1 /* 2 * Implementation of the kernel access vector cache (AVC). 3 * 4 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil> 5 * James Morris <jmorris@redhat.com> 6 * 7 * Update: KaiGai, Kohei <kaigai@ak.jp.nec.com> 8 * Replaced the avc_lock spinlock by RCU. 9 * 10 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 11 * 12 * This program is free software; you can redistribute it and/or modify 13 * it under the terms of the GNU General Public License version 2, 14 * as published by the Free Software Foundation. 15 */ 16 #include <linux/types.h> 17 #include <linux/stddef.h> 18 #include <linux/kernel.h> 19 #include <linux/slab.h> 20 #include <linux/fs.h> 21 #include <linux/dcache.h> 22 #include <linux/init.h> 23 #include <linux/skbuff.h> 24 #include <linux/percpu.h> 25 #include <net/sock.h> 26 #include <linux/un.h> 27 #include <net/af_unix.h> 28 #include <linux/ip.h> 29 #include <linux/audit.h> 30 #include <linux/ipv6.h> 31 #include <net/ipv6.h> 32 #include "avc.h" 33 #include "avc_ss.h" 34 #include "classmap.h" 35 36 #define AVC_CACHE_SLOTS 512 37 #define AVC_DEF_CACHE_THRESHOLD 512 38 #define AVC_CACHE_RECLAIM 16 39 40 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS 41 #define avc_cache_stats_incr(field) \ 42 do { \ 43 per_cpu(avc_cache_stats, get_cpu()).field++; \ 44 put_cpu(); \ 45 } while (0) 46 #else 47 #define avc_cache_stats_incr(field) do {} while (0) 48 #endif 49 50 struct avc_entry { 51 u32 ssid; 52 u32 tsid; 53 u16 tclass; 54 struct av_decision avd; 55 }; 56 57 struct avc_node { 58 struct avc_entry ae; 59 struct hlist_node list; /* anchored in avc_cache->slots[i] */ 60 struct rcu_head rhead; 61 }; 62 63 struct avc_cache { 64 struct hlist_head slots[AVC_CACHE_SLOTS]; /* head for avc_node->list */ 65 spinlock_t slots_lock[AVC_CACHE_SLOTS]; /* lock for writes */ 66 atomic_t lru_hint; /* LRU hint for reclaim scan */ 67 atomic_t active_nodes; 68 u32 latest_notif; /* latest revocation notification */ 69 }; 70 71 struct avc_callback_node { 72 int (*callback) (u32 event, u32 ssid, u32 tsid, 73 u16 tclass, u32 perms, 74 u32 *out_retained); 75 u32 events; 76 u32 ssid; 77 u32 tsid; 78 u16 tclass; 79 u32 perms; 80 struct avc_callback_node *next; 81 }; 82 83 /* Exported via selinufs */ 84 unsigned int avc_cache_threshold = AVC_DEF_CACHE_THRESHOLD; 85 86 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS 87 DEFINE_PER_CPU(struct avc_cache_stats, avc_cache_stats) = { 0 }; 88 #endif 89 90 static struct avc_cache avc_cache; 91 static struct avc_callback_node *avc_callbacks; 92 static struct kmem_cache *avc_node_cachep; 93 94 static inline int avc_hash(u32 ssid, u32 tsid, u16 tclass) 95 { 96 return (ssid ^ (tsid<<2) ^ (tclass<<4)) & (AVC_CACHE_SLOTS - 1); 97 } 98 99 /** 100 * avc_dump_av - Display an access vector in human-readable form. 101 * @tclass: target security class 102 * @av: access vector 103 */ 104 static void avc_dump_av(struct audit_buffer *ab, u16 tclass, u32 av) 105 { 106 const char **perms; 107 int i, perm; 108 109 if (av == 0) { 110 audit_log_format(ab, " null"); 111 return; 112 } 113 114 perms = secclass_map[tclass-1].perms; 115 116 audit_log_format(ab, " {"); 117 i = 0; 118 perm = 1; 119 while (i < (sizeof(av) * 8)) { 120 if ((perm & av) && perms[i]) { 121 audit_log_format(ab, " %s", perms[i]); 122 av &= ~perm; 123 } 124 i++; 125 perm <<= 1; 126 } 127 128 if (av) 129 audit_log_format(ab, " 0x%x", av); 130 131 audit_log_format(ab, " }"); 132 } 133 134 /** 135 * avc_dump_query - Display a SID pair and a class in human-readable form. 136 * @ssid: source security identifier 137 * @tsid: target security identifier 138 * @tclass: target security class 139 */ 140 static void avc_dump_query(struct audit_buffer *ab, u32 ssid, u32 tsid, u16 tclass) 141 { 142 int rc; 143 char *scontext; 144 u32 scontext_len; 145 146 rc = security_sid_to_context(ssid, &scontext, &scontext_len); 147 if (rc) 148 audit_log_format(ab, "ssid=%d", ssid); 149 else { 150 audit_log_format(ab, "scontext=%s", scontext); 151 kfree(scontext); 152 } 153 154 rc = security_sid_to_context(tsid, &scontext, &scontext_len); 155 if (rc) 156 audit_log_format(ab, " tsid=%d", tsid); 157 else { 158 audit_log_format(ab, " tcontext=%s", scontext); 159 kfree(scontext); 160 } 161 162 BUG_ON(tclass >= ARRAY_SIZE(secclass_map)); 163 audit_log_format(ab, " tclass=%s", secclass_map[tclass-1].name); 164 } 165 166 /** 167 * avc_init - Initialize the AVC. 168 * 169 * Initialize the access vector cache. 170 */ 171 void __init avc_init(void) 172 { 173 int i; 174 175 for (i = 0; i < AVC_CACHE_SLOTS; i++) { 176 INIT_HLIST_HEAD(&avc_cache.slots[i]); 177 spin_lock_init(&avc_cache.slots_lock[i]); 178 } 179 atomic_set(&avc_cache.active_nodes, 0); 180 atomic_set(&avc_cache.lru_hint, 0); 181 182 avc_node_cachep = kmem_cache_create("avc_node", sizeof(struct avc_node), 183 0, SLAB_PANIC, NULL); 184 185 audit_log(current->audit_context, GFP_KERNEL, AUDIT_KERNEL, "AVC INITIALIZED\n"); 186 } 187 188 int avc_get_hash_stats(char *page) 189 { 190 int i, chain_len, max_chain_len, slots_used; 191 struct avc_node *node; 192 struct hlist_head *head; 193 194 rcu_read_lock(); 195 196 slots_used = 0; 197 max_chain_len = 0; 198 for (i = 0; i < AVC_CACHE_SLOTS; i++) { 199 head = &avc_cache.slots[i]; 200 if (!hlist_empty(head)) { 201 struct hlist_node *next; 202 203 slots_used++; 204 chain_len = 0; 205 hlist_for_each_entry_rcu(node, next, head, list) 206 chain_len++; 207 if (chain_len > max_chain_len) 208 max_chain_len = chain_len; 209 } 210 } 211 212 rcu_read_unlock(); 213 214 return scnprintf(page, PAGE_SIZE, "entries: %d\nbuckets used: %d/%d\n" 215 "longest chain: %d\n", 216 atomic_read(&avc_cache.active_nodes), 217 slots_used, AVC_CACHE_SLOTS, max_chain_len); 218 } 219 220 static void avc_node_free(struct rcu_head *rhead) 221 { 222 struct avc_node *node = container_of(rhead, struct avc_node, rhead); 223 kmem_cache_free(avc_node_cachep, node); 224 avc_cache_stats_incr(frees); 225 } 226 227 static void avc_node_delete(struct avc_node *node) 228 { 229 hlist_del_rcu(&node->list); 230 call_rcu(&node->rhead, avc_node_free); 231 atomic_dec(&avc_cache.active_nodes); 232 } 233 234 static void avc_node_kill(struct avc_node *node) 235 { 236 kmem_cache_free(avc_node_cachep, node); 237 avc_cache_stats_incr(frees); 238 atomic_dec(&avc_cache.active_nodes); 239 } 240 241 static void avc_node_replace(struct avc_node *new, struct avc_node *old) 242 { 243 hlist_replace_rcu(&old->list, &new->list); 244 call_rcu(&old->rhead, avc_node_free); 245 atomic_dec(&avc_cache.active_nodes); 246 } 247 248 static inline int avc_reclaim_node(void) 249 { 250 struct avc_node *node; 251 int hvalue, try, ecx; 252 unsigned long flags; 253 struct hlist_head *head; 254 struct hlist_node *next; 255 spinlock_t *lock; 256 257 for (try = 0, ecx = 0; try < AVC_CACHE_SLOTS; try++) { 258 hvalue = atomic_inc_return(&avc_cache.lru_hint) & (AVC_CACHE_SLOTS - 1); 259 head = &avc_cache.slots[hvalue]; 260 lock = &avc_cache.slots_lock[hvalue]; 261 262 if (!spin_trylock_irqsave(lock, flags)) 263 continue; 264 265 rcu_read_lock(); 266 hlist_for_each_entry(node, next, head, list) { 267 avc_node_delete(node); 268 avc_cache_stats_incr(reclaims); 269 ecx++; 270 if (ecx >= AVC_CACHE_RECLAIM) { 271 rcu_read_unlock(); 272 spin_unlock_irqrestore(lock, flags); 273 goto out; 274 } 275 } 276 rcu_read_unlock(); 277 spin_unlock_irqrestore(lock, flags); 278 } 279 out: 280 return ecx; 281 } 282 283 static struct avc_node *avc_alloc_node(void) 284 { 285 struct avc_node *node; 286 287 node = kmem_cache_zalloc(avc_node_cachep, GFP_ATOMIC); 288 if (!node) 289 goto out; 290 291 INIT_RCU_HEAD(&node->rhead); 292 INIT_HLIST_NODE(&node->list); 293 avc_cache_stats_incr(allocations); 294 295 if (atomic_inc_return(&avc_cache.active_nodes) > avc_cache_threshold) 296 avc_reclaim_node(); 297 298 out: 299 return node; 300 } 301 302 static void avc_node_populate(struct avc_node *node, u32 ssid, u32 tsid, u16 tclass, struct av_decision *avd) 303 { 304 node->ae.ssid = ssid; 305 node->ae.tsid = tsid; 306 node->ae.tclass = tclass; 307 memcpy(&node->ae.avd, avd, sizeof(node->ae.avd)); 308 } 309 310 static inline struct avc_node *avc_search_node(u32 ssid, u32 tsid, u16 tclass) 311 { 312 struct avc_node *node, *ret = NULL; 313 int hvalue; 314 struct hlist_head *head; 315 struct hlist_node *next; 316 317 hvalue = avc_hash(ssid, tsid, tclass); 318 head = &avc_cache.slots[hvalue]; 319 hlist_for_each_entry_rcu(node, next, head, list) { 320 if (ssid == node->ae.ssid && 321 tclass == node->ae.tclass && 322 tsid == node->ae.tsid) { 323 ret = node; 324 break; 325 } 326 } 327 328 return ret; 329 } 330 331 /** 332 * avc_lookup - Look up an AVC entry. 333 * @ssid: source security identifier 334 * @tsid: target security identifier 335 * @tclass: target security class 336 * 337 * Look up an AVC entry that is valid for the 338 * (@ssid, @tsid), interpreting the permissions 339 * based on @tclass. If a valid AVC entry exists, 340 * then this function returns the avc_node. 341 * Otherwise, this function returns NULL. 342 */ 343 static struct avc_node *avc_lookup(u32 ssid, u32 tsid, u16 tclass) 344 { 345 struct avc_node *node; 346 347 avc_cache_stats_incr(lookups); 348 node = avc_search_node(ssid, tsid, tclass); 349 350 if (node) 351 avc_cache_stats_incr(hits); 352 else 353 avc_cache_stats_incr(misses); 354 355 return node; 356 } 357 358 static int avc_latest_notif_update(int seqno, int is_insert) 359 { 360 int ret = 0; 361 static DEFINE_SPINLOCK(notif_lock); 362 unsigned long flag; 363 364 spin_lock_irqsave(¬if_lock, flag); 365 if (is_insert) { 366 if (seqno < avc_cache.latest_notif) { 367 printk(KERN_WARNING "SELinux: avc: seqno %d < latest_notif %d\n", 368 seqno, avc_cache.latest_notif); 369 ret = -EAGAIN; 370 } 371 } else { 372 if (seqno > avc_cache.latest_notif) 373 avc_cache.latest_notif = seqno; 374 } 375 spin_unlock_irqrestore(¬if_lock, flag); 376 377 return ret; 378 } 379 380 /** 381 * avc_insert - Insert an AVC entry. 