add main branch files

kernel/selinux/Makefile

@@ -0,0 +1,16 @@
+obj-y += selinux.o
+obj-y += sepolicy.o
+obj-y += rules.o
+
+ifeq ($(shell grep -q " current_sid(void)" $(srctree)/security/selinux/include/objsec.h; echo $$?),0)
+ccflags-y += -DKSU_COMPAT_HAS_CURRENT_SID
+endif
+
+ifeq ($(shell grep -q "struct selinux_state " $(srctree)/security/selinux/include/security.h; echo $$?),0)
+ccflags-y += -DKSU_COMPAT_HAS_SELINUX_STATE
+endif
+
+ccflags-y += -Wno-implicit-function-declaration -Wno-strict-prototypes -Wno-int-conversion
+ccflags-y += -Wno-declaration-after-statement -Wno-unused-function
+ccflags-y += -I$(srctree)/security/selinux -I$(srctree)/security/selinux/include
+ccflags-y += -I$(objtree)/security/selinux -include $(srctree)/include/uapi/asm-generic/errno.h

kernel/selinux/rules.c

@@ -0,0 +1,463 @@
+#include <linux/uaccess.h>
+#include <linux/types.h>
+#include <linux/version.h>
+
+#include "../klog.h" // IWYU pragma: keep
+#include "selinux.h"
+#include "sepolicy.h"
+#include "ss/services.h"
+#include "linux/lsm_audit.h"
+#include "xfrm.h"
+
+#define SELINUX_POLICY_INSTEAD_SELINUX_SS
+
+#define KERNEL_SU_DOMAIN "su"
+#define KERNEL_SU_FILE "ksu_file"
+#define KERNEL_EXEC_TYPE "ksu_exec"
+#define ALL NULL
+
+static struct policydb *get_policydb(void)
+{
+	struct policydb *db;
+	struct selinux_policy *policy = rcu_dereference(selinux_state.policy);
+	db = &policy->policydb;
+	return db;
+}
+
+void apply_kernelsu_rules()
+{
+	if (!getenforce()) {
+		pr_info("SELinux permissive or disabled, apply rules!\n");
+	}
+
+	rcu_read_lock();
+	struct policydb *db = get_policydb();
+
+	ksu_permissive(db, KERNEL_SU_DOMAIN);
+	ksu_typeattribute(db, KERNEL_SU_DOMAIN, "mlstrustedsubject");
+	ksu_typeattribute(db, KERNEL_SU_DOMAIN, "netdomain");
+	ksu_typeattribute(db, KERNEL_SU_DOMAIN, "bluetoothdomain");
+
+	// Create unconstrained file type
+	ksu_type(db, KERNEL_SU_FILE, "file_type");
+	ksu_typeattribute(db, KERNEL_SU_FILE, "mlstrustedobject");
+	ksu_allow(db, ALL, KERNEL_SU_FILE, ALL, ALL);
+
+	// allow all!
+	ksu_allow(db, KERNEL_SU_DOMAIN, ALL, ALL, ALL);
+
+	// allow us do any ioctl
+	if (db->policyvers >= POLICYDB_VERSION_XPERMS_IOCTL) {
+		ksu_allowxperm(db, KERNEL_SU_DOMAIN, ALL, "blk_file", ALL);
+		ksu_allowxperm(db, KERNEL_SU_DOMAIN, ALL, "fifo_file", ALL);
+		ksu_allowxperm(db, KERNEL_SU_DOMAIN, ALL, "chr_file", ALL);
+		ksu_allowxperm(db, KERNEL_SU_DOMAIN, ALL, "file", ALL);
+	}
+
+	// we need to save allowlist in /data/adb/ksu
+	ksu_allow(db, "kernel", "adb_data_file", "dir", ALL);
+	ksu_allow(db, "kernel", "adb_data_file", "file", ALL);
+	// we need to search /data/app
+	ksu_allow(db, "kernel", "apk_data_file", "file", "open");
+	ksu_allow(db, "kernel", "apk_data_file", "dir", "open");
+	ksu_allow(db, "kernel", "apk_data_file", "dir", "read");
+	ksu_allow(db, "kernel", "apk_data_file", "dir", "search");
+	// we may need to do mount on shell
+	ksu_allow(db, "kernel", "shell_data_file", "file", ALL);
+	// we need to read /data/system/packages.list
+	ksu_allow(db, "kernel", "kernel", "capability", "dac_override");
+	// Android 10+:
+	// http://aospxref.com/android-12.0.0_r3/xref/system/sepolicy/private/file_contexts#512
+	ksu_allow(db, "kernel", "packages_list_file", "file", ALL);
+	// Kernel 4.4
+	ksu_allow(db, "kernel", "packages_list_file", "dir", ALL);
+	// Android 9-:
+	// http://aospxref.com/android-9.0.0_r61/xref/system/sepolicy/private/file_contexts#360
+	ksu_allow(db, "kernel", "system_data_file", "file", ALL);
+	ksu_allow(db, "kernel", "system_data_file", "dir", ALL);
+	// our ksud triggered by init
+	ksu_allow(db, "init", "adb_data_file", "file", ALL);
+	ksu_allow(db, "init", "adb_data_file", "dir", ALL); // #1289
+	ksu_allow(db, "init", KERNEL_SU_DOMAIN, ALL, ALL);
+	// we need to umount modules in zygote
+	ksu_allow(db, "zygote", "adb_data_file", "dir", "search");
+
+	// copied from Magisk rules
+	// suRights
+	ksu_allow(db, "servicemanager", KERNEL_SU_DOMAIN, "dir", "search");
+	ksu_allow(db, "servicemanager", KERNEL_SU_DOMAIN, "dir", "read");
+	ksu_allow(db, "servicemanager", KERNEL_SU_DOMAIN, "file", "open");
+	ksu_allow(db, "servicemanager", KERNEL_SU_DOMAIN, "file", "read");
+	ksu_allow(db, "servicemanager", KERNEL_SU_DOMAIN, "process", "getattr");
+	ksu_allow(db, ALL, KERNEL_SU_DOMAIN, "process", "sigchld");
+
+	// allowLog
