Re: object class discovery userland

[Eamon Walsh <ewalsh@tycho.nsa.gov>]

Joshua Brindle wrote:
> Eamon Walsh wrote:
>> Here's a first go at an interface.  It's an init function
>> that is a replacement for avc_init().  It takes flags, the
>> class/permission mapping to use, and callback functions.
>>
>> This is trying to solve a few other problems at the same time, namely:
>>
>> - selinux prefix on the function name
> 
> So the client callsites will have to change then, oh well, we wanted to
> do this anyway..

Well, the old avc_init() could be kept around for awhile.  Calling it 
would still work, it just wouldn't have a mapping (would treat incoming 
class/perm values literally).

> 
>> - drops support for memory, threading, and locking callbacks
>> (would just always use malloc and pthread)
> 
> Were these ever used or were they a remnant of the early
> implementations?

I'm not aware of any users of them.  I put them in basically because the 
X server wrapped malloc ("Xalloc"), glib has malloc wrappers and so 
forth.  But the X people are moving away from this and back to straight 
malloc.  I've come around to the belief that this is better done through 
the linker with private functions.


>> - adds type code to logging callback
>>
>> ---
>>
>>  selinux.h |   37 +++++++++++++++++++++++++++++++++++++
>>  1 file changed, 37 insertions(+)
>>
>>
>> Index: libselinux/include/selinux/selinux.h
>> ===================================================================
>> --- libselinux/include/selinux/selinux.h	(revision 2445)
>> +++ libselinux/include/selinux/selinux.h	(working copy) @@ -132,6
>>  		+132,43 @@ unsigned int seqno;
>>  	};
>>
>> +	struct av_mapping {
>> +		const char *name;
>> +		const access_vector_t value;
>> +	};
>> +
> 
> Should this be a linked list?

I was thinking that the last element could be zeroed out.  Same thing 
with the last class element.  Would make it easier to have a static 
initializer e.g.

struct security_class_mapping *mapping = {
	{ "xwindow", 32, {{"create", 1}, {"draw", 2}, {NULL, 0}} },
	{ "xcursor", 33, {{"create", 1}, {"show", 2}, {NULL, 0}} },
	{ NULL, 0, NULL }
};


-- 
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.