382 * @ssid: source security identifier 383 * @tsid: target security identifier 384 * @tclass: target security class 385 * @avd: resulting av decision 386 * 387 * Insert an AVC entry for the SID pair 388 * (@ssid, @tsid) and class @tclass. 389 * The access vectors and the sequence number are 390 * normally provided by the security server in 391 * response to a security_compute_av() call. If the 392 * sequence number @avd->seqno is not less than the latest 393 * revocation notification, then the function copies 394 * the access vectors into a cache entry, returns 395 * avc_node inserted. Otherwise, this function returns NULL. 396 */ 397 static struct avc_node *avc_insert(u32 ssid, u32 tsid, u16 tclass, struct av_decision *avd) 398 { 399 struct avc_node *pos, *node = NULL; 400 int hvalue; 401 unsigned long flag; 402 403 if (avc_latest_notif_update(avd->seqno, 1)) 404 goto out; 405 406 node = avc_alloc_node(); 407 if (node) { 408 struct hlist_head *head; 409 struct hlist_node *next; 410 spinlock_t *lock; 411 412 hvalue = avc_hash(ssid, tsid, tclass); 413 avc_node_populate(node, ssid, tsid, tclass, avd); 414 415 head = &avc_cache.slots[hvalue]; 416 lock = &avc_cache.slots_lock[hvalue]; 417 418 spin_lock_irqsave(lock, flag); 419 hlist_for_each_entry(pos, next, head, list) { 420 if (pos->ae.ssid == ssid && 421 pos->ae.tsid == tsid && 422 pos->ae.tclass == tclass) { 423 avc_node_replace(node, pos); 424 goto found; 425 } 426 } 427 hlist_add_head_rcu(&node->list, head); 428 found: 429 spin_unlock_irqrestore(lock, flag); 430 } 431 out: 432 return node; 433 } 434 435 /** 436 * avc_audit_pre_callback - SELinux specific information 437 * will be called by generic audit code 438 * @ab: the audit buffer 439 * @a: audit_data 440 */ 441 static void avc_audit_pre_callback(struct audit_buffer *ab, void *a) 442 { 443 struct common_audit_data *ad = a; 444 audit_log_format(ab, "avc: %s ", 445 ad->selinux_audit_data.denied ? "denied" : "granted"); 446 avc_dump_av(ab, ad->selinux_audit_data.tclass, 447 ad->selinux_audit_data.audited); 448 audit_log_format(ab, " for "); 449 } 450 451 /** 452 * avc_audit_post_callback - SELinux specific information 453 * will be called by generic audit code 454 * @ab: the audit buffer 455 * @a: audit_data 456 */ 457 static void avc_audit_post_callback(struct audit_buffer *ab, void *a) 458 { 459 struct common_audit_data *ad = a; 460 audit_log_format(ab, " "); 461 avc_dump_query(ab, ad->selinux_audit_data.ssid, 462 ad->selinux_audit_data.tsid, 463 ad->selinux_audit_data.tclass); 464 } 465 466 /** 467 * avc_audit - Audit the granting or denial of permissions. 468 * @ssid: source security identifier 469 * @tsid: target security identifier 470 * @tclass: target security class 471 * @requested: requested permissions 472 * @avd: access vector decisions 473 * @result: result from avc_has_perm_noaudit 474 * @a: auxiliary audit data 475 * 476 * Audit the granting or denial of permissions in accordance 477 * with the policy. This function is typically called by 478 * avc_has_perm() after a permission check, but can also be 479 * called directly by callers who use avc_has_perm_noaudit() 480 * in order to separate the permission check from the auditing. 