+	ksu_allow(db, "logd", KERNEL_SU_DOMAIN, "dir", "search");
+	ksu_allow(db, "logd", KERNEL_SU_DOMAIN, "file", "read");
+	ksu_allow(db, "logd", KERNEL_SU_DOMAIN, "file", "open");
+	ksu_allow(db, "logd", KERNEL_SU_DOMAIN, "file", "getattr");
+
+	// dumpsys
+	ksu_allow(db, ALL, KERNEL_SU_DOMAIN, "fd", "use");
+	ksu_allow(db, ALL, KERNEL_SU_DOMAIN, "fifo_file", "write");
+	ksu_allow(db, ALL, KERNEL_SU_DOMAIN, "fifo_file", "read");
+	ksu_allow(db, ALL, KERNEL_SU_DOMAIN, "fifo_file", "open");
+	ksu_allow(db, ALL, KERNEL_SU_DOMAIN, "fifo_file", "getattr");
+
+	// bootctl
+	ksu_allow(db, "hwservicemanager", KERNEL_SU_DOMAIN, "dir", "search");
+	ksu_allow(db, "hwservicemanager", KERNEL_SU_DOMAIN, "file", "read");
+	ksu_allow(db, "hwservicemanager", KERNEL_SU_DOMAIN, "file", "open");
+	ksu_allow(db, "hwservicemanager", KERNEL_SU_DOMAIN, "process",
+		  "getattr");
+
+	// For mounting loop devices, mirrors, tmpfs
+	ksu_allow(db, "kernel", ALL, "file", "read");
+	ksu_allow(db, "kernel", ALL, "file", "write");
+
+	// Allow all binder transactions
+	ksu_allow(db, ALL, KERNEL_SU_DOMAIN, "binder", ALL);
+
+    // Allow system server kill su process
+    ksu_allow(db, "system_server", KERNEL_SU_DOMAIN, "process", "getpgid");
+    ksu_allow(db, "system_server", KERNEL_SU_DOMAIN, "process", "sigkill");
+
+	rcu_read_unlock();
+}
+
+#define MAX_SEPOL_LEN 128
+
+#define CMD_NORMAL_PERM 1
+#define CMD_XPERM 2
+#define CMD_TYPE_STATE 3
+#define CMD_TYPE 4
+#define CMD_TYPE_ATTR 5
+#define CMD_ATTR 6
+#define CMD_TYPE_TRANSITION 7
+#define CMD_TYPE_CHANGE 8
+#define CMD_GENFSCON 9
+
+struct sepol_data {
+	u32 cmd;
+	u32 subcmd;
+	char __user *sepol1;
+	char __user *sepol2;
+	char __user *sepol3;
+	char __user *sepol4;
+	char __user *sepol5;
+	char __user *sepol6;
+	char __user *sepol7;
+};
+
+static int get_object(char *buf, char __user *user_object, size_t buf_sz,
+		      char **object)
+{
+	if (!user_object) {
+		*object = ALL;
+		return 0;
+	}
+
+	if (strncpy_from_user(buf, user_object, buf_sz) < 0) {
+		return -1;
+	}
+
+	*object = buf;
+
+	return 0;
+}
+
+// reset avc cache table, otherwise the new rules will not take effect if already denied
+static void reset_avc_cache()
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 4, 0))
+	avc_ss_reset(0);
+	selnl_notify_policyload(0);
+	selinux_status_update_policyload(0);
+#else
+	struct selinux_avc *avc = selinux_state.avc;
+	avc_ss_reset(avc, 0);
+	selnl_notify_policyload(0);
+	selinux_status_update_policyload(&selinux_state, 0);
+#endif
+	selinux_xfrm_notify_policyload();
+}
+
+int handle_sepolicy(unsigned long arg3, void __user *arg4)
+{
+	if (!arg4) {
+		return -1;
+	}
+
+	if (!getenforce()) {
+		pr_info("SELinux permissive or disabled when handle policy!\n");
+	}
+
+	struct sepol_data data;
+	if (copy_from_user(&data, arg4, sizeof(struct sepol_data))) {
+		pr_err("sepol: copy sepol_data failed.\n");
+		return -1;
+	}
+
+	u32 cmd = data.cmd;
+	u32 subcmd = data.subcmd;
+
+	rcu_read_lock();
+
+	struct policydb *db = get_policydb();
+
+	int ret = -1;
+	if (cmd == CMD_NORMAL_PERM) {
+		char src_buf[MAX_SEPOL_LEN];
+		char tgt_buf[MAX_SEPOL_LEN];
+		char cls_buf[MAX_SEPOL_LEN];
+		char perm_buf[MAX_SEPOL_LEN];
+
+		char *s, *t, *c, *p;
+		if (get_object(src_buf, data.sepol1, sizeof(src_buf), &s) < 0) {
+			pr_err("sepol: copy src failed.\n");
+			goto exit;
+		}
+
+		if (get_object(tgt_buf, data.sepol2, sizeof(tgt_buf), &t) < 0) {
+			pr_err("sepol: copy tgt failed.\n");
+			goto exit;
+		}
+
+		if (get_object(cls_buf, data.sepol3, sizeof(cls_buf), &c) < 0) {
+			pr_err("sepol: copy cls failed.\n");
+			goto exit;
+		}
+
+		if (get_object(perm_buf, data.sepol4, sizeof(perm_buf), &p) <
+		    0) {
+			pr_err("sepol: copy perm failed.\n");
+			goto exit;
+		}
+
+		bool success = false;
+		if (subcmd == 1) {
+			success = ksu_allow(db, s, t, c, p);
+		} else if (subcmd == 2) {
+			success = ksu_deny(db, s, t, c, p);
+		} else if (subcmd == 3) {
+			success = ksu_auditallow(db, s, t, c, p);
+		} else if (subcmd == 4) {
+			success = ksu_dontaudit(db, s, t, c, p);
+		} else {
+			pr_err("sepol: unknown subcmd: %d\n", subcmd);
+		}
+		ret = success ? 0 : -1;
+
+	} else if (cmd == CMD_XPERM) {
+		char src_buf[MAX_SEPOL_LEN];
+		char tgt_buf[MAX_SEPOL_LEN];
+		char cls_buf[MAX_SEPOL_LEN];
+
+		char __maybe_unused
+			operation[MAX_SEPOL_LEN]; // it is always ioctl now!
