07-27 20:38:43 +00:00
|
|
|
#define COD_LOCK_CHAR 'k'
|
|
|
|
|
#define COD_MMAP_CHAR 'm'
|
|
|
|
|
#define COD_INHERIT_CHAR 'i'
|
2007-07-27 20:45:45 +00:00
|
|
|
#define COD_UNCONFINED_CHAR 'U'
|
|
|
|
|
#define COD_UNSAFE_UNCONFINED_CHAR 'u'
|
[https://bugzilla.novell.com/show_bug.cgi?id=172061]
This (updated) patch to trunk adds support for Px and Ux (toggle
bprm_secure on exec) in the parser, As requested, lowercase p and u
corresponds to an unfiltered environmnet on exec, uppercase will filter
the environment. It applies after the 'm' patch.
As a side effect, I tried to reduce the use of hardcoded characters in
the debugging statements -- there are still a few warnings that have
hard coded letters in them; not sure I can fix them all.
This version issues a warning for every unsafe ux and issues a single
warning for the first 'R', 'W', 'X', 'L', and 'I' it encounters,
except when the "-q" or "--quiet" flag , "--remove" profile flag, or
"-N" report names flags are passed. Unfortunately, it made the logic
somewhat more convoluted. Wordsmithing improvements welcome.
2006-08-04 17:14:49 +00:00
|
|
|
#define COD_PROFILE_CHAR 'P'
|
|
|
|
|
#define COD_UNSAFE_PROFILE_CHAR 'p'
|
2008-04-16 04:44:21 +00:00
|
|
|
#define COD_LOCAL_CHAR 'C'
|
|
|
|
|
#define COD_UNSAFE_LOCAL_CHAR 'c'
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
|
#define OPTION_ADD 1
|
|
|
|
|
#define OPTION_REMOVE 2
|
|
|
|
|
#define OPTION_REPLACE 3
|
|
|
|
|
#define OPTION_STDOUT 4
|
|
|
|
|
|
2007-02-27 02:29:16 +00:00
|
|
|
#define AARE_NONE 0
|
|
|
|
|
#define AARE_PCRE 1
|
|
|
|
|
#define AARE_DFA 2
|
|
|
|
|
|
2008-09-10 08:42:49 +00:00
|
|
|
#define FLAG_CHANGEHAT_1_4 2
|
|
|
|
|
#define FLAG_CHANGEHAT_1_5 3
|
2010-08-26 11:24:41 -07:00
|
|
|
extern int kernel_supports_network;
|
2011-03-07 07:05:37 -08:00
|
|
|
extern int net_af_max_override;
|
2008-09-10 08:42:49 +00:00
|
|
|
extern int flag_changehat_version;
|
2009-06-10 15:37:27 +00:00
|
|
|
extern int read_implies_exec;
|
2010-01-07 16:21:02 -08:00
|
|
|
extern dfaflags_t dfaflags;
|
2010-07-17 18:39:37 -07:00
|
|
|
extern int preprocess_only;
|
2010-02-17 12:21:52 -08:00
|
|
|
|
|
|
|
|
#define PATH_CHROOT_REL 0x1
|
|
|
|
|
#define PATH_NS_REL 0x2
|
|
|
|
|
#define PATH_CHROOT_NSATTACH 0x4
|
|
|
|
|
#define PATH_CHROOT_NO_ATTACH 0x8
|
|
|
|
|
#define PATH_MEDIATE_DELETED 0x10
|
|
|
|
|
#define PATH_DELEGATE_DELETED 0x20
|
|
|
|
|
#define PATH_ATTACH 0x40
|
|
|
|
|
#define PATH_NO_ATTACH 0x80
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
#ifdef DEBUG
|
|
|
|
|
#define PDEBUG(fmt, args...) printf("parser: " fmt, ## args)
|
|
|
|
|
#else
|
|
|
|
|
#define PDEBUG(fmt, args...) /* Do nothing */
|
|
|
|
|
#endif
|
|
|
|
|
#define NPDEBUG(fmt, args...) /* Do nothing */
|
|
|
|
|
|
|
|
|
|
#define PERROR(fmt, args...) fprintf(stderr, fmt, ## args)
|
|
|
|
|
|
|
|
|
|
#ifndef TRUE
|
|
|
|
|
#define TRUE (1)
|
|
|
|
|
#endif
|
|
|
|
|
#ifndef FALSE
|
|
|
|
|
#define FALSE (0)
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
#define MIN_PORT 0
|
|
|
|
|
#define MAX_PORT 65535
|
|
|
|
|
|
|
|
|
|
#ifndef __unused
|
|
|
|
|
#define __unused __attribute__ ((unused))
|
|
|
|
|
#endif
|
|
|
|
|
|
2007-02-27 02:29:16 +00:00
|
|
|
#define list_for_each(LIST, ENTRY) \
|
|
|
|
|
for ((ENTRY) = (LIST); (ENTRY); (ENTRY) = (ENTRY)->next)
|
2007-07-27 20:29:47 +00:00
|
|
|
#define list_for_each_safe(LIST, ENTRY, TMP) \
|
|
|
|
|
for ((ENTRY) = (LIST), (TMP) = (LIST) ? (LIST)->next : NULL; (ENTRY); (ENTRY) = (TMP), (TMP) = (TMP) ? (TMP)->next : NULL)
|
2007-02-27 02:29:16 +00:00
