poldiff.h File Reference

00058         {
00059         /** only for error conditions */
00060                 POLDIFF_FORM_NONE,
00061         /** item was added - only in policy 2 */
00062                 POLDIFF_FORM_ADDED,
00063         /** item was removed - only in policy 1 */
00064                 POLDIFF_FORM_REMOVED,
00065         /** item was modified - in both policies but with different meaning */
00066                 POLDIFF_FORM_MODIFIED,
00067         /** item was added due to an added type - for rules only */
00068                 POLDIFF_FORM_ADD_TYPE,
00069         /** item was removed due to a removed type - for rules only */
00070                 POLDIFF_FORM_REMOVE_TYPE
00071         } poldiff_form_e;

00320 {
00321         poldiff_t *diff = NULL;
00322         int error;
00323 
00324         if (!orig_policy || !mod_policy) {
00325                 ERR(NULL, "%s", strerror(EINVAL));
00326                 errno = EINVAL;
00327                 return NULL;
00328         }
00329 
00330         if (!(diff = calloc(1, sizeof(poldiff_t)))) {
00331                 ERR(NULL, "%s", strerror(ENOMEM));
00332                 errno = ENOMEM;
00333                 return NULL;
00334         }
00335         diff->orig_pol = orig_policy;
00336         diff->mod_pol = mod_policy;
00337         diff->orig_qpol = apol_policy_get_qpol(diff->orig_pol);
00338         diff->mod_qpol = apol_policy_get_qpol(diff->mod_pol);
00339         diff->fn = fn;
00340         diff->handle_arg = callback_arg;
00341         if ((diff->type_map = type_map_create()) == NULL) {
00342                 ERR(diff, "%s", strerror(ENOMEM));
00343                 poldiff_destroy(&diff);
00344                 errno = ENOMEM;
00345                 return NULL;
00346         }
00347         if (type_map_infer(diff) < 0) {
00348                 error = errno;
00349                 poldiff_destroy(&diff);
00350                 errno = error;
00351                 return NULL;
00352         }
00353 
00354         if ((diff->attrib_diffs = attrib_summary_create()) == NULL ||
00355             (diff->avrule_diffs[AVRULE_OFFSET_ALLOW] = avrule_create()) == NULL ||
00356             (diff->avrule_diffs[AVRULE_OFFSET_AUDITALLOW] = avrule_create()) == NULL ||
00357             (diff->avrule_diffs[AVRULE_OFFSET_DONTAUDIT] = avrule_create()) == NULL ||
00358             (diff->avrule_diffs[AVRULE_OFFSET_NEVERALLOW] = avrule_create()) == NULL ||
00359             (diff->bool_diffs = bool_create()) == NULL ||
00360             (diff->cat_diffs = cat_create()) == NULL ||
00361             (diff->class_diffs = class_create()) == NULL ||
00362             (diff->common_diffs = common_create()) == NULL ||
00363             (diff->level_diffs = level_create()) == NULL ||
00364             (diff->range_trans_diffs = range_trans_create()) == NULL ||
00365             (diff->role_diffs = role_create()) == NULL ||
00366             (diff->role_allow_diffs = role_allow_create()) == NULL ||
00367             (diff->role_trans_diffs = role_trans_create()) == NULL ||
00368             (diff->terule_diffs[TERULE_OFFSET_CHANGE] = terule_create()) == NULL ||
00369             (diff->terule_diffs[TERULE_OFFSET_MEMBER] = terule_create()) == NULL ||
00370             (diff->terule_diffs[TERULE_OFFSET_TRANS] = terule_create()) == NULL ||
00371             (diff->type_diffs = type_summary_create()) == NULL || (diff->user_diffs = user_create()) == NULL) {
00372                 ERR(diff, "%s", strerror(ENOMEM));
00373                 poldiff_destroy(&diff);
00374                 errno = ENOMEM;
00375                 return NULL;
00376         }
00377 
00378         diff->policy_opts = QPOL_POLICY_OPTION_NO_RULES | QPOL_POLICY_OPTION_NO_NEVERALLOWS;
00379         return diff;
00380 }

00383 {
00384         if (!diff || !(*diff))
00385                 return;
00386         apol_policy_destroy(&(*diff)->orig_pol);
00387         apol_policy_destroy(&(*diff)->mod_pol);
00388         apol_bst_destroy(&(*diff)->class_bst);
00389         apol_bst_destroy(&(*diff)->perm_bst);
00390         apol_bst_destroy(&(*diff)->bool_bst);
00391 
00392         type_map_destroy(&(*diff)->type_map);
00393         attrib_summary_destroy(&(*diff)->attrib_diffs);
00394         avrule_destroy(&(*diff)->avrule_diffs[AVRULE_OFFSET_ALLOW]);
00395         avrule_destroy(&(*diff)->avrule_diffs[AVRULE_OFFSET_AUDITALLOW]);
00396         avrule_destroy(&(*diff)->avrule_diffs[AVRULE_OFFSET_DONTAUDIT]);
00397         avrule_destroy(&(*diff)->avrule_diffs[AVRULE_OFFSET_NEVERALLOW]);
00398         bool_destroy(&(*diff)->bool_diffs);
00399         cat_destroy(&(*diff)->cat_diffs);
00400         class_destroy(&(*diff)->class_diffs);
00401         common_destroy(&(*diff)->common_diffs);
00402         level_destroy(&(*diff)->level_diffs);
00403         range_trans_destroy(&(*diff)->range_trans_diffs);
00404         role_destroy(&(*diff)->role_diffs);
00405         role_allow_destroy(&(*diff)->role_allow_diffs);
00406         role_trans_destroy(&(*diff)->role_trans_diffs);
00407         user_destroy(&(*diff)->user_diffs);
00408         terule_destroy(&(*diff)->terule_diffs[TERULE_OFFSET_CHANGE]);
00409         terule_destroy(&(*diff)->terule_diffs[TERULE_OFFSET_MEMBER]);
00410         terule_destroy(&(*diff)->terule_diffs[TERULE_OFFSET_TRANS]);
00411         type_summary_destroy(&(*diff)->type_diffs);
00412         free(*diff);
00413         *diff = NULL;
00414 }

00514 {
00515         size_t i, num_items;
00516 
00517         if (!flags)
00518                 return 0;              /* nothing to do */
00519 
00520         if (!diff) {
00521                 ERR(diff, "%s", strerror(EINVAL));
00522                 errno = EINVAL;
00523                 return -1;
00524         }
00525 
00526         int policy_opts = diff->policy_opts;
00527         if (flags & (POLDIFF_DIFF_AVRULES | POLDIFF_DIFF_TERULES)) {
00528                 policy_opts &= ~(QPOL_POLICY_OPTION_NO_RULES);
00529         }
00530         if (flags & POLDIFF_DIFF_AVNEVERALLOW) {
00531                 policy_opts &= ~(QPOL_POLICY_OPTION_NO_NEVERALLOWS);
00532         }
00533         if (policy_opts != diff->policy_opts) {
00534                 INFO(diff, "%s", "Loading rules from original policy.");
00535                 if (qpol_policy_rebuild(diff->orig_qpol, policy_opts)) {
00536                         return -1;
00537                 }
00538                 INFO(diff, "%s", "Loading rules from modified policy.");
00539                 if (qpol_policy_rebuild(diff->mod_qpol, policy_opts)) {
00540                         return -1;
00541                 }
00542                 // force flushing of existing pointers into policies
00543                 diff->remapped = 1;
00544                 diff->policy_opts = policy_opts;
00545         }
00546 
00547         num_items = sizeof(component_records) / sizeof(poldiff_component_record_t);
00548         if (diff->remapped) {
00549                 for (i = 0; i < num_items; i++) {
00550                         if (component_records[i].flag_bit & POLDIFF_DIFF_REMAPPED) {
00551                                 INFO(diff, "Resetting %s diff.", component_records[i].item_name);
00552                                 if (component_records[i].reset(diff))
00553                                         return -1;
00554                         }
00555                 }
00556                 diff->diff_status &= ~(POLDIFF_DIFF_REMAPPED);
00557                 diff->remapped = 0;
00558         }
00559 
00560         INFO(diff, "%s", "Building type map.");
00561         if (type_map_build(diff)) {
00562                 return -1;
00563         }
00564 
00565         diff->line_numbers_enabled = 0;
00566         for (i = 0; i < num_items; i++) {
00567                 /* item requested but not yet run */
00568                 if ((flags & component_records[i].flag_bit) && !(component_records[i].flag_bit & diff->diff_status)) {
00569                         INFO(diff, "Running %s diff.", component_records[i].item_name);
00570                         if (poldiff_do_item_diff(diff, &(component_records[i]))) {
00571                                 return -1;
00572                         }
00573                 }
00574         }
00575 
00576         return 0;
00577 }