+		char perm_set[MAX_SEPOL_LEN];
+
+		char *s, *t, *c;
+		if (get_object(src_buf, data.sepol1, sizeof(src_buf), &s) < 0) {
+			pr_err("sepol: copy src failed.\n");
+			goto exit;
+		}
+		if (get_object(tgt_buf, data.sepol2, sizeof(tgt_buf), &t) < 0) {
+			pr_err("sepol: copy tgt failed.\n");
+			goto exit;
+		}
+		if (get_object(cls_buf, data.sepol3, sizeof(cls_buf), &c) < 0) {
+			pr_err("sepol: copy cls failed.\n");
+			goto exit;
+		}
+		if (strncpy_from_user(operation, data.sepol4,
+				      sizeof(operation)) < 0) {
+			pr_err("sepol: copy operation failed.\n");
+			goto exit;
+		}
+		if (strncpy_from_user(perm_set, data.sepol5, sizeof(perm_set)) <
+		    0) {
+			pr_err("sepol: copy perm_set failed.\n");
+			goto exit;
+		}
+
+		bool success = false;
+		if (subcmd == 1) {
+			success = ksu_allowxperm(db, s, t, c, perm_set);
+		} else if (subcmd == 2) {
+			success = ksu_auditallowxperm(db, s, t, c, perm_set);
+		} else if (subcmd == 3) {
+			success = ksu_dontauditxperm(db, s, t, c, perm_set);
+		} else {
+			pr_err("sepol: unknown subcmd: %d\n", subcmd);
+		}
+		ret = success ? 0 : -1;
+	} else if (cmd == CMD_TYPE_STATE) {
+		char src[MAX_SEPOL_LEN];
+
+		if (strncpy_from_user(src, data.sepol1, sizeof(src)) < 0) {
+			pr_err("sepol: copy src failed.\n");
+			goto exit;
+		}
+
+		bool success = false;
+		if (subcmd == 1) {
+			success = ksu_permissive(db, src);
+		} else if (subcmd == 2) {
+			success = ksu_enforce(db, src);
+		} else {
+			pr_err("sepol: unknown subcmd: %d\n", subcmd);
+		}
+		if (success)
+			ret = 0;
+
+	} else if (cmd == CMD_TYPE || cmd == CMD_TYPE_ATTR) {
+		char type[MAX_SEPOL_LEN];
+		char attr[MAX_SEPOL_LEN];
+
+		if (strncpy_from_user(type, data.sepol1, sizeof(type)) < 0) {
+			pr_err("sepol: copy type failed.\n");
+			goto exit;
+		}
+		if (strncpy_from_user(attr, data.sepol2, sizeof(attr)) < 0) {
+			pr_err("sepol: copy attr failed.\n");
+			goto exit;
+		}
+
+		bool success = false;
+		if (cmd == CMD_TYPE) {
+			success = ksu_type(db, type, attr);
+		} else {
+			success = ksu_typeattribute(db, type, attr);
+		}
+		if (!success) {
+			pr_err("sepol: %d failed.\n", cmd);
+			goto exit;
+		}
+		ret = 0;
+
+	} else if (cmd == CMD_ATTR) {
+		char attr[MAX_SEPOL_LEN];
+
+		if (strncpy_from_user(attr, data.sepol1, sizeof(attr)) < 0) {
+			pr_err("sepol: copy attr failed.\n");
+			goto exit;
+		}
+		if (!ksu_attribute(db, attr)) {
+			pr_err("sepol: %d failed.\n", cmd);
+			goto exit;
+		}
+		ret = 0;
+
+	} else if (cmd == CMD_TYPE_TRANSITION) {
+		char src[MAX_SEPOL_LEN];
+		char tgt[MAX_SEPOL_LEN];
+		char cls[MAX_SEPOL_LEN];
+		char default_type[MAX_SEPOL_LEN];
+		char object[MAX_SEPOL_LEN];
+
+		if (strncpy_from_user(src, data.sepol1, sizeof(src)) < 0) {
+			pr_err("sepol: copy src failed.\n");
+			goto exit;
+		}
+		if (strncpy_from_user(tgt, data.sepol2, sizeof(tgt)) < 0) {
+			pr_err("sepol: copy tgt failed.\n");
+			goto exit;
+		}
+		if (strncpy_from_user(cls, data.sepol3, sizeof(cls)) < 0) {
+			pr_err("sepol: copy cls failed.\n");
+			goto exit;
+		}
+		if (strncpy_from_user(default_type, data.sepol4,
+				      sizeof(default_type)) < 0) {
+			pr_err("sepol: copy default_type failed.\n");
+			goto exit;
+		}
+		char *real_object;
+		if (data.sepol5 == NULL) {
+			real_object = NULL;
+		} else {
+			if (strncpy_from_user(object, data.sepol5,
+					      sizeof(object)) < 0) {
+				pr_err("sepol: copy object failed.\n");
+				goto exit;
+			}
+			real_object = object;
+		}
+
+		bool success = ksu_type_transition(db, src, tgt, cls,
+						   default_type, real_object);
+		if (success)
+			ret = 0;
+
+	} else if (cmd == CMD_TYPE_CHANGE) {
+		char src[MAX_SEPOL_LEN];
+		char tgt[MAX_SEPOL_LEN];
+		char cls[MAX_SEPOL_LEN];
+		char default_type[MAX_SEPOL_LEN];
+
+		if (strncpy_from_user(src, data.sepol1, sizeof(src)) < 0) {
+			pr_err("sepol: copy src failed.\n");
+			goto exit;
+		}
+		if (strncpy_from_user(tgt, data.sepol2, sizeof(tgt)) < 0) {
+			pr_err("sepol: copy tgt failed.\n");
+			goto exit;
+		}
+		if (strncpy_from_user(cls, data.sepol3, sizeof(cls)) < 0) {
+			pr_err("sepol: copy cls failed.\n");
+			goto exit;
+		}
+		if (strncpy_from_user(default_type, data.sepol4,
+				      sizeof(default_type)) < 0) {
+			pr_err("sepol: copy default_type failed.\n");
+			goto exit;
+		}
+		bool success = false;
+		if (subcmd == 1) {
+			success = ksu_type_change(db, src, tgt, cls,
+						  default_type);
+		} else if (subcmd == 2) {
+			success = ksu_type_member(db, src, tgt, cls,
+						  default_type);
+		} else {
+			pr_err("sepol: unknown subcmd: %d\n", subcmd);
+		}
+		if (success)
+			ret = 0;
+	} else if (cmd == CMD_GENFSCON) {
+		char name[MAX_SEPOL_LEN];
+		char path[MAX_SEPOL_LEN];
+		char context[MAX_SEPOL_LEN];
+		if (strncpy_from_user(name, data.sepol1, sizeof(name)) < 0) {
+			pr_err("sepol: copy name failed.\n");
+			goto exit;
+		}
+		if (strncpy_from_user(path, data.sepol2, sizeof(path)) < 0) {
+			pr_err("sepol: copy path failed.\n");
+			goto exit;
+		}
+		if (strncpy_from_user(context, data.sepol3, sizeof(context)) <
+		    0) {
+			pr_err("sepol: copy context failed.\n");
+			goto exit;
+		}
+
+		if (!ksu_genfscon(db, name, path, context)) {
+			pr_err("sepol: %d failed.\n", cmd);
+			goto exit;
+		}
+		ret = 0;
+	} else {
+		pr_err("sepol: unknown cmd: %d\n", cmd);
+	}
+
+exit:
+	rcu_read_unlock();
+
+	// only allow and xallow needs to reset avc cache, but we cannot do that because
+	// we are in atomic context. so we just reset it every time.
