CBIT(3X)

NAME
cbit, cbitread, cbitlookup, cbitparse, cbitcert - security category manipulation

SYNOPSIS

#include <cbit.h>

struct cbit *cbitparse(char **fields, struct cbit *cb);

struct cbit *cbitread(char *file);

struct cbit *cbitlookup(char *name, struct cbit *cb);

char *cbitcert(struct cbit *p);

DESCRIPTION
These functions manipulate certificates entitling computers to handle compartmented security categories. Each security compartment is represented by a structure of form:
    struct cbit {
    	char *name;		official name of category
    	int floor;		default value (only bottom bit used)
    	char *owner;		public name of issuing authority
    	char *nickname;		our version of category name
    	int bitslot;		where we store it
    	char *exerciser;		who we are
    	char *certificate;	owner's signature
    }
which describes the meaning of the bitslot-th bit in a computer's label space. By convention, the lines of the file contain (in ASCII colon-separated form) the compartments currently held on the local computer.

Cbitparse fills in and returns a cbit in the obvious way from a vector of seven strings. If the second argument is zero cbitparse allots a new structure using malloc(3).

Cbitread reads and parses an ASCII file of cbits, returning an array of filled in structures. The last entry in the array is a dummy; it is signalled by having a zero value of name.

Cbitlookup, when fed a category name and an array of cbits (such as returned by cbitread), returns a pointer to the unique entry whose category name is name, or returns zero.

Cbitcert composes a certificate granting exerciser the right to hold files with the given security category. The output of cbitcert depends only on name, floor, owner, and exerciser. The output must be signed by owner with xs (see notary(3)) to produce the checksum value in certificate. Third parties may check validity of a cbit by calling
    verify(p->exerciser, p->certificate, cbitcert(p), strlen(cbitcert(p)))

FILES

SEE ALSO
notary(3).

DIAGNOSTICS
These routines all return 0 on error.