avdatum = avtab_search(&policydb.te_avtab, &avkey, AVTAB_AV); if (avdatum) { if (avdatum->specified & AVTAB_ALLOWED) avd->allowed = avtab_allowed(avdatum); if (avdatum->specified & AVTAB_AUDITDENY) avd->auditdeny = avtab_auditdeny(avdatum); if (avdatum->specified & AVTAB_AUDITALLOW) avd->auditallow = avtab_auditallow(avdatum); 
avkey.specified = AVTAB_AV; sattr = &policydb.type_attr_map[scontext->type - 1]; tattr = &policydb.type_attr_map[tcontext->type - 1]; ebitmap_for_each_bit(sattr, snode, i) { if (!ebitmap_node_get_bit(snode, i)) continue; ebitmap_for_each_bit(tattr, tnode, j) { if (!ebitmap_node_get_bit(tnode, j)) continue; avkey.source_type = i + 1; avkey.target_type = j + 1; for (node = avtab_search_node(&policydb.te_avtab, &avkey); node != NULL; node = avtab_search_node_next(node, avkey.specified)) { if (node->key.specified == AVTAB_ALLOWED) avd->allowed |= node->datum.data; else if (node->key.specified == AVTAB_AUDITALLOW) avd->auditallow |= node->datum.data; else if (node->key.specified == AVTAB_AUDITDENY) avd->auditdeny &= node->datum.data; }  /* Check conditional av table for additional permissions */ cond_compute_av(&policydb.te_cond_avtab, &avkey, avd);  } 
static int context_struct_compute_av(struct context *scontext,				     struct context *tcontext,				     u16 tclass,				     u32 requested,				     struct av_decision *avd){	struct constraint_node *constraint;	struct role_allow *ra;	struct avtab_key avkey;	struct avtab_datum *avdatum;	struct class_datum *tclass_datum;	/*	 * Remap extended Netlink classes for old policy versions.	 * Do this here rather than socket_type_to_security_class()	 * in case a newer policy version is loaded, allowing sockets	 * to remain in the correct class.	 */	if (policydb_loaded_version < POLICYDB_VERSION_NLCLASS)		if (tclass >= SECCLASS_NETLINK_ROUTE_SOCKET &&		    tclass <= SECCLASS_NETLINK_DNRT_SOCKET)			tclass = SECCLASS_NETLINK_SOCKET;	if (!tclass || tclass > policydb.p_classes.nprim) {		printk(KERN_ERR "security_compute_av:  unrecognized class %d\n",		       tclass);		return -EINVAL;	}	tclass_datum = policydb.class_val_to_struct[tclass - 1];	/*	 * Initialize the access vectors to the default values.	 */	avd->allowed = 0;	avd->decided = 0xffffffff;	avd->auditallow = 0;	avd->auditdeny = 0xffffffff;	avd->seqno = latest_granting;	/*	 * If a specific type enforcement rule was defined for	 * this permission check, then use it.	 */	avkey.source_type = scontext->type;	avkey.target_type = tcontext->type;	avkey.target_class = tclass;	avdatum = avtab_search(&policydb.te_avtab, &avkey, AVTAB_AV);	if (avdatum) {		if (avdatum->specified & AVTAB_ALLOWED)			avd->allowed = avtab_allowed(avdatum);		if (avdatum->specified & AVTAB_AUDITDENY)			avd->auditdeny = avtab_auditdeny(avdatum);		if (avdatum->specified & AVTAB_AUDITALLOW)			avd->auditallow = avtab_auditallow(avdatum);	}	/* Check conditional av table for additional permissions */	cond_compute_av(&policydb.te_cond_avtab, &avkey, avd);	/*	 * Remove any permissions prohibited by a constraint (this includes	 * the MLS policy).	 */	constraint = tclass_datum->constraints;	while (constraint) {		if ((constraint->permissions & (avd->allowed)) &&		    !constraint_expr_eval(scontext, tcontext, NULL,					  constraint->expr)) {			avd->allowed = (avd->allowed) & ~(constraint->permissions);		}		constraint = constraint->next;	}	/*	 * If checking process transition permission and the	 * role is changing, then check the (current_role, new_role)	 * pair.	 */	if (tclass == SECCLASS_PROCESS &&	    (avd->allowed & (PROCESS__TRANSITION | PROCESS__DYNTRANSITION)) &&	    scontext->role != tcontext->role) {		for (ra = policydb.role_allow; ra; ra = ra->next) {			if (scontext->role == ra->role &&			    tcontext->role == ra->new_role)				break;		}		if (!ra)			avd->allowed = (avd->allowed) & ~(PROCESS__TRANSITION |			                                PROCESS__DYNTRANSITION);	}	return 0;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/782ebb992ec20b5afdd5786ee8c2f1b58b631f24/services.c/clean/security/selinux/ss/services.c