481 * For example, this separation is useful when the permission check must 482 * be performed under a lock, to allow the lock to be released 483 * before calling the auditing code. 484 */ 485 void avc_audit(u32 ssid, u32 tsid, 486 u16 tclass, u32 requested, 487 struct av_decision *avd, int result, struct common_audit_data *a) 488 { 489 struct common_audit_data stack_data; 490 u32 denied, audited; 491 denied = requested & ~avd->allowed; 492 if (denied) 493 audited = denied & avd->auditdeny; 494 else if (result) 495 audited = denied = requested; 496 else 497 audited = requested & avd->auditallow; 498 if (!audited) 499 return; 500 if (!a) { 501 a = &stack_data; 502 COMMON_AUDIT_DATA_INIT(a, NONE); 503 } 504 a->selinux_audit_data.tclass = tclass; 505 a->selinux_audit_data.requested = requested; 506 a->selinux_audit_data.ssid = ssid; 507 a->selinux_audit_data.tsid = tsid; 508 a->selinux_audit_data.audited = audited; 509 a->selinux_audit_data.denied = denied; 510 a->lsm_pre_audit = avc_audit_pre_callback; 511 a->lsm_post_audit = avc_audit_post_callback; 512 common_lsm_audit(a); 513 } 514 515 /** 516 * avc_add_callback - Register a callback for security events. 517 * @callback: callback function 518 * @events: security events 519 * @ssid: source security identifier or %SECSID_WILD 520 * @tsid: target security identifier or %SECSID_WILD 521 * @tclass: target security class 522 * @perms: permissions 523 * 524 * Register a callback function for events in the set @events 525 * related to the SID pair (@ssid, @tsid) 526 * and the permissions @perms, interpreting 527 * @perms based on @tclass. Returns %0 on success or 528 * -%ENOMEM if insufficient memory exists to add the callback. 529 */ 530 int avc_add_callback(int (*callback)(u32 event, u32 ssid, u32 tsid, 531 u16 tclass, u32 perms, 532 u32 *out_retained), 533 u32 events, u32 ssid, u32 tsid, 534 u16 tclass, u32 perms) 535 { 536 struct avc_callback_node *c; 537 int rc = 0; 538 539 c = kmalloc(sizeof(*c), GFP_ATOMIC); 540 if (!c) { 541 rc = -ENOMEM; 542 goto out; 543 } 544 545 c->callback = callback; 546 c->events = events; 547 c->ssid = ssid; 548 c->tsid = tsid; 549 c->perms = perms; 550 c->next = avc_callbacks; 551 avc_callbacks = c; 552 out: 553 return rc; 554 } 555 556 static inline int avc_sidcmp(u32 x, u32 y) 557 { 558 return (x == y || x == SECSID_WILD || y == SECSID_WILD); 559 } 560 561 /** 562 * avc_update_node Update an AVC entry 563 * @event : Updating event 564 * @perms : Permission mask bits 565 * @ssid,@tsid,@tclass : identifier of an AVC entry 566 * @seqno : sequence number when decision was made 567 * 568 * if a valid AVC entry doesn't exist,this function returns -ENOENT. 569 * if kmalloc() called internal returns NULL, this function returns -ENOMEM. 570 * otherwise, this function updates the AVC entry. The original AVC-entry object 571 * will release later by RCU. 572 */ 573 static int avc_update_node(u32 event, u32 perms, u32 ssid, u32 tsid, u16 tclass, 574 u32 seqno) 575 { 576 int hvalue, rc = 0; 577 unsigned long flag; 578 struct avc_node *pos, *node, *orig = NULL; 579 struct hlist_head *head; 580 struct hlist_node *next; 581 spinlock_t *lock; 582 583 node = avc_alloc_node(); 584 if (!node) { 585 rc = -ENOMEM; 586 goto out; 587 } 588 589 /* Lock the target slot */ 590 hvalue = avc_hash(ssid, tsid, tclass); 591 592 head = &avc_cache.slots[hvalue]; 