15b497af4SThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only
2409dcf31SDaniel Jurgens /*
3409dcf31SDaniel Jurgens * Pkey table
4409dcf31SDaniel Jurgens *
5409dcf31SDaniel Jurgens * SELinux must keep a mapping of Infinband PKEYs to labels/SIDs. This
6409dcf31SDaniel Jurgens * mapping is maintained as part of the normal policy but a fast cache is
7409dcf31SDaniel Jurgens * needed to reduce the lookup overhead.
8409dcf31SDaniel Jurgens *
9409dcf31SDaniel Jurgens * This code is heavily based on the "netif" and "netport" concept originally
10409dcf31SDaniel Jurgens * developed by
11409dcf31SDaniel Jurgens * James Morris <jmorris@redhat.com> and
12409dcf31SDaniel Jurgens * Paul Moore <paul@paul-moore.com>
13409dcf31SDaniel Jurgens * (see security/selinux/netif.c and security/selinux/netport.c for more
14409dcf31SDaniel Jurgens * information)
15409dcf31SDaniel Jurgens */
16409dcf31SDaniel Jurgens
17409dcf31SDaniel Jurgens /*
18409dcf31SDaniel Jurgens * (c) Mellanox Technologies, 2016
19409dcf31SDaniel Jurgens */
20409dcf31SDaniel Jurgens
21409dcf31SDaniel Jurgens #include <linux/types.h>
22409dcf31SDaniel Jurgens #include <linux/rcupdate.h>
23409dcf31SDaniel Jurgens #include <linux/list.h>
24409dcf31SDaniel Jurgens #include <linux/spinlock.h>
25409dcf31SDaniel Jurgens
26409dcf31SDaniel Jurgens #include "ibpkey.h"
27409dcf31SDaniel Jurgens #include "objsec.h"
28409dcf31SDaniel Jurgens
29409dcf31SDaniel Jurgens #define SEL_PKEY_HASH_SIZE 256
30409dcf31SDaniel Jurgens #define SEL_PKEY_HASH_BKT_LIMIT 16
31409dcf31SDaniel Jurgens
32409dcf31SDaniel Jurgens struct sel_ib_pkey_bkt {
33409dcf31SDaniel Jurgens int size;
34409dcf31SDaniel Jurgens struct list_head list;
35409dcf31SDaniel Jurgens };
36409dcf31SDaniel Jurgens
37409dcf31SDaniel Jurgens struct sel_ib_pkey {
38409dcf31SDaniel Jurgens struct pkey_security_struct psec;
39409dcf31SDaniel Jurgens struct list_head list;
40409dcf31SDaniel Jurgens struct rcu_head rcu;
41409dcf31SDaniel Jurgens };
42409dcf31SDaniel Jurgens
43409dcf31SDaniel Jurgens static DEFINE_SPINLOCK(sel_ib_pkey_lock);
44409dcf31SDaniel Jurgens static struct sel_ib_pkey_bkt sel_ib_pkey_hash[SEL_PKEY_HASH_SIZE];
45409dcf31SDaniel Jurgens
46409dcf31SDaniel Jurgens /**
47409dcf31SDaniel Jurgens * sel_ib_pkey_hashfn - Hashing function for the pkey table
48409dcf31SDaniel Jurgens * @pkey: pkey number
49409dcf31SDaniel Jurgens *
50409dcf31SDaniel Jurgens * Description:
51409dcf31SDaniel Jurgens * This is the hashing function for the pkey table, it returns the bucket
52409dcf31SDaniel Jurgens * number for the given pkey.
53409dcf31SDaniel Jurgens *
54409dcf31SDaniel Jurgens */
sel_ib_pkey_hashfn(u16 pkey)55409dcf31SDaniel Jurgens static unsigned int sel_ib_pkey_hashfn(u16 pkey)
56409dcf31SDaniel Jurgens {
57409dcf31SDaniel Jurgens return (pkey & (SEL_PKEY_HASH_SIZE - 1));
58409dcf31SDaniel Jurgens }
59409dcf31SDaniel Jurgens
60409dcf31SDaniel Jurgens /**
61409dcf31SDaniel Jurgens * sel_ib_pkey_find - Search for a pkey record
62409dcf31SDaniel Jurgens * @subnet_prefix: subnet_prefix
63409dcf31SDaniel Jurgens * @pkey_num: pkey_num
64409dcf31SDaniel Jurgens *
65409dcf31SDaniel Jurgens * Description:
66409dcf31SDaniel Jurgens * Search the pkey table and return the matching record. If an entry
67409dcf31SDaniel Jurgens * can not be found in the table return NULL.
68409dcf31SDaniel Jurgens *
69409dcf31SDaniel Jurgens */
sel_ib_pkey_find(u64 subnet_prefix,u16 pkey_num)70409dcf31SDaniel Jurgens static struct sel_ib_pkey *sel_ib_pkey_find(u64 subnet_prefix, u16 pkey_num)
71409dcf31SDaniel Jurgens {
72409dcf31SDaniel Jurgens unsigned int idx;
73409dcf31SDaniel Jurgens struct sel_ib_pkey *pkey;
74409dcf31SDaniel Jurgens
75409dcf31SDaniel Jurgens idx = sel_ib_pkey_hashfn(pkey_num);
76409dcf31SDaniel Jurgens list_for_each_entry_rcu(pkey, &sel_ib_pkey_hash[idx].list, list) {
77409dcf31SDaniel Jurgens if (pkey->psec.pkey == pkey_num &&
78409dcf31SDaniel Jurgens pkey->psec.subnet_prefix == subnet_prefix)
79409dcf31SDaniel Jurgens return pkey;
80409dcf31SDaniel Jurgens }
81409dcf31SDaniel Jurgens
82409dcf31SDaniel Jurgens return NULL;
83409dcf31SDaniel Jurgens }
84409dcf31SDaniel Jurgens
85409dcf31SDaniel Jurgens /**
86409dcf31SDaniel Jurgens * sel_ib_pkey_insert - Insert a new pkey into the table
87409dcf31SDaniel Jurgens * @pkey: the new pkey record
88409dcf31SDaniel Jurgens *
89409dcf31SDaniel Jurgens * Description:
90409dcf31SDaniel Jurgens * Add a new pkey record to the hash table.
91409dcf31SDaniel Jurgens *
92409dcf31SDaniel Jurgens */
sel_ib_pkey_insert(struct sel_ib_pkey * pkey)93409dcf31SDaniel Jurgens static void sel_ib_pkey_insert(struct sel_ib_pkey *pkey)
94409dcf31SDaniel Jurgens {
95409dcf31SDaniel Jurgens unsigned int idx;
96409dcf31SDaniel Jurgens
97409dcf31SDaniel Jurgens /* we need to impose a limit on the growth of the hash table so check
98409dcf31SDaniel Jurgens * this bucket to make sure it is within the specified bounds
99409dcf31SDaniel Jurgens */
100409dcf31SDaniel Jurgens idx = sel_ib_pkey_hashfn(pkey->psec.pkey);
101409dcf31SