1 /* SPDX-License-Identifier: GPL-2.0 */ 2 /* 3 * Access vector cache interface for object managers. 4 * 5 * Author : Stephen Smalley, <sds@tycho.nsa.gov> 6 */ 7 #ifndef _SELINUX_AVC_H_ 8 #define _SELINUX_AVC_H_ 9 10 #include <linux/stddef.h> 11 #include <linux/errno.h> 12 #include <linux/kernel.h> 13 #include <linux/kdev_t.h> 14 #include <linux/spinlock.h> 15 #include <linux/init.h> 16 #include <linux/audit.h> 17 #include <linux/lsm_audit.h> 18 #include <linux/in6.h> 19 #include "flask.h" 20 #include "av_permissions.h" 21 #include "security.h" 22 23 /* 24 * An entry in the AVC. 25 */ 26 struct avc_entry; 27 28 struct task_struct; 29 struct inode; 30 struct sock; 31 struct sk_buff; 32 33 /* 34 * AVC statistics 35 */ 36 struct avc_cache_stats { 37 unsigned int lookups; 38 unsigned int misses; 39 unsigned int allocations; 40 unsigned int reclaims; 41 unsigned int frees; 42 }; 43 44 /* 45 * We only need this data after we have decided to send an audit message. 46 */ 47 struct selinux_audit_data { 48 u32 ssid; 49 u32 tsid; 50 u16 tclass; 51 u32 requested; 52 u32 audited; 53 u32 denied; 54 int result; 55 }; 56 57 /* 58 * AVC operations 59 */ 60 61 void __init avc_init(void); 62 63 static inline u32 avc_audit_required(u32 requested, 64 struct av_decision *avd, 65 int result, 66 u32 auditdeny, 67 u32 *deniedp) 68 { 69 u32 denied, audited; 70 denied = requested & ~avd->allowed; 71 if (unlikely(denied)) { 72 audited = denied & avd->auditdeny; 73 /* 74 * auditdeny is TRICKY! Setting a bit in 75 * this field means that ANY denials should NOT be audited if 76 * the policy contains an explicit dontaudit rule for that 77 * permission. Take notice that this is unrelated to the 78 * actual permissions that were denied. As an example lets 79 * assume: 80 * 81 * denied == READ 82 * avd.auditdeny & ACCESS == 0 (not set means explicit rule) 83 * auditdeny & ACCESS == 1 84 * 85 * We will NOT audit the denial even though the denied 86 * permission was READ and the auditdeny checks were for 87 * ACCESS 88 */ 89 if (auditdeny && !(auditdeny & avd->auditdeny)) 90 audited = 0; 91 } else if (result) 92 audited = denied = requested; 93 else 94 audited = requested & avd->auditallow; 95 *deniedp = denied; 96 return audited; 97 } 98 99 int slow_avc_audit(u32 ssid, u32 tsid, u16 tclass, 100 u32 requested, u32 audited, u32 denied, int result, 101 struct common_audit_data *a, 102 unsigned flags); 103 104 /** 105 * avc_audit - Audit the granting or denial of permissions. 106 * @ssid: source security identifier 107 * @tsid: target security identifier 108 * @tclass: target security class 109 * @requested: requested permissions 110 * @avd: access vector decisions 111 * @result: result from avc_has_perm_noaudit 112 * @a: auxiliary audit data 113 * @flags: VFS walk flags 114 * 115 * Audit the granting or denial of permissions in accordance 116 * with the policy. This function is typically called by 117 * avc_has_perm() after a permission check, but can also be 118 * called directly by callers who use avc_has_perm_noaudit() 119 * in order to separate the permission check from the auditing. 120 * For example, this separation is useful when the permission check must 121 * be performed under a lock, to allow the lock to be released 122 * before calling the auditing code. 123 */ 124 static inline int avc_audit(u32 ssid, u32 tsid, 125 u16 tclass, u32 requested, 126 struct av_decision *avd, 127 int result, 128 struct common_audit_data *a, 129 int flags) 130 { 131 u32 audited, denied; 132 audited = avc_audit_required(requested, avd, result, 0, &denied); 133 if (likely(!audited)) 134 return 0; 135 return slow_avc_audit(ssid, tsid, tclass, 136 requested, audited, denied, result, 137 a, flags); 138 } 139 140 #define AVC_STRICT 1 /* Ignore permissive mode. */ 141 #define AVC_EXTENDED_PERMS 2 /* update extended permissions */ 142 int avc_has_perm_noaudit(u32 ssid, u32 tsid, 143 u16 tclass, u32 requested, 144 unsigned flags, 145 struct av_decision *avd); 146 147 int avc_has_perm(u32 ssid, u32 tsid, 148 u16 tclass, u32 requested, 149 struct common_audit_data *auditdata); 150 int avc_has_perm_flags(u32 ssid, u32 tsid, 151 u16 tclass, u32 requested, 152 struct common_audit_data *auditdata, 153 int flags); 154 155 int avc_has_extended_perms(u32 ssid, u32 tsid, u16 tclass, u32 requested, 156 u8 driver, u8 perm, struct common_audit_data *ad); 157 158 159 u32 avc_policy_seqno(void); 160 161 #define AVC_CALLBACK_GRANT 1 162 #define AVC_CALLBACK_TRY_REVOKE 2 163 #define AVC_CALLBACK_REVOKE 4 164 #define AVC_CALLBACK_RESET 8 165 #define AVC_CALLBACK_AUDITALLOW_ENABLE 16 166 #define AVC_CALLBACK_AUDITALLOW_DISABLE 32 167 #define AVC_CALLBACK_AUDITDENY_ENABLE 64 168 #define AVC_CALLBACK_AUDITDENY_DISABLE 128 169 #define AVC_CALLBACK_ADD_XPERMS 256 170 171 int avc_add_callback(int (*callback)(u32 event), u32 events); 172 173 /* Exported to selinuxfs */ 174 int avc_get_hash_stats(char *page); 175 extern unsigned int avc_cache_threshold; 176 177 /* Attempt to free avc node cache */ 178 void avc_disable(void); 179 180 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS 181 DECLARE_PER_CPU(struct avc_cache_stats, avc_cache_stats); 182 #endif 183 184 #endif /* _SELINUX_AVC_H_ */ 185 186