593 lock = &avc_cache.slots_lock[hvalue]; 594 595 spin_lock_irqsave(lock, flag); 596 597 hlist_for_each_entry(pos, next, head, list) { 598 if (ssid == pos->ae.ssid && 599 tsid == pos->ae.tsid && 600 tclass == pos->ae.tclass && 601 seqno == pos->ae.avd.seqno){ 602 orig = pos; 603 break; 604 } 605 } 606 607 if (!orig) { 608 rc = -ENOENT; 609 avc_node_kill(node); 610 goto out_unlock; 611 } 612 613 /* 614 * Copy and replace original node. 615 */ 616 617 avc_node_populate(node, ssid, tsid, tclass, &orig->ae.avd); 618 619 switch (event) { 620 case AVC_CALLBACK_GRANT: 621 node->ae.avd.allowed |= perms; 622 break; 623 case AVC_CALLBACK_TRY_REVOKE: 624 case AVC_CALLBACK_REVOKE: 625 node->ae.avd.allowed &= ~perms; 626 break; 627 case AVC_CALLBACK_AUDITALLOW_ENABLE: 628 node->ae.avd.auditallow |= perms; 629 break; 630 case AVC_CALLBACK_AUDITALLOW_DISABLE: 631 node->ae.avd.auditallow &= ~perms; 632 break; 633 case AVC_CALLBACK_AUDITDENY_ENABLE: 634 node->ae.avd.auditdeny |= perms; 635 break; 636 case AVC_CALLBACK_AUDITDENY_DISABLE: 637 node->ae.avd.auditdeny &= ~perms; 638 break; 639 } 640 avc_node_replace(node, orig); 641 out_unlock: 642 spin_unlock_irqrestore(lock, flag); 643 out: 644 return rc; 645 } 646 647 /** 648 * avc_flush - Flush the cache 649 */ 650 static void avc_flush(void) 651 { 652 struct hlist_head *head; 653 struct hlist_node *next; 654 struct avc_node *node; 655 spinlock_t *lock; 656 unsigned long flag; 657 int i; 658 659 for (i = 0; i < AVC_CACHE_SLOTS; i++) { 660 head = &avc_cache.slots[i]; 661 lock = &avc_cache.slots_lock[i]; 662 663 spin_lock_irqsave(lock, flag); 664 /* 665 * With preemptable RCU, the outer spinlock does not 666 * prevent RCU grace periods from ending. 667 */ 668 rcu_read_lock(); 669 hlist_for_each_entry(node, next, head, list) 670 avc_node_delete(node); 671 rcu_read_unlock(); 672 spin_unlock_irqrestore(lock, flag); 673 } 674 } 675 676 /** 677 * avc_ss_reset - Flush the cache and revalidate migrated permissions. 678 * @seqno: policy sequence number 679 */ 680 int avc_ss_reset(u32 seqno) 681 { 682 struct avc_callback_node *c; 683 int rc = 0, tmprc; 684 685 avc_flush(); 686 687 for (c = avc_callbacks; c; c = c->next) { 688 if (c->events & AVC_CALLBACK_RESET) { 689 tmprc = c->callback(AVC_CALLBACK_RESET, 690 0, 0, 0, 0, NULL); 691 /* save the first error encountered for the return 692 value and continue processing the callbacks */ 693 if (!rc) 694 rc = tmprc; 695 } 696 } 697 698 avc_latest_notif_update(seqno, 0); 699 return rc; 700 } 701 702 /** 703 * avc_has_perm_noaudit - Check permissions but perform no auditing. 704 * @ssid: source security identifier 705 * @tsid: target security identifier 706 * @tclass: target security class 707 * @requested: requested permissions, interpreted based on @tclass 708 * @flags: AVC_STRICT or 0 709 * @avd: access vector decisions 710 * 711 * Check the AVC to determine whether the @requested permissions are granted 712 * for the SID pair (@ssid, @tsid), interpreting the permissions 713 * based on @tclass, and call the security server on a cache miss to obtain 714 * a new decision and add it to the cache. Return a copy of the decisions 715 * in @avd. Return %0 if all @requested permissions are granted, 716 * -%EACCES if any permissions are denied, or another -errno upon 717 * other errors. This function is typically called by avc_has_perm(), 718 * but may also be called directly to separate permission checking from 719 * auditing, e.g. in cases where a lock must be held for the check but 720 * should be released for the auditing. 