+	reset_avc_cache();
+
+	return ret;
+}

kernel/selinux/selinux.c

@@ -0,0 +1,130 @@
+#include "selinux.h"
+#include "objsec.h"
+#include "linux/version.h"
+#include "../klog.h" // IWYU pragma: keep
+
+#define KERNEL_SU_DOMAIN "u:r:su:s0"
+
+static int transive_to_domain(const char *domain)
+{
+	struct cred *cred;
+	struct task_security_struct *tsec;
+	u32 sid;
+	int error;
+
+	cred = (struct cred *)__task_cred(current);
+
+	tsec = cred->security;
+	if (!tsec) {
+		pr_err("tsec == NULL!\n");
+		return -1;
+	}
+
+	error = security_secctx_to_secid(domain, strlen(domain), &sid);
+	if (error) {
+		pr_info("security_secctx_to_secid %s -> sid: %d, error: %d\n",
+			domain, sid, error);
+	}
+	if (!error) {
+		tsec->sid = sid;
+		tsec->create_sid = 0;
+		tsec->keycreate_sid = 0;
+		tsec->sockcreate_sid = 0;
+	}
+	return error;
+}
+
+void setup_selinux(const char *domain)
+{
+	if (transive_to_domain(domain)) {
+		pr_err("transive domain failed.\n");
+		return;
+	}
+
+	/* we didn't need this now, we have change selinux rules when boot!
+if (!is_domain_permissive) {
+  if (set_domain_permissive() == 0) {
+      is_domain_permissive = true;
+  }
+}*/
+}
+
+void setenforce(bool enforce)
+{
+#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
+	selinux_state.enforcing = enforce;
+#endif
+}
+
+bool getenforce()
+{
+#ifdef CONFIG_SECURITY_SELINUX_DISABLE
+	if (selinux_state.disabled) {
+		return false;
+	}
+#endif
+
+#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
+	return selinux_state.enforcing;
+#else
+	return true;
+#endif
+}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 10, 0)) &&                         \
+	!defined(KSU_COMPAT_HAS_CURRENT_SID)
+/*
+ * get the subjective security ID of the current task
+ */
+static inline u32 current_sid(void)
+{
+	const struct task_security_struct *tsec = current_security();
+
+	return tsec->sid;
+}
+#endif
+
+bool is_ksu_domain()
+{
+	char *domain;
+	u32 seclen;
+	bool result;
+	int err = security_secid_to_secctx(current_sid(), &domain, &seclen);
+	if (err) {
+		return false;
+	}
+	result = strncmp(KERNEL_SU_DOMAIN, domain, seclen) == 0;
+	security_release_secctx(domain, seclen);
+	return result;
+}
+
+bool is_zygote(void *sec)
+{
+	struct task_security_struct *tsec = (struct task_security_struct *)sec;
+	if (!tsec) {
+		return false;
+	}
+	char *domain;
+	u32 seclen;
+	bool result;
+	int err = security_secid_to_secctx(tsec->sid, &domain, &seclen);
+	if (err) {
+		return false;
+	}
+	result = strncmp("u:r:zygote:s0", domain, seclen) == 0;
+	security_release_secctx(domain, seclen);
+	return result;
+}
+
+#define DEVPTS_DOMAIN "u:object_r:ksu_file:s0"
+
+u32 ksu_get_devpts_sid()
+{
+	u32 devpts_sid = 0;
+	int err = security_secctx_to_secid(DEVPTS_DOMAIN, strlen(DEVPTS_DOMAIN),
+					   &devpts_sid);
+	if (err) {
+		pr_info("get devpts sid err %d\n", err);
+	}
+	return devpts_sid;
+}

kernel/selinux/selinux.h

@@ -0,0 +1,21 @@
+#ifndef __KSU_H_SELINUX
+#define __KSU_H_SELINUX
+
+#include "linux/types.h"
+#include "linux/version.h"
+
+void setup_selinux(const char *);
+
+void setenforce(bool);
+
+bool getenforce();
+
+bool is_ksu_domain();
+
+bool is_zygote(void *cred);
+
+void apply_kernelsu_rules();
+
+u32 ksu_get_devpts_sid();
+
+#endif

kernel/selinux/sepolicy.c

@@ -0,0 +1,853 @@
+#include <linux/gfp.h>
+#include <linux/printk.h>
+#include <linux/slab.h>
+#include <linux/version.h>
+
+#include "sepolicy.h"
+#include "../klog.h" // IWYU pragma: keep
+#include "ss/symtab.h"
+#include "../kernel_compat.h" // Add check Huawei Device
+
+#define KSU_SUPPORT_ADD_TYPE
+
+//////////////////////////////////////////////////////
+// Declaration
+//////////////////////////////////////////////////////
+
+static struct avtab_node *get_avtab_node(struct policydb *db,
+					 struct avtab_key *key,
+					 struct avtab_extended_perms *xperms);
+
+static bool add_rule(struct policydb *db, const char *s, const char *t,
+		     const char *c, const char *p, int effect, bool invert);
+
+static void add_rule_raw(struct policydb *db, struct type_datum *src,
+			 struct type_datum *tgt, struct class_datum *cls,
+			 struct perm_datum *perm, int effect, bool invert);
+
+static void add_xperm_rule_raw(struct policydb *db, struct type_datum *src,
+			       struct type_datum *tgt, struct class_datum *cls,
+			       uint16_t low, uint16_t high, int effect,
+			       bool invert);
+static bool add_xperm_rule(struct policydb *db, const char *s, const char *t,
+			   const char *c, const char *range, int effect,
+			   bool invert);
+
+static bool add_type_rule(struct policydb *db, const char *s, const char *t,
+			  const char *c, const char *d, int effect);
+
+static bool add_filename_trans(struct policydb *db, const char *s,
+			       const char *t, const char *c, const char *d,
+			       const char *o);
+
+static bool add_genfscon(struct policydb *db, const char *fs_name,
+			 const char *path, const char *context);
+
+static bool add_type(struct policydb *db, const char *type_name, bool attr);
+
+static bool set_type_state(struct policydb *db, const char *type_name,
+			   bool permissive);
+
+static void add_typeattribute_raw(struct policydb *db, struct type_datum *type,
+				  struct type_datum *attr);
+
+static bool add_typeattribute(struct policydb *db, const char *type,
+			      const char *attr);
+
+//////////////////////////////////////////////////////
+// Implementation
+//////////////////////////////////////////////////////
+
+// Invert is adding rules for auditdeny; in other cases, invert is removing
+// rules
+#define strip_av(effect, invert) ((effect == AVTAB_AUDITDENY) == !invert)
+
+#define ksu_hash_for_each(node_ptr, n_slot, cur)                               \
+	int i;                                                                 \
+	for (i = 0; i < n_slot; ++i)                                           \
+		for (cur = node_ptr[i]; cur; cur = cur->next)
+
+// htable is a struct instead of pointer above 5.8.0:
+// https://elixir.bootlin.com/linux/v5.8-rc1/source/security/selinux/ss/symtab.h
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)
+#define ksu_hashtab_for_each(htab, cur)                                        \
+	ksu_hash_for_each(htab.htable, htab.size, cur)
+#else
+#define ksu_hashtab_for_each(htab, cur)                                        \
+	ksu_hash_for_each(htab->htable, htab->size, cur)
+#endif
+
+// symtab_search is introduced on 5.9.0:
+// https://elixir.bootlin.com/linux/v5.9-rc1/source/security/selinux/ss/symtab.h
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 9, 0)
+#define symtab_search(s, name) hashtab_search((s)->table, name)
+#define symtab_insert(s, name, datum) hashtab_insert((s)->table, name, datum)
+#endif
+
+#define avtab_for_each(avtab, cur)                                             \
+	ksu_hash_for_each(avtab.htable, avtab.nslot, cur);
+
+static struct avtab_node *get_avtab_node(struct policydb *db,
+					 struct avtab_key *key,
+					 struct avtab_extended_perms *xperms)
+{
+	struct avtab_node *node;
+
+	/* AVTAB_XPERMS entries are not necessarily unique */
+	if (key->specified & AVTAB_XPERMS) {
+		bool match = false;
+		node = avtab_search_node(&db->te_avtab, key);
+		while (node) {
+			if ((node->datum.u.xperms->specified ==
+			     xperms->specified) &&
+			    (node->datum.u.xperms->driver == xperms->driver)) {
+				match = true;
+				break;
+			}
+			node = avtab_search_node_next(node, key->specified);
+		}
+		if (!match)
+			node = NULL;
+	} else {
+		node = avtab_search_node(&db->te_avtab, key);
+	}
+
+	if (!node) {
+		struct avtab_datum avdatum = {};
+		/*
+     * AUDITDENY, aka DONTAUDIT, are &= assigned, versus |= for
+     * others. Initialize the data accordingly.
