summaryrefslogtreecommitdiffstats
path: root/scripts/selinux/genheaders
Commit message (Collapse)AuthorAgeFilesLines
* selinux: genheaders should fail if too many permissions are definedStephen Smalley2017-07-311-1/+6
| | | | | | | | | | | Ensure that genheaders fails with an error if too many permissions are defined in a class to fit within an access vector. This is similar to a check performed by checkpolicy when compiling the policy. Also, fix the suffix on the permission constants generated by this program. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com>
* selinux: include sys/socket.h in host programs to have PF_MAXNicolas Iooss2017-03-101-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Compiling with clang and -Wundef makes the compiler report a usage of undefined PF_MAX macro in security/selinux/include/classmap.h: In file included from scripts/selinux/mdp/mdp.c:48: security/selinux/include/classmap.h:37:31: warning: no previous extern declaration for non-static variable 'secclass_map' [-Wmissing-variable-declarations] struct security_class_mapping secclass_map[] = { ^ security/selinux/include/classmap.h:235:5: error: 'PF_MAX' is not defined, evaluates to 0 [-Werror,-Wundef] #if PF_MAX > 43 ^ In file included from scripts/selinux/genheaders/genheaders.c:17: security/selinux/include/classmap.h:37:31: warning: no previous extern declaration for non-static variable 'secclass_map' [-Wmissing-variable-declarations] struct security_class_mapping secclass_map[] = { ^ security/selinux/include/classmap.h:235:5: error: 'PF_MAX' is not defined, evaluates to 0 [-Werror,-Wundef] #if PF_MAX > 43 ^ PF_MAX is defined in include/linux/socket.h but not in include/uapi/linux/socket.h. Therefore host programs have to rely on the definition from libc's /usr/include/bits/socket.h, included by <sys/socket.h>. Fix the issue by using sys/socket.h in mdp and genheaders. When classmap.h is included by security/selinux/avc.c, it uses the kernel definition of PF_MAX, which makes the test consistent. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org> Signed-off-by: Paul Moore <paul@paul-moore.com>
* selinux: use the kernel headers when building scripts/selinuxPaul Moore2016-12-212-1/+7
| | | | | | | | | | | | | | Commit 3322d0d64f4e ("selinux: keep SELinux in sync with new capability definitions") added a check on the defined capabilities without explicitly including the capability header file which caused problems when building genheaders for users of clang/llvm. Resolve this by using the kernel headers when building genheaders, which is arguably the right thing to do regardless, and explicitly including the kernel's capability.h header file in classmap.h. We also update the mdp build, even though it wasn't causing an error we really should be using the headers from the kernel we are building. Reported-by: Nicolas Iooss <nicolas.iooss@m4x.org> Signed-off-by: Paul Moore <paul@paul-moore.com>
* selinux, kbuild: remove unnecessary $(hostprogs-y) from clean-filesMasahiro Yamada2014-06-171-1/+0
| | | | | | | | | Files added to hostprogs-y are cleaned. (See scripts/Makefile.clean) Adding them to clean-files is redundant. Signed-off-by: Masahiro Yamada <yamada.m@jp.panasonic.com> Acked-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Paul Moore <pmoore@redhat.com>
* SELinux: Auto-generate security_is_socket_classHarry Ciao2011-03-031-0/+20
| | | | | | | | | | | The security_is_socket_class() is auto-generated by genheaders based on classmap.h to reduce maintenance effort when a new class is defined in SELinux kernel. The name for any socket class should be suffixed by "socket" and doesn't contain more than one substr of "socket". Signed-off-by: Harry Ciao <qingtao.cao@windriver.com> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
* selinux: fix warning in genheadersJames Morris2010-03-161-1/+1
| | | | | | | | | | Fix const warning in the genheaders script as a result of changes to the headers, as noted here: http://linux.derkeiler.com/Mailing-Lists/Kernel/2010-03/msg03977.html Reported-by: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: James Morris <jmorris@namei.org>
* SELinux: header generation may hit infinite loopEric Paris2009-11-231-1/+1
| | | | | | | | | | If a permission name is long enough the selinux class definition generation tool will go into a infinite loop. This is because it's macro max() is fooled into thinking it is dealing with unsigned numbers. This patch makes sure the macro always uses signed number so 1 > -1. Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: James Morris <jmorris@namei.org>
* selinux: Fix warningsAlan Cox2009-11-191-2/+2
| | | | | | | | | | | scripts/selinux/genheaders/genheaders.c:20: warning: no previous prototype for ?usage? scripts/selinux/genheaders/genheaders.c:26: warning: no previous prototype for ?stoupperx? Signed-off-by: Alan Cox <alan@linux.intel.com> Acked-by: WANG Cong <xiyou.wangcong@gmail.com> Signed-off-by: James Morris <jmorris@namei.org>
* SELinux: add .gitignore files for dynamic classesEric Paris2009-10-241-0/+1
| | | | | | | | | | The SELinux dynamic class work in c6d3aaa4e35c71a32a86ececacd4eea7ecfc316c creates a number of dynamic header files and scripts. Add .gitignore files so git doesn't complain about these. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Stephen D. Smalley <sds@tycho.nsa.gov> Signed-off-by: James Morris <jmorris@namei.org>
* selinux: generate flask headers during kernel buildStephen Smalley2009-10-072-0/+123
Add a simple utility (scripts/selinux/genheaders) and invoke it to generate the kernel-private class and permission indices in flask.h and av_permissions.h automatically during the kernel build from the security class mapping definitions in classmap.h. Adding new kernel classes and permissions can then be done just by adding them to classmap.h. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: James Morris <jmorris@namei.org>