mirror of
https://github.com/openharmony/kernel_linux_common_modules.git
synced 2026-08-27 01:31:36 -04:00
staralien
0afc82cd6f
--------------------------------------- DEC(Dynamic Enhance Control) is a dynamic file access enhancement mechanism. It resolves DAC interception and sharefs security risks, precisely controlling file access via a kernel permission database, ioctl interfaces and LSM framework. DEC will bind the token ID of the application and the paths it can access. The user-level sandboxmanager module and appspawn module will configure the relevant policies. When the application accesses the control paths under the sharefs file system, DEC checks the: create, read, write, remove, rename, move, access of files by the application. Signed-off-by: staralien <chengxin@servicecenter-harmonytsc.com>
40 lines
922 B
C
40 lines
922 B
C
/*
|
|
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
* Copyright (c) 2026 Huawei Device Co., Ltd.
|
|
*/
|
|
|
|
#ifndef _DEC_PATH_TREE_H
|
|
#define _DEC_PATH_TREE_H
|
|
|
|
#include <linux/types.h>
|
|
|
|
#include "dec_common.h"
|
|
|
|
enum delete_criteria {
|
|
DELETE_BY_TOKENID = 1,
|
|
DELETE_BY_USERID,
|
|
};
|
|
|
|
union dec_dectroy_params {
|
|
struct {
|
|
uint64_t tokenid;
|
|
} tokeninfo;
|
|
struct {
|
|
int userid;
|
|
const char *path;
|
|
} userinfo;
|
|
};
|
|
|
|
struct dec_destroy_ctx {
|
|
enum delete_criteria criteria;
|
|
union dec_dectroy_params params;
|
|
uint64_t timestamp;
|
|
};
|
|
|
|
bool dec_path_tree_query(uint64_t tokenid, const char *path, uint32_t mode, bool is_persist);
|
|
int dec_set_rule(struct path_tree_params *params);
|
|
int dec_delete_rule(uint64_t tokenid, const char *path, uint64_t timestamp);
|
|
int dec_destroy_rule_by_id(struct dec_destroy_ctx *ctx);
|
|
|
|
int dec_set_prefix(const char *prefix);
|
|
#endif /* _DEC_PATH_TREE_H */ |