|
|
|
#define list_last_entry(LIST, ENTRY) \
|
|
|
|
|
for ((ENTRY) = (LIST); (ENTRY) && (ENTRY)->next; (ENTRY) = (ENTRY)->next)
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
/* Some external definitions to make b0rken programs happy */
|
|
|
|
|
extern char *progname;
|
|
|
|
|
extern char *subdomainbase;
|
|
|
|
|
extern char *profilename;
|
2007-11-16 09:18:48 +00:00
|
|
|
extern char *profile_namespace;
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
|
/* from parser_main */
|
|
|
|
|
extern int force_complain;
|
2009-07-24 07:34:54 +00:00
|
|
|
extern int conf_quiet;
|
2009-11-11 10:56:04 -08:00
|
|
|
extern int conf_verbose;
|
|
|
|
|
extern int kernel_load;
|
2007-02-27 02:29:16 +00:00
|
|
|
extern int regex_type;
|
2009-11-11 10:56:04 -08:00
|
|
|
extern int perms_create;
|
2010-09-15 12:01:21 -07:00
|
|
|
extern struct timespec mru_tstamp;
|
|
|
|
|
extern void update_mru_tstamp(FILE *file);
|
[https://bugzilla.novell.com/show_bug.cgi?id=172061]
This (updated) patch to trunk adds support for Px and Ux (toggle
bprm_secure on exec) in the parser, As requested, lowercase p and u
corresponds to an unfiltered environmnet on exec, uppercase will filter
the environment. It applies after the 'm' patch.
As a side effect, I tried to reduce the use of hardcoded characters in
the debugging statements -- there are still a few warnings that have
hard coded letters in them; not sure I can fix them all.
This version issues a warning for every unsafe ux and issues a single
warning for the first 'R', 'W', 'X', 'L', and 'I' it encounters,
except when the "-q" or "--quiet" flag , "--remove" profile flag, or
"-N" report names flags are passed. Unfortunately, it made the logic
somewhat more convoluted. Wordsmithing improvements welcome.
2006-08-04 17:14:49 +00:00
|
|
|
extern void pwarn(char *fmt, ...) __attribute__((__format__(__printf__, 1, 2)));
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2009-07-24 07:34:11 +00:00
|
|
|
extern FILE *yyin;
|
|
|
|
|
extern void yyrestart(FILE *fp);
|
2006-04-11 21:52:54 +00:00
|
|
|
extern int yyparse(void);
|
|
|
|
|
extern void yyerror(char *msg, ...);
|
|
|
|
|
extern int yylex(void);
|
|
|
|
|
|
2009-07-24 07:35:39 +00:00
|
|
|
/* parser_include.c */
|
|
|
|
|
extern char *basedir;
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
/* parser_regex.c */
|
|
|
|
|
extern int process_regex(struct codomain *cod);
|
|
|
|
|
extern int post_process_entry(struct cod_entry *entry);
|
2009-07-24 07:34:11 +00:00
|
|
|
extern void reset_regex(void);
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
|
/* parser_variable.c */
|
|
|
|
|
extern int process_variables(struct codomain *cod);
|
|
|
|
|
extern struct var_string *split_out_var(char *string);
|
|
|
|
|
extern void free_var_string(struct var_string *var);
|
|
|
|
|
|
|
|
|
|
/* parser_misc.c */
|
|
|
|
|
extern char *processquoted(char *string, int len);
|
|
|
|
|
extern char *processunquoted(char *string, int len);
|
|
|
|
|
extern int get_keyword_token(const char *keyword);
|
2007-11-16 09:32:38 +00:00
|
|
|
extern int name_to_capability(const char *keyword);
|
2008-04-06 18:55:46 +00:00
|
|
|
extern int get_rlimit(const char *name);
|
2006-04-11 21:52:54 +00:00
|
|
|
extern char *process_var(const char *var);
|
|
|
|
|
extern int parse_mode(const char *mode);
|
2007-11-16 09:37:31 +00:00
|
|
|
extern struct cod_entry *new_entry(char *namespace, char *id, int mode,
|
|
|
|
|
char *link_id);
|
2007-07-27 20:29:47 +00:00
|
|
|
extern struct aa_network_entry *new_network_ent(unsigned int family,
|
|
|