+     */
+		if (key->specified & AVTAB_XPERMS) {
+			avdatum.u.xperms = xperms;
+		} else {
+			avdatum.u.data =
+				key->specified == AVTAB_AUDITDENY ? ~0U : 0U;
+		}
+		/* this is used to get the node - insertion is actually unique */
+		node = avtab_insert_nonunique(&db->te_avtab, key, &avdatum);
+
+		int grow_size = sizeof(struct avtab_key);
+		grow_size += sizeof(struct avtab_datum);
+		if (key->specified & AVTAB_XPERMS) {
+			grow_size += sizeof(u8);
+			grow_size += sizeof(u8);
+			grow_size += sizeof(u32) *
+				     ARRAY_SIZE(avdatum.u.xperms->perms.p);
+		}
+		db->len += grow_size;
+	}
+
+	return node;
+}
+
+static bool add_rule(struct policydb *db, const char *s, const char *t,
+		     const char *c, const char *p, int effect, bool invert)
+{
+	struct type_datum *src = NULL, *tgt = NULL;
+	struct class_datum *cls = NULL;
+	struct perm_datum *perm = NULL;
+
+	if (s) {
+		src = symtab_search(&db->p_types, s);
+		if (src == NULL) {
+			pr_info("source type %s does not exist\n", s);
+			return false;
+		}
+	}
+
+	if (t) {
+		tgt = symtab_search(&db->p_types, t);
+		if (tgt == NULL) {
+			pr_info("target type %s does not exist\n", t);
+			return false;
+		}
+	}
+
+	if (c) {
+		cls = symtab_search(&db->p_classes, c);
+		if (cls == NULL) {
+			pr_info("class %s does not exist\n", c);
+			return false;
+		}
+	}
+
+	if (p) {
+		if (c == NULL) {
+			pr_info("No class is specified, cannot add perm [%s] \n",
+				p);
+			return false;
+		}
+
+		perm = symtab_search(&cls->permissions, p);
+		if (perm == NULL && cls->comdatum != NULL) {
+			perm = symtab_search(&cls->comdatum->permissions, p);
+		}
+		if (perm == NULL) {
+			pr_info("perm %s does not exist in class %s\n", p, c);
+			return false;
+		}
+	}
+	add_rule_raw(db, src, tgt, cls, perm, effect, invert);
+	return true;
+}
+
+static void add_rule_raw(struct policydb *db, struct type_datum *src,
+			 struct type_datum *tgt, struct class_datum *cls,
+			 struct perm_datum *perm, int effect, bool invert)
+{
+	if (src == NULL) {
+		struct hashtab_node *node;
+		if (strip_av(effect, invert)) {
+			ksu_hashtab_for_each(db->p_types.table, node)
+			{
+				add_rule_raw(db,
+					     (struct type_datum *)node->datum,
+					     tgt, cls, perm, effect, invert);
+			};
+		} else {
+			ksu_hashtab_for_each(db->p_types.table, node)
+			{
+				struct type_datum *type =
+					(struct type_datum *)(node->datum);
+				if (type->attribute) {
+					add_rule_raw(db, type, tgt, cls, perm,
+						     effect, invert);
+				}
+			};
+		}
+	} else if (tgt == NULL) {
+		struct hashtab_node *node;
+		if (strip_av(effect, invert)) {
+			ksu_hashtab_for_each(db->p_types.table, node)
+			{
+				add_rule_raw(db, src,
+					     (struct type_datum *)node->datum,
+					     cls, perm, effect, invert);
+			};
+		} else {
+			ksu_hashtab_for_each(db->p_types.table, node)
+			{
+				struct type_datum *type =
+					(struct type_datum *)(node->datum);
+				if (type->attribute) {
+					add_rule_raw(db, src, type, cls, perm,
+						     effect, invert);
+				}
+			};
+		}
+	} else if (cls == NULL) {
+		struct hashtab_node *node;
+		ksu_hashtab_for_each(db->p_classes.table, node)
+		{
+			add_rule_raw(db, src, tgt,
+				     (struct class_datum *)node->datum, perm,
+				     effect, invert);
+		}
+	} else {
+		struct avtab_key key;
+		key.source_type = src->value;
+		key.target_type = tgt->value;
+		key.target_class = cls->value;
+		key.specified = effect;
+
+		struct avtab_node *node = get_avtab_node(db, &key, NULL);
+		if (invert) {
+			if (perm)
+				node->datum.u.data &=
+					~(1U << (perm->value - 1));
+			else
+				node->datum.u.data = 0U;
+		} else {
+			if (perm)
+				node->datum.u.data |= 1U << (perm->value - 1);
+			else
+				node->datum.u.data = ~0U;
+		}
+	}
+}
+
+#define ioctl_driver(x) (x >> 8 & 0xFF)
+#define ioctl_func(x) (x & 0xFF)
+
+#define xperm_test(x, p) (1 & (p[x >> 5] >> (x & 0x1f)))
+#define xperm_set(x, p) (p[x >> 5] |= (1 << (x & 0x1f)))
+#define xperm_clear(x, p) (p[x >> 5] &= ~(1 << (x & 0x1f)))
+
+static void add_xperm_rule_raw(struct policydb *db, struct type_datum *src,
+			       struct type_datum *tgt, struct class_datum *cls,
+			       uint16_t low, uint16_t high, int effect,
+			       bool invert)
+{
+	if (src == NULL) {
+		struct hashtab_node *node;
+		ksu_hashtab_for_each(db->p_types.table, node)
+		{
+			struct type_datum *type =
+				(struct type_datum *)(node->datum);
+			if (type->attribute) {
+				add_xperm_rule_raw(db, type, tgt, cls, low,
+						   high, effect, invert);
+			}
+		};
+	} else if (tgt == NULL) {
+		struct hashtab_node *node;
+		ksu_hashtab_for_each(db->p_types.table, node)
+		{
+			struct type_datum *type =
+				(struct type_datum *)(node->datum);
+			if (type->attribute) {
+				add_xperm_rule_raw(db, src, type, cls, low,
+						   high, effect, invert);
+			}
+		};
+	} else if (cls == NULL) {
+		struct hashtab_node *node;
+		ksu_hashtab_for_each(db->p_classes.table, node)
+		{
+			add_xperm_rule_raw(db, src, tgt,
+					   (struct class_datum *)(node->datum),
+					   low, high, effect, invert);
+		};
+	} else {
+		struct avtab_key key;
+		key.source_type = src->value;
+		key.target_type = tgt->value;
+		key.target_class = cls->value;
+		key.specified = effect;
+
+		struct avtab_datum *datum;
+		struct avtab_node *node;
+		struct avtab_extended_perms xperms;
+
+		memset(&xperms, 0, sizeof(xperms));