721 */ 722 int avc_has_perm_noaudit(u32 ssid, u32 tsid, 723 u16 tclass, u32 requested, 724 unsigned flags, 725 struct av_decision *in_avd) 726 { 727 struct avc_node *node; 728 struct av_decision avd_entry, *avd; 729 int rc = 0; 730 u32 denied; 731 732 BUG_ON(!requested); 733 734 rcu_read_lock(); 735 736 node = avc_lookup(ssid, tsid, tclass); 737 if (!node) { 738 rcu_read_unlock(); 739 740 if (in_avd) 741 avd = in_avd; 742 else 743 avd = &avd_entry; 744 745 security_compute_av(ssid, tsid, tclass, avd); 746 rcu_read_lock(); 747 node = avc_insert(ssid, tsid, tclass, avd); 748 } else { 749 if (in_avd) 750 memcpy(in_avd, &node->ae.avd, sizeof(*in_avd)); 751 avd = &node->ae.avd; 752 } 753 754 denied = requested & ~(avd->allowed); 755 756 if (denied) { 757 if (flags & AVC_STRICT) 758 rc = -EACCES; 759 else if (!selinux_enforcing || (avd->flags & AVD_FLAGS_PERMISSIVE)) 760 avc_update_node(AVC_CALLBACK_GRANT, requested, ssid, 761 tsid, tclass, avd->seqno); 762 else 763 rc = -EACCES; 764 } 765 766 rcu_read_unlock(); 767 return rc; 768 } 769 770 /** 771 * avc_has_perm - Check permissions and perform any appropriate auditing. 772 * @ssid: source security identifier 773 * @tsid: target security identifier 774 * @tclass: target security class 775 * @requested: requested permissions, interpreted based on @tclass 776 * @auditdata: auxiliary audit data 777 * 778 * Check the AVC to determine whether the @requested permissions are granted 779 * for the SID pair (@ssid, @tsid), interpreting the permissions 780 * based on @tclass, and call the security server on a cache miss to obtain 781 * a new decision and add it to the cache. Audit the granting or denial of 782 * permissions in accordance with the policy. Return %0 if all @requested 783 * permissions are granted, -%EACCES if any permissions are denied, or 784 * another -errno upon other errors. 785 */ 786 int avc_has_perm(u32 ssid, u32 tsid, u16 tclass, 787 u32 requested, struct common_audit_data *auditdata) 788 { 789 struct av_decision avd; 790 int rc; 791 792 rc = avc_has_perm_noaudit(ssid, tsid, tclass, requested, 0, &avd); 793 avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata); 794 return rc; 795 } 796 797 u32 avc_policy_seqno(void) 798 { 799 return avc_cache.latest_notif; 800 } 801 802 void avc_disable(void) 803 { 804 /* 805 * If you are looking at this because you have realized that we are 806 * not destroying the avc_node_cachep it might be easy to fix, but 807 * I don't know the memory barrier semantics well enough to know. It's 808 * possible that some other task dereferenced security_ops when 809 * it still pointed to selinux operations. If that is the case it's 810 * possible that it is about to use the avc and is about to need the 811 * avc_node_cachep. I know I could wrap the security.c security_ops call 812 * in an rcu_lock, but seriously, it's not worth it. Instead I just flush 813 * the cache and get that memory back. 814 */ 815 if (avc_node_cachep) { 816 avc_flush(); 817 /* kmem_cache_destroy(avc_node_cachep); */ 818 } 819 } 820