|
|
unsigned int type,
|
|
|
|
|
unsigned int protocol);
|
|
|
|
|
extern struct aa_network_entry *network_entry(const char *family,
|
|
|
|
|
const char *type,
|
|
|
|
|
const char *protocol);
|
2009-07-24 17:24:41 +00:00
|
|
|
extern size_t get_af_max(void);
|
2007-07-27 20:29:47 +00:00
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
extern void debug_cod_list(struct codomain *list);
|
|
|
|
|
/* returns -1 if value != true or false, otherwise 0 == false, 1 == true */
|
|
|
|
|
extern int str_to_boolean(const char* str);
|
|
|
|
|
extern struct cod_entry *copy_cod_entry(struct cod_entry *cod);
|
|
|
|
|
extern void free_cod_entries(struct cod_entry *list);
|
|
|
|
|
|
|
|
|
|
/* parser_symtab.c */
|
|
|
|
|
extern int add_boolean_var(const char *var, int boolean);
|
|
|
|
|
extern int get_boolean_var(const char *var);
|
|
|
|
|
extern int new_set_var(const char *var, const char *value);
|
|
|
|
|
extern int add_set_value(const char *var, const char *value);
|
|
|
|
|
extern void *get_set_var(const char *var);
|
|
|
|
|
extern char *get_next_set_value(void **context);
|
|
|
|
|
extern void dump_symtab(void);
|
|
|
|
|
extern void dump_expanded_symtab(void);
|
2009-07-24 07:34:11 +00:00
|
|
|
void free_symtabs(void);
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2008-04-09 09:03:17 +00:00
|
|
|
/* parser_alias.c */
|
|
|
|
|
extern int new_alias(const char *from, const char *to);
|
2009-06-10 20:26:31 +00:00
|
|
|
extern void replace_aliases(struct codomain *cod);
|
2008-04-09 09:03:17 +00:00
|
|
|
extern void free_aliases(void);
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
/* parser_merge.c */
|
|
|
|
|
extern int codomain_merge_rules(struct codomain *cod);
|
|
|
|
|
|
|
|
|
|
/* parser_interface.c */
|
|
|
|
|
typedef struct __sdserialize sd_serialize;
|
|
|
|
|
extern int load_codomain(int option, struct codomain *cod);
|
2007-06-26 21:09:46 +00:00
|
|
|
extern int sd_serialize_profile(sd_serialize *p, struct codomain *cod,
|
|
|
|
|
int flatten);
|
2008-06-09 10:00:28 +00:00
|
|
|
extern int sd_load_buffer(int option, char *buffer, int size);
|
2009-07-24 07:36:09 +00:00
|
|
|
extern int cache_fd;
|
2008-06-09 10:00:28 +00:00
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
|
/* parser_policy.c */
|
|
|
|
|
extern void add_to_list(struct codomain *codomain);
|
|
|
|
|
extern void add_hat_to_policy(struct codomain *policy, struct codomain *hat);
|
|
|
|
|
extern void add_entry_to_policy(struct codomain *policy, struct cod_entry *entry);
|
2008-06-04 07:24:38 +00:00
|
|
|
extern void post_process_nt_entries(struct codomain *cod);
|
2006-04-11 21:52:54 +00:00
|
|
|
extern int post_process_policy(void);
|
|
|
|
|
extern int process_hat_regex(struct codomain *cod);
|
|
|
|
|
extern int process_hat_variables(struct codomain *cod);
|
|
|
|
|
extern int post_merge_rules(void);
|
|
|
|
|
extern int merge_hat_rules(struct codomain *cod);
|
|
|
|
|
extern struct codomain *merge_policy(struct codomain *a, struct codomain *b);
|
|
|
|
|
extern int load_policy(int option);
|
|
|
|
|
extern int load_hats(sd_serialize *p, struct codomain *cod);
|
2007-06-26 21:09:46 +00:00
|
|
|
extern int load_flattened_hats(struct codomain *cod);
|
2006-04-11 21:52:54 +00:00
|
|
|
extern void free_policy(struct codomain *cod);
|
|
|
|
|
extern void dump_policy(void);
|
|
|
|
|
extern void dump_policy_hats(struct codomain *cod);
|
|
|
|
|
extern void dump_policy_names(void);
|
2006-04-18 17:15:05 +00:00
|
|
|
extern int die_if_any_regex(void);
|
2009-07-24 07:34:11 +00:00
|
|
|
void free_policies(void);
|