Changeset 1960

Timestamp:

02/27/08 10:42:48 (9 months ago)

Author:

dsugar

Message:

lots of changes to support checking accesses

Files:

• branches/mls/libselinuxjava-plugin/libselinuxjava/antbuild.xml (modified) (2 diffs)
• branches/mls/libselinuxjava-plugin/libselinuxjava/selinuxswig.i (modified) (4 diffs)

branches/mls/libselinuxjava-plugin/libselinuxjava/antbuild.xml

@@ -23 +23 @@
-        </condition>
-
+        <condition property="libdir" value="/usr/lib64">
+                <and>
+                        <isset property="target_arch" />
+                        <equals arg1="x86_64" arg2="${target_arch}" />
+                </and>
+        </condition>
+        
+        <condition property="libdir" value="/usr/lib">
+                <not>
+                        <isset property="libdir" />
+                </not>
+        </condition>
+        
-        <condition property="cross_option" value="-Dfoo">
-                <not>
@@ -72 +85 @@
-                        <arg value="${target_dir}/libselinuxjava.so"/>
-                        <arg value="${target_dir}/selinuxswig_wrap.o" />
+                        <arg value="${libdir}/libsepol.a" />
-                        <arg value="-ldl"/>
+                        <arg value="-lsepol" />
-                        <arg value="-lselinux"/> 
-                </exec>