00580 {
00581         if (!flags)
00582                 return 1;              /* nothing to do */
00583 
00584         if (!diff) {
00585                 ERR(diff, "%s", strerror(EINVAL));
00586                 errno = EINVAL;
00587                 return -1;
00588         }
00589         if ((diff->diff_status & flags) == flags) {
00590                 return 1;
00591         }
00592         return 0;
00593 }

00596 {
00597         size_t i, j, num_items, tmp_stats[5] = { 0, 0, 0, 0, 0 };
00598 
00599         if (!diff || !flags) {
00600                 ERR(diff, "%s", strerror(EINVAL));
00601                 errno = EINVAL;
00602                 return -1;
00603         }
00604 
00605         stats[0] = stats[1] = stats[2] = stats[3] = stats[4] = 0;
00606 
00607         num_items = sizeof(component_records) / sizeof(poldiff_component_record_t);
00608         for (i = 0; i < num_items; i++) {
00609                 if (flags & component_records[i].flag_bit) {
00610                         component_records[i].get_stats(diff, tmp_stats);
00611                         for (j = 0; j < 5; j++)
00612                                 stats[j] += tmp_stats[j];
00613                 }
00614         }
00615 
00616         return 0;
00617 }

00620 {
00621         int retval;
00622         if (diff == NULL) {
00623                 errno = EINVAL;
00624                 return -1;
00625         }
00626         if (!diff->line_numbers_enabled) {
00627                 if (qpol_policy_build_syn_rule_table(diff->orig_qpol))
00628                         return -1;
00629                 if (qpol_policy_build_syn_rule_table(diff->mod_qpol))
00630                         return -1;
00631                 if ((retval = avrule_enable_line_numbers(diff, AVRULE_OFFSET_ALLOW)) < 0) {
00632                         return retval;
00633                 }
00634                 if ((retval = avrule_enable_line_numbers(diff, AVRULE_OFFSET_AUDITALLOW)) < 0) {
00635                         return retval;
00636                 }
00637                 if ((retval = avrule_enable_line_numbers(diff, AVRULE_OFFSET_DONTAUDIT)) < 0) {
00638                         return retval;
00639                 }
00640                 if ((retval = avrule_enable_line_numbers(diff, AVRULE_OFFSET_NEVERALLOW)) < 0) {
00641                         return retval;
00642                 }
00643                 if ((retval = terule_enable_line_numbers(diff, TERULE_OFFSET_CHANGE)) < 0) {
00644                         return retval;
00645                 }
00646                 if ((retval = terule_enable_line_numbers(diff, TERULE_OFFSET_MEMBER)) < 0) {
00647                         return retval;
00648                 }
00649                 if ((retval = terule_enable_line_numbers(diff, TERULE_OFFSET_TRANS)) < 0) {
00650                         return retval;
00651                 }
00652                 diff->line_numbers_enabled = 1;
00653         }
00654         return 0;
00655 }