Commit 3322d0d6 ("selinux: keep SELinux in sync with new capability
definitions") added a check on the defined capabilities without
explicitly including the capability header file which caused problems
when building genheaders for users of clang/llvm.  Resolve this by
using the kernel headers when building genheaders, which is arguably
the right thing to do regardless, and explicitly including the
kernel's capability.h header file in classmap.h.  We also update the
mdp build, even though it wasn't causing an error we really should
be using the headers from the kernel we are building.
Reported-by: NNicolas Iooss <nicolas.iooss@m4x.org>
Signed-off-by: NPaul Moore <paul@paul-moore.com>

The security_is_socket_class() is auto-generated by genheaders based
on classmap.h to reduce maintenance effort when a new class is defined
in SELinux kernel. The name for any socket class should be suffixed by
"socket" and doesn't contain more than one substr of "socket".
Signed-off-by: NHarry Ciao <qingtao.cao@windriver.com>
Signed-off-by: NEric Paris <eparis@redhat.com>
Acked-by: NStephen Smalley <sds@tycho.nsa.gov>

Fix const warning in the genheaders script as a result of
changes to the headers, as noted here:

http://linux.derkeiler.com/Mailing-Lists/Kernel/2010-03/msg03977.htmlReported-by: NStephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: NJames Morris <jmorris@namei.org>

If a permission name is long enough the selinux class definition generation
tool will go into a infinite loop.  This is because it's macro max() is
fooled into thinking it is dealing with unsigned numbers.  This patch makes
sure the macro always uses signed number so 1 > -1.
Signed-off-by: NEric Paris <eparis@redhat.com>
Signed-off-by: NJames Morris <jmorris@namei.org>

scripts/selinux/genheaders/genheaders.c:20: warning: no previous prototype
for ?usage?
scripts/selinux/genheaders/genheaders.c:26: warning: no previous prototype
for ?stoupperx?
Signed-off-by: NAlan Cox <alan@linux.intel.com>
Acked-by: NWANG Cong <xiyou.wangcong@gmail.com>
Signed-off-by: NJames Morris <jmorris@namei.org>

Add a simple utility (scripts/selinux/genheaders) and invoke it to
generate the kernel-private class and permission indices in flask.h
and av_permissions.h automatically during the kernel build from the
security class mapping definitions in classmap.h.  Adding new kernel
classes and permissions can then be done just by adding them to classmap.h.
Signed-off-by: NStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: NJames Morris <jmorris@namei.org>