+		if (ioctl_driver(low) != ioctl_driver(high)) {
+			xperms.specified = AVTAB_XPERMS_IOCTLDRIVER;
+			xperms.driver = 0;
+		} else {
+			xperms.specified = AVTAB_XPERMS_IOCTLFUNCTION;
+			xperms.driver = ioctl_driver(low);
+		}
+		int i;
+		if (xperms.specified == AVTAB_XPERMS_IOCTLDRIVER) {
+			for (i = ioctl_driver(low); i <= ioctl_driver(high);
+			     ++i) {
+				if (invert)
+					xperm_clear(i, xperms.perms.p);
+				else
+					xperm_set(i, xperms.perms.p);
+			}
+		} else {
+			for (i = ioctl_func(low); i <= ioctl_func(high); ++i) {
+				if (invert)
+					xperm_clear(i, xperms.perms.p);
+				else
+					xperm_set(i, xperms.perms.p);
+			}
+		}
+
+		node = get_avtab_node(db, &key, &xperms);
+		if (!node) {
+			pr_warn("add_xperm_rule_raw cannot found node!\n");
+			return;
+		}
+		datum = &node->datum;
+
+		if (datum->u.xperms == NULL) {
+			datum->u.xperms =
+				(struct avtab_extended_perms *)(kmalloc(
+					sizeof(xperms), GFP_KERNEL));
+			if (!datum->u.xperms) {
+				pr_err("alloc xperms failed\n");
+				return;
+			}
+			memcpy(datum->u.xperms, &xperms, sizeof(xperms));
+		}
+	}
+}
+
+static bool add_xperm_rule(struct policydb *db, const char *s, const char *t,
+			   const char *c, const char *range, int effect,
+			   bool invert)
+{
+	struct type_datum *src = NULL, *tgt = NULL;
+	struct class_datum *cls = NULL;
+
+	if (s) {
+		src = symtab_search(&db->p_types, s);
+		if (src == NULL) {
+			pr_info("source type %s does not exist\n", s);
+			return false;
+		}
+	}
+
+	if (t) {
+		tgt = symtab_search(&db->p_types, t);
+		if (tgt == NULL) {
+			pr_info("target type %s does not exist\n", t);
+			return false;
+		}
+	}
+
+	if (c) {
+		cls = symtab_search(&db->p_classes, c);
+		if (cls == NULL) {
+			pr_info("class %s does not exist\n", c);
+			return false;
+		}
+	}
+
+	u16 low, high;
+
+	if (range) {
+		if (strchr(range, '-')) {
+			sscanf(range, "%hx-%hx", &low, &high);
+		} else {
+			sscanf(range, "%hx", &low);
+			high = low;
+		}
+	} else {
+		low = 0;
+		high = 0xFFFF;
+	}
+
+	add_xperm_rule_raw(db, src, tgt, cls, low, high, effect, invert);
+	return true;
+}
+
+static bool add_type_rule(struct policydb *db, const char *s, const char *t,
+			  const char *c, const char *d, int effect)
+{
+	struct type_datum *src, *tgt, *def;
+	struct class_datum *cls;
+
+	src = symtab_search(&db->p_types, s);
+	if (src == NULL) {
+		pr_info("source type %s does not exist\n", s);
+		return false;
+	}
+	tgt = symtab_search(&db->p_types, t);
+	if (tgt == NULL) {
+		pr_info("target type %s does not exist\n", t);
+		return false;
+	}
+	cls = symtab_search(&db->p_classes, c);
+	if (cls == NULL) {
+		pr_info("class %s does not exist\n", c);
+		return false;
+	}
+	def = symtab_search(&db->p_types, d);
+	if (def == NULL) {
+		pr_info("default type %s does not exist\n", d);
+		return false;
+	}
+
+	struct avtab_key key;
+	key.source_type = src->value;
+	key.target_type = tgt->value;
+	key.target_class = cls->value;
+	key.specified = effect;
+
+	struct avtab_node *node = get_avtab_node(db, &key, NULL);
+	node->datum.u.data = def->value;
+
+	return true;
+}
+
+// 5.9.0 : static inline int hashtab_insert(struct hashtab *h, void *key, void
+// *datum, struct hashtab_key_params key_params) 5.8.0: int
+// hashtab_insert(struct hashtab *h, void *k, void *d);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 9, 0)
+static u32 filenametr_hash(const void *k)
+{
+	const struct filename_trans_key *ft = k;
+	unsigned long hash;
+	unsigned int byte_num;
+	unsigned char focus;
+
+	hash = ft->ttype ^ ft->tclass;
+
+	byte_num = 0;
+	while ((focus = ft->name[byte_num++]))
+		hash = partial_name_hash(focus, hash);
+	return hash;
+}
+
+static int filenametr_cmp(const void *k1, const void *k2)
+{
+	const struct filename_trans_key *ft1 = k1;
+	const struct filename_trans_key *ft2 = k2;
+	int v;
+
+	v = ft1->ttype - ft2->ttype;
+	if (v)
+		return v;
+
+	v = ft1->tclass - ft2->tclass;
+	if (v)
+		return v;
+
+	return strcmp(ft1->name, ft2->name);
+}
+
+static const struct hashtab_key_params filenametr_key_params = {
+	.hash = filenametr_hash,
+	.cmp = filenametr_cmp,
+};
+#endif
+
+static bool add_filename_trans(struct policydb *db, const char *s,
+			       const char *t, const char *c, const char *d,
+			       const char *o)
+{
+	struct type_datum *src, *tgt, *def;
+	struct class_datum *cls;
+
+	src = symtab_search(&db->p_types, s);
+	if (src == NULL) {
+		pr_warn("source type %s does not exist\n", s);
+		return false;
+	}
+	tgt = symtab_search(&db->p_types, t);
+	if (tgt == NULL) {
+		pr_warn("target type %s does not exist\n", t);
+		return false;
+	}
+	cls = symtab_search(&db->p_classes, c);
+	if (cls == NULL) {
+		pr_warn("class %s does not exist\n", c);
+		return false;
+	}
+	def = symtab_search(&db->p_types, d);
+	if (def == NULL) {
+		pr_warn("default type %s does not exist\n", d);
+		return false;
+	}
+
+	struct filename_trans_key key;
+	key.ttype = tgt->value;
+	key.tclass = cls->value;
+	key.name = (char *)o;
+
+	struct filename_trans_datum *last = NULL;
+
+	struct filename_trans_datum *trans =
+		policydb_filenametr_search(db, &key);
+	while (trans) {
+		if (ebitmap_get_bit(&trans->stypes, src->value - 1)) {
+			// Duplicate, overwrite existing data and return
+			trans->otype = def->value;
+			return true;
+		}
+		if (trans->otype == def->value)
+			break;
+		last = trans;
