/* SPDX-License-Identifier: GPL-2.0-only */ /* * AppArmor security module * * This file contains AppArmor policy dfa matching engine definitions. * * Copyright (C) 1998-2008 Novell/SUSE * Copyright 2009-2012 Canonical Ltd. */ #ifndef __AA_MATCH_H #define __AA_MATCH_H #include <linux/kref.h> #define DFA_NOMATCH … #define DFA_START … /** * The format used for transition tables is based on the GNU flex table * file format (--tables-file option; see Table File Format in the flex * info pages and the flex sources for documentation). The magic number * used in the header is 0x1B5E783D instead of 0xF13C57B1 though, because * new tables have been defined and others YY_ID_CHK (check) and YY_ID_DEF * (default) tables are used slightly differently (see the apparmor-parser * package). * * * The data in the packed dfa is stored in network byte order, and the tables * are arranged for flexibility. We convert the table data to host native * byte order. * * The dfa begins with a table set header, and is followed by the actual * tables. */ #define YYTH_MAGIC … #define YYTH_FLAG_DIFF_ENCODE … #define YYTH_FLAG_OOB_TRANS … #define YYTH_FLAGS … #define MAX_OOB_SUPPORTED … struct table_set_header { … }; /* The YYTD_ID are one less than flex table mappings. The flex id * has 1 subtracted at table load time, this allows us to directly use the * ID's as indexes. */ #define YYTD_ID_ACCEPT … #define YYTD_ID_BASE … #define YYTD_ID_CHK … #define YYTD_ID_DEF … #define YYTD_ID_EC … #define YYTD_ID_META … #define YYTD_ID_ACCEPT2 … #define YYTD_ID_NXT … #define YYTD_ID_TSIZE … #define YYTD_ID_MAX … #define YYTD_DATA8 … #define YYTD_DATA16 … #define YYTD_DATA32 … #define YYTD_DATA64 … /* ACCEPT & ACCEPT2 tables gets 6 dedicated flags, YYTD_DATAX define the * first flags */ #define ACCEPT1_FLAGS(X) … #define ACCEPT2_FLAGS(X) … #define TO_ACCEPT1_FLAG(X) … #define TO_ACCEPT2_FLAG(X) … #define DFA_FLAG_VERIFY_STATES … struct table_header { … }; #define DEFAULT_TABLE(DFA) … #define BASE_TABLE(DFA) … #define NEXT_TABLE(DFA) … #define CHECK_TABLE(DFA) … #define EQUIV_TABLE(DFA) … #define ACCEPT_TABLE(DFA) … #define ACCEPT_TABLE2(DFA) … struct aa_dfa { … }; #define byte_to_byte(X) … #define UNPACK_ARRAY(TABLE, BLOB, LEN, TTYPE, BTYPE, NTOHX) … static inline size_t table_size(size_t len, size_t el_size) { … } #define aa_state_t … struct aa_dfa *aa_dfa_unpack(void *blob, size_t size, int flags); aa_state_t aa_dfa_match_len(struct aa_dfa *dfa, aa_state_t start, const char *str, int len); aa_state_t aa_dfa_match(struct aa_dfa *dfa, aa_state_t start, const char *str); aa_state_t aa_dfa_next(struct aa_dfa *dfa, aa_state_t state, const char c); aa_state_t aa_dfa_outofband_transition(struct aa_dfa *dfa, aa_state_t state); aa_state_t aa_dfa_match_until(struct aa_dfa *dfa, aa_state_t start, const char *str, const char **retpos); aa_state_t aa_dfa_matchn_until(struct aa_dfa *dfa, aa_state_t start, const char *str, int n, const char **retpos); void aa_dfa_free_kref(struct kref *kref); #define WB_HISTORY_SIZE … struct match_workbuf { … }; #define DEFINE_MATCH_WB(N) … aa_state_t aa_dfa_leftmatch(struct aa_dfa *dfa, aa_state_t start, const char *str, unsigned int *count); /** * aa_get_dfa - increment refcount on dfa @p * @dfa: dfa (MAYBE NULL) * * Returns: pointer to @dfa if @dfa is NULL will return NULL * Requires: @dfa must be held with valid refcount when called */ static inline struct aa_dfa *aa_get_dfa(struct aa_dfa *dfa) { … } /** * aa_put_dfa - put a dfa refcount * @dfa: dfa to put refcount (MAYBE NULL) * * Requires: if @dfa != NULL that a valid refcount be held */ static inline void aa_put_dfa(struct aa_dfa *dfa) { … } #define MATCH_FLAG_DIFF_ENCODE … #define MARK_DIFF_ENCODE … #define MATCH_FLAG_OOB_TRANSITION … #define MATCH_FLAGS_MASK … #define MATCH_FLAGS_VALID … #define MATCH_FLAGS_INVALID … #endif /* __AA_MATCH_H */
Codebase Browser
linux