branches/mls/libselinuxjava-plugin/libselinuxjava/selinuxswig.i

@@ -3 +3 @@
-#include <selinux/selinux.h>
-#include <string.h>
+#include <sepol/sepol.h>
+#include <sepol/policydb/services.h>
+#include <sepol/policydb/sidtab.h>
+#include <sepol/policydb/flask_types.h>
-#include <sys/stat.h>
+
+typedef struct sepol_av_decision sepol_decision;
-%}
-
-
-
+
+
+
+
-int is_selinux_enabled (void);
-int is_selinux_mls_enabled (void);
@@ -14 +22 @@
-int framework_ignore_invalid_con();
-
-
-
+
-%newobject matchpathconex;
-
+onst c
-
-
@@ -33 +40 @@
-}
-
-
+onst c
-{
-        security_context_t oCon;
@@ -51 +58 @@
-// These constants are pulled from sys/stat.h
-%constant long S_IFDIR = S_IFDIR;
+
+/*
+%typemap(in) (signed char *i_pData, int i_nLen) {
+        jbyte lData = (jbyte) $input;
+        $1 = lData;
+        $2 = lData.length;
+}
+*/
+//%apply (signed char *DATA, int LENGTH) { ( signed char *i_pData, int i_nLen) };
+
+%typemap(jni) (signed char *i_pData, int i_nLen) "jbyteArray"
+%typemap(jtype) (signed char *i_pData, int i_nLen) "byte[]"
+%typemap(jstype) (signed char *i_pData, int i_nLen) "byte[]"
+
+%typemap(javain) (signed char *i_pData, int i_nLen) "$javainput"
+
+%typemap(in) (signed char *i_pData, int i_nLen)
+{
+        jboolean bIsCopy = JNI_FALSE;
+
+        //printf("Is data copy(1): %d\n", bIsCopy);
+
+        $1 = (*jenv)->GetByteArrayElements(jenv, $input, &bIsCopy);
+        $2 = (*jenv)->GetArrayLength(jenv, $input);
+        
+        //printf("Is data copy(2): %d\n", bIsCopy);
+}
+
+%typemap(freearg) (signed char *i_pData, int i_nLen)
+{
+//TODO: do I need to release this data?? It is quite a lot of data!!
+//      (*jenv)->ReleaseByteArrayElements(jenv, $input, $1, 0);
+}
+
+typedef struct policy_file {} policy_file_t;
+
+%extend policy_file_t
+{
+        policy_file_t (signed char *i_pData, int i_nLen)
+//      policy_file_t (ByteArrayStruct bas)
+        {
+                policy_file_t *result = malloc(sizeof (policy_file_t));
+                result->type = PF_USE_MEMORY;
+                result->data = (char *) i_pData;
+                result->len = i_nLen;
+                
+                return result;
+        }
+        
+        ~policy_file_t()
+        {
+                free(self);
+        }
+
+        void setPolicy (signed char *i_pData, int i_nLen)
+        {
+                self->type = PF_USE_MEMORY;
+                self->data = (char *) i_pData;
+                self->len = i_nLen;
+        }
+};
+
+// libsepol stuff -- policydb
+
+typedef struct policydb {} policydb_t;
+
+%extend policydb_t 
+{
+
+        policydb_t(policy_file_t *i_file)
+        {
+                policydb_t *result = malloc (sizeof (policydb_t));
+                policydb_init(result);
+                policydb_read (result, i_file, 0);
+                sepol_set_policydb(result);
+                return result;
+        }
+
+        ~policydb_t()
+        {
+                policydb_destroy(self);
+                free(self);
+        }
+
+};
+
+
+
+// libsepol -- sidtab
+
+typedef struct sidtab_t {} sidtab_t;
+%extend sidtab_t
+{
+        sidtab_t ()
+        {
+                sidtab_t *result = malloc (sizeof (sidtab_t));
+                sepol_sidtab_init(result);
+                sepol_set_sidtab(result);
+                return result;
+        }
+        
+        ~sidtab_t ()
+        {
+                sepol_sidtab_destroy(self);
+                free(self);
+        }
+};
+
+
+typedef struct sepol_security_id_t {} sepol_security_id_t;
+%newobject sepol_security_id_t::toString;
+
+%extend sepol_security_id_t
+{
+        sepol_security_id_t (char *i_szContext)
+        {
+                sepol_security_id_t *result = malloc (sizeof (sepol_security_id_t));
+//              int rc = 
+                        sepol_context_to_sid(i_szContext, strlen(i_szContext), result);
+                //printf ("sepol_security_id_t context %s result: %d\n", i_szContext, rc);
+                return result;
+        }
+
+        ~sepol_security_id_t ()
+        {
+                free(self);
+        }
+        
+        const char *toString ()
+        {
+                sepol_security_context_t outContext;
+                size_t outLen;
+        
+//              int rc = 
+                        sepol_sid_to_context(*self, &outContext, &outLen);
+                //printf ("sepol_security_id_t to string len %ld context %s result: %d\n", outLen, outContext, rc);
+                
+                char *result = calloc (sizeof (char), outLen + 1);
+                strncpy (result, outContext, outLen);
+                
+                //TODO: how do I free the resutling string?
+                //free (&outContext);
+                
+                return result;
+        }
+};
+
+typedef struct sepol_access_vector_t {
+        //sepol_security_class_t m_class;
+} sepol_access_vector_t;
+
+%extend sepol_access_vector_t
+{
+//      sepol_security_class_t m_class;
+
+        sepol_access_vector_t(sepol_security_class_t i_class, const char *i_szPerm)
+        {
+//              m_class = i_class;
+                sepol_access_vector_t *result = malloc(sizeof (sepol_access_vector_t));
+                *result = string_to_av_perm(i_class, i_szPerm);
+                return result;
+        }
+        
+        sepol_access_vector_t(sepol_access_vector_t *i_copy)
+        {
+                sepol_access_vector_t *result = malloc(sizeof (sepol_access_vector_t));
+                *result = *i_copy;
+                return result;
+        }
+        
+        ~sepol_access_vector_t()
+        {
+                free(self);
+        }
+        
+        int isValid ()
+        {
+                return *self != 0;
+        }
+        
+        sepol_access_vector_t *addPerm (sepol_access_vector_t *i_addMe)
+        {
+                *self |= *i_addMe;
+                return self;
+        }
+        
+/*      
+        const char *toString ()
+        {
+                return security_av_perm_to_string(m_class, *self);
+        }
+*/
+};
+
+
+typedef struct sepol_security_class_t {} sepol_security_class_t;
+%extend sepol_security_class_t
+{
+        sepol_security_class_t (const char *i_szClass)
+        {
+                sepol_security_class_t *result = malloc(sizeof (sepol_security_class_t));
+                *result = string_to_security_class(i_szClass);
+                return result;
+        }
+        
+        ~sepol_security_class_t()
+        {
+                free(self);
+        }
+        
+        const char *toString ()
+        {
+                return security_class_to_string (*self);
+        }
+}; 
+
+
+//int sepol_compute_av_reason(sepol_security_id_t ssid, sepol_security_id_t tsid, sepol_security_class_t tclass, sepol_access_vector_t requested, 
+
+
+typedef struct sepol_decision {} sepol_decision;
+%extend sepol_decision
+{
+        sepol_decision(sepol_security_id_t i_ssid, 
+                sepol_security_id_t i_tsid,
+                sepol_security_class_t i_tclass,
+                sepol_access_vector_t i_requested)
+        {
+                sepol_decision *result = malloc(sizeof(sepol_decision));
+                sepol_compute_av(i_ssid, i_tsid, i_tclass, i_requested, result);
+                return result;
+        }
+        
+        ~sepol_decision ()
+        {
+                free(self);
+        }
+
+        int getAllowed ()
+        {       
+                return self->allowed;
+        }
+        
+};