+		trans = trans->next;
+	}
+
+	if (trans == NULL) {
+		trans = (struct filename_trans_datum *)kcalloc(sizeof(*trans),
+							       1, GFP_ATOMIC);
+		struct filename_trans_key *new_key =
+			(struct filename_trans_key *)kmalloc(sizeof(*new_key),
+							     GFP_ATOMIC);
+		*new_key = key;
+		new_key->name = kstrdup(key.name, GFP_ATOMIC);
+		trans->next = last;
+		trans->otype = def->value;
+		hashtab_insert(&db->filename_trans, new_key, trans,
+			       filenametr_key_params);
+	}
+
+	db->compat_filename_trans_count++;
+	return ebitmap_set_bit(&trans->stypes, src->value - 1, 1) == 0;
+}
+
+static bool add_genfscon(struct policydb *db, const char *fs_name,
+			 const char *path, const char *context)
+{
+	return false;
+}
+
+static void *ksu_realloc(void *old, size_t new_size, size_t old_size)
+{
+	// we can't use krealloc, because it may be read-only
+	void *new = kzalloc(new_size, GFP_ATOMIC);
+	if (!new) {
+		return NULL;
+	}
+	if (old_size) {
+		memcpy(new, old, old_size);
+	}
+	// we can't use kfree, because it may be read-only
+	// there maybe some leaks, maybe we can check ptr_write, but it's not a big deal
+	// kfree(old);
+	return new;
+}
+
+static bool add_type(struct policydb *db, const char *type_name, bool attr)
+{
+	struct type_datum *type = symtab_search(&db->p_types, type_name);
+	if (type) {
+		pr_warn("Type %s already exists\n", type_name);
+		return true;
+	}
+
+	u32 value = ++db->p_types.nprim;
+	type = (struct type_datum *)kzalloc(sizeof(struct type_datum),
+					    GFP_ATOMIC);
+	if (!type) {
+		pr_err("add_type: alloc type_datum failed.\n");
+		return false;
+	}
+
+	type->primary = 1;
+	type->value = value;
+	type->attribute = attr;
+
+	char *key = kstrdup(type_name, GFP_ATOMIC);
+	if (!key) {
+		pr_err("add_type: alloc key failed.\n");
+		return false;
+	}
+
+	if (symtab_insert(&db->p_types, key, type)) {
+		pr_err("add_type: insert symtab failed.\n");
+		return false;
+	}
+
+	struct ebitmap *new_type_attr_map_array =
+		ksu_realloc(db->type_attr_map_array,
+			    value * sizeof(struct ebitmap),
+			    (value - 1) * sizeof(struct ebitmap));
+
+	if (!new_type_attr_map_array) {
+		pr_err("add_type: alloc type_attr_map_array failed\n");
+		return false;
+	}
+
+	struct type_datum **new_type_val_to_struct =
+		ksu_realloc(db->type_val_to_struct,
+			    sizeof(*db->type_val_to_struct) * value,
+			    sizeof(*db->type_val_to_struct) * (value - 1));
+
+	if (!new_type_val_to_struct) {
+		pr_err("add_type: alloc type_val_to_struct failed\n");
+		return false;
+	}
+
+	char **new_val_to_name_types =
+		ksu_realloc(db->sym_val_to_name[SYM_TYPES],
+			    sizeof(char *) * value,
+			    sizeof(char *) * (value - 1));
+	if (!new_val_to_name_types) {
+		pr_err("add_type: alloc val_to_name failed\n");
+		return false;
+	}
+
+	db->type_attr_map_array = new_type_attr_map_array;
+	ebitmap_init(&db->type_attr_map_array[value - 1]);
+	ebitmap_set_bit(&db->type_attr_map_array[value - 1], value - 1, 1);
+
+	db->type_val_to_struct = new_type_val_to_struct;
+	db->type_val_to_struct[value - 1] = type;
+
+	db->sym_val_to_name[SYM_TYPES] = new_val_to_name_types;
+	db->sym_val_to_name[SYM_TYPES][value - 1] = key;
+
+	int i;
+	for (i = 0; i < db->p_roles.nprim; ++i) {
+		ebitmap_set_bit(&db->role_val_to_struct[i]->types, value - 1,
+				1);
+	}
+
+	return true;
+}
+
+static bool set_type_state(struct policydb *db, const char *type_name,
+			   bool permissive)
+{
+	struct type_datum *type;
+	if (type_name == NULL) {
+		struct hashtab_node *node;
+		ksu_hashtab_for_each(db->p_types.table, node)
+		{
+			type = (struct type_datum *)(node->datum);
+			if (ebitmap_set_bit(&db->permissive_map, type->value,
+					    permissive))
+				pr_info("Could not set bit in permissive map\n");
+		};
+	} else {
+		type = (struct type_datum *)symtab_search(&db->p_types,
+							  type_name);
+		if (type == NULL) {
+			pr_info("type %s does not exist\n", type_name);
+			return false;
+		}
+		if (ebitmap_set_bit(&db->permissive_map, type->value,
+				    permissive)) {
+			pr_info("Could not set bit in permissive map\n");
+			return false;
+		}
+	}
+	return true;
+}
+
+static void add_typeattribute_raw(struct policydb *db, struct type_datum *type,
+				  struct type_datum *attr)
+{
+	struct ebitmap *sattr = &db->type_attr_map_array[type->value - 1];
+	ebitmap_set_bit(sattr, attr->value - 1, 1);
+
+	struct hashtab_node *node;
+	struct constraint_node *n;
+	struct constraint_expr *e;
+	ksu_hashtab_for_each(db->p_classes.table, node)
+	{
+		struct class_datum *cls = (struct class_datum *)(node->datum);
+		for (n = cls->constraints; n; n = n->next) {
+			for (e = n->expr; e; e = e->next) {
+				if (e->expr_type == CEXPR_NAMES &&
+				    ebitmap_get_bit(&e->type_names->types,
+						    attr->value - 1)) {
+					ebitmap_set_bit(&e->names,
+							type->value - 1, 1);
+				}
+			}
+		}
+	};
+}
+
+static bool add_typeattribute(struct policydb *db, const char *type,
+			      const char *attr)
+{
+	struct type_datum *type_d = symtab_search(&db->p_types, type);
+	if (type_d == NULL) {
+		pr_info("type %s does not exist\n", type);
+		return false;
+	} else if (type_d->attribute) {
+		pr_info("type %s is an attribute\n", attr);
+		return false;
+	}
+
+	struct type_datum *attr_d = symtab_search(&db->p_types, attr);
+	if (attr_d == NULL) {
+		pr_info("attribute %s does not exist\n", type);
+		return false;
+	} else if (!attr_d->attribute) {
+		pr_info("type %s is not an attribute \n", attr);
+		return false;
+	}
+
+	add_typeattribute_raw(db, type_d, attr_d);
+	return true;
+}
+
+//////////////////////////////////////////////////////////////////////////
+
+// Operation on types
+bool ksu_type(struct policydb *db, const char *name, const char *attr)
+{
+	return add_type(db, name, false) && add_typeattribute(db, name, attr);
+}
+
+bool ksu_attribute(struct policydb *db, const char *name)
+{
+	return add_type(db, name, true);
+}
+
+bool ksu_permissive(struct policydb *db, const char *type)
+{
+	return set_type_state(db, type, true);
+}
+
+bool ksu_enforce(struct policydb *db, const char *type)
+{
+	return set_type_state(db, type, false);
+}
+
+bool ksu_typeattribute(struct policydb *db, const char *type, const char *attr)
+{
+	return add_typeattribute(db, type, attr);
+}
+
+bool ksu_exists(struct policydb *db, const char *type)
+{
+	return symtab_search(&db->p_types, type) != NULL;
+}
+
+// Access vector rules
+bool ksu_allow(struct policydb *db, const char *src, const char *tgt,
+	       const char *cls, const char *perm)
+{
+	return add_rule(db, src, tgt, cls, perm, AVTAB_ALLOWED, false);
+}
+
+bool ksu_deny(struct policydb *db, const char *src, const char *tgt,
+	      const char *cls, const char *perm)
+{
+	return add_rule(db, src, tgt, cls, perm, AVTAB_ALLOWED, true);
+}
+
+bool ksu_auditallow(struct policydb *db, const char *src, const char *tgt,
+		    const char *cls, const char *perm)
+{
+	return add_rule(db, src, tgt, cls, perm, AVTAB_AUDITALLOW, false);
+}
+bool ksu_dontaudit(struct policydb *db, const char *src, const char *tgt,
+		   const char *cls, const char *perm)
+{
+	return add_rule(db, src, tgt, cls, perm, AVTAB_AUDITDENY, true);
+}
+
+// Extended permissions access vector rules
+bool ksu_allowxperm(struct policydb *db, const char *src, const char *tgt,
+		    const char *cls, const char *range)
+{
+	return add_xperm_rule(db, src, tgt, cls, range, AVTAB_XPERMS_ALLOWED,
+			      false);
+}
+
+bool ksu_auditallowxperm(struct policydb *db, const char *src, const char *tgt,
+			 const char *cls, const char *range)
+{
+	return add_xperm_rule(db, src, tgt, cls, range, AVTAB_XPERMS_AUDITALLOW,
+			      false);
+}
+
+bool ksu_dontauditxperm(struct policydb *db, const char *src, const char *tgt,
+			const char *cls, const char *range)
+{
+	return add_xperm_rule(db, src, tgt, cls, range, AVTAB_XPERMS_DONTAUDIT,
+			      false);
+}
+
+// Type rules
+bool ksu_type_transition(struct policydb *db, const char *src, const char *tgt,
+			 const char *cls, const char *def, const char *obj)
+{
+	if (obj) {
+		return add_filename_trans(db, src, tgt, cls, def, obj);
+	} else {
+		return add_type_rule(db, src, tgt, cls, def, AVTAB_TRANSITION);
+	}
+}
+
+bool ksu_type_change(struct policydb *db, const char *src, const char *tgt,
+		     const char *cls, const char *def)
+{
+	return add_type_rule(db, src, tgt, cls, def, AVTAB_CHANGE);
+}
+
+bool ksu_type_member(struct policydb *db, const char *src, const char *tgt,
+		     const char *cls, const char *def)
+{
+	return add_type_rule(db, src, tgt, cls, def, AVTAB_MEMBER);
+}
+
+// File system labeling
+bool ksu_genfscon(struct policydb *db, const char *fs_name, const char *path,
+		  const char *ctx)
+{
+	return add_genfscon(db, fs_name, path, ctx);
+}

kernel/selinux/sepolicy.h

@@ -0,0 +1,46 @@
+#ifndef __KSU_H_SEPOLICY
+#define __KSU_H_SEPOLICY
+
+#include <linux/types.h>
+
+#include "ss/policydb.h"
+
+// Operation on types
+bool ksu_type(struct policydb *db, const char *name, const char *attr);
+bool ksu_attribute(struct policydb *db, const char *name);
+bool ksu_permissive(struct policydb *db, const char *type);
+bool ksu_enforce(struct policydb *db, const char *type);
+bool ksu_typeattribute(struct policydb *db, const char *type, const char *attr);
+bool ksu_exists(struct policydb *db, const char *type);
+
+// Access vector rules
+bool ksu_allow(struct policydb *db, const char *src, const char *tgt,
+	       const char *cls, const char *perm);
+bool ksu_deny(struct policydb *db, const char *src, const char *tgt,
+	      const char *cls, const char *perm);
+bool ksu_auditallow(struct policydb *db, const char *src, const char *tgt,
+		    const char *cls, const char *perm);
+bool ksu_dontaudit(struct policydb *db, const char *src, const char *tgt,
+		   const char *cls, const char *perm);
+
+// Extended permissions access vector rules
+bool ksu_allowxperm(struct policydb *db, const char *src, const char *tgt,
+		    const char *cls, const char *range);
+bool ksu_auditallowxperm(struct policydb *db, const char *src, const char *tgt,
+			 const char *cls, const char *range);
+bool ksu_dontauditxperm(struct policydb *db, const char *src, const char *tgt,
+			const char *cls, const char *range);
+
+// Type rules
+bool ksu_type_transition(struct policydb *db, const char *src, const char *tgt,
+			 const char *cls, const char *def, const char *obj);
+bool ksu_type_change(struct policydb *db, const char *src, const char *tgt,
+		     const char *cls, const char *def);
+bool ksu_type_member(struct policydb *db, const char *src, const char *tgt,
+		     const char *cls, const char *def);
+
+// File system labeling
+bool ksu_genfscon(struct policydb *db, const char *fs_name, const char *path,
+		  const char *ctx);
+
+#endif