return ret == 0 ? 0 : -1;
}
-void smack_rule_set_remove(SmackRuleSet handle, const char *subject,
- const char *object)
-{
- struct smack_subject *s = NULL;
- struct smack_object *o = NULL;
-
- HASH_FIND_STR(handle->subjects, subject, s);
- if (s == NULL)
- return;
-
- HASH_FIND_STR(s->objects, object, o);
- if (o == NULL)
- return;
-
- o->ac = 0;
- return;
-}
-
-void smack_rule_set_remove_by_subject(SmackRuleSet handle, const char *subject)
-{
- struct smack_subject *s = NULL;
- struct smack_object *o = NULL, *tmp = NULL;
-
- HASH_FIND_STR(handle->subjects, subject, s);
- if (s == NULL)
- return;
-
- HASH_ITER(hh, s->objects, o, tmp)
- o->ac = 0;
-}
-
-void smack_rule_set_remove_by_object(SmackRuleSet handle, const char *object)
-{
- struct smack_subject *s = NULL, *tmp = NULL;
- struct smack_object *o = NULL;
-
- HASH_ITER(hh, handle->subjects, s, tmp) {
- HASH_FIND_STR(s->objects, object, o);
- if (o)
- o->ac = 0;
- }
-}
-
int smack_rule_set_have_access(SmackRuleSet handle, const char *subject,
const char *object, const char *access_str)
{
const char *object, const char *access);
/*!
- * Remove rule from a rule set. When rules are applied to kernel, removed
- * rules will be written with empty access code.
- *
- * @param handle handle to a rule set
- * @param subject subject of the rule
- * @param object object of the rule
- * @return Returns negative value on failure.
- */
-extern void smack_rule_set_remove(SmackRuleSet handle, const char *subject,
- const char *object);
-
-/*!
- * Remove all rules with the given subject from a rule set. When rules are
- * applied to kernel, removed rules will be written with empty access code.
- *
- * @param handle handle to a rule set
- * @param subject subject of the rule
- */
-extern void smack_rule_set_remove_by_subject(SmackRuleSet handle,
- const char *subject);
-
-/*!
- * Remove all rules with the given object from a rule set. When rules are
- * applied to kernel, removed rules will be written with empty access code.
-
- * @param handle handle to a rule set
- * @param object object of the rule
- */
-extern void smack_rule_set_remove_by_object(SmackRuleSet handle,
- const char *object);
-
-/*!
* Check access to a give object from the give rule set.
*
* @param handle handle to a rule set
smack_rule_set_add(rules, "Apple", "Orange", "rwx");
smack_rule_set_add(rules, "Plum", "Peach", "rx");
smack_rule_set_add(rules, "Banana", "Peach", "xa");
- smack_rule_set_remove(rules, "Plum", "Peach");
rc = smack_rule_set_apply_kernel(
rules,
smack_rule_set_add(rules, "Apple", "Orange", "rwx");
smack_rule_set_add(rules, "Plum", "Peach", "rx");
smack_rule_set_add(rules, "Banana", "Peach", "xa");
- smack_rule_set_remove(rules, "Plum", "Peach");
rc = smack_rule_set_save(
rules,
}
END_TEST
-START_TEST(test_rule_set_remove_by_subject)
-{
- int rc;
- SmackRuleSet rules;
-
- rules = smack_rule_set_new(NULL);
- fail_unless(rules != NULL, "Creating rule set failed");
- if (rules == NULL)
- return;
-
- smack_rule_set_add(rules, "Apple", "Orange", "rwx");
- smack_rule_set_add(rules, "Plum", "Peach", "rx");
- smack_rule_set_add(rules, "Banana", "Peach", "xa");
-
- smack_rule_set_remove_by_subject(rules, "Plum");
-
- rc = smack_rule_set_have_access(rules, "Plum", "Peach", "rx");
- fail_unless(rc == 0, "Access granted to a removed rule");
-
- smack_rule_set_free(rules);
-}
-END_TEST
-
-START_TEST(test_rule_set_remove_by_object)
-{
- int rc;
- SmackRuleSet rules;
-
- rules = smack_rule_set_new(NULL);
- fail_unless(rules != NULL, "Creating rule set failed");
- if (rules == NULL)
- return;
-
- smack_rule_set_add(rules, "Apple", "Orange", "rwx");
- smack_rule_set_add(rules, "Plum", "Peach", "rx");
- smack_rule_set_add(rules, "Banana", "Peach", "xa");
-
- smack_rule_set_remove_by_object(rules, "Peach");
-
- rc = smack_rule_set_have_access(rules, "Plum", "Peach", "rx");
- fail_unless(rc == 0, "Access granted to a removed rule");
-
- smack_rule_set_free(rules);
-}
-END_TEST
-
Suite *ruleset_suite (void)
{
Suite *s;
tc_core = tcase_create("Rules");
tcase_add_test(tc_core, test_save_to_kernel);
tcase_add_test(tc_core, test_save_to_file);
- tcase_add_test(tc_core, test_rule_set_remove_by_subject);
- tcase_add_test(tc_core, test_rule_set_remove_by_object);
suite_add_tcase(s, tc_core);
return s;