|
The getexecattr() function returns a single exec_attr entry. Entries can come from any of the sources specified
in the nsswitch.conf(4)
file.
Successive calls to getexecattr() return either
successive exec_attr entries or NULL. Because getexecattr() always returns a
single entry, the next pointer in the execattr_t data structure points to NULL.
The internal representation of an exec_attr entry
is an execattr_t structure defined in <exec_attr.h> with the following members:
| |
char *name; /* name of the profile */
char *type; /* type of profile */
char *policy; /* policy under which the attributes are */
/* relevant*/
char *res1; /* reserved for future use */
char *res2; /* reserved for future use */
char *id; /* unique identifier */
kva_t *attr; /* attributes */
struct execattr_s *next; /* optional pointer to next profile */
|
The free_execattr() function releases memory. It
follows the next pointers in the execattr_t structure so that the entire linked list is released.
The setexecattr() function "rewinds"
to the beginning of the enumeration of exec_attr entries.
Calls to getexecuser() can leave the enumeration in
an indeterminate state. Therefore, setexecattr() should
be called before the first call to getexecattr().
The endexecattr() function can be called to indicate
that exec_attr processing is complete; the library can
then close any open exec_attr file, deallocate any internal
storage, and so forth.
The getexecuser() function returns a linked list
of entries filtered by the function's arguments. Only entries assigned to
the specified username, as described in the passwd(4) database,
and containing the specified type and id, as described in the exec_attr(4)
database, are placed in the list. The getexecuser() function
is different from the other functions in its family because it spans two
databases. It first looks up the list of profiles assigned to a user in
the user_attr database and the list of default profiles
in /etc/security/policy.conf, then looks up each profile
in the exec_attr database.
The getexecprof() function returns a linked list
of entries that have components matching the function's arguments. Only
entries in the database matching the argument profname,
as described in exec_attr, and containing the type and id, also described in exec_attr, are placed in the list.
Using getexecuser() and getexecprof(),
programmers can search for any type argument, such
as the manifest constant KV_COMMAND. The arguments are
logically AND-ed together so that only entries exactly matching all of the
arguments are returned. Wildcard matching applies if there is no exact match
for an ID. Any argument can be assigned the NULL value to indicate that it is not used as part of the matching
criteria. The search_flag controls whether the function
returns the first match (GET_ONE), setting the next pointer to NULL or all matching
entries (GET_ALL), using the next
pointer to create a linked list of all entries that meet the search criteria.
See EXAMPLES.
Once a list of entries is returned by getexecuser()
or getexecprof(), the convenience function match_execattr() can be used to identify an individual entry. It
returns a pointer to the individual element with the same profile name ( profname), type name ( type), and id. Function parameters set to NULL
are not used as part of the matching criteria. In the event that multiple
entries meet the matching criteria, only a pointer to the first entry is
returned. The kva_match(3SECDB)
function can be used to look up a key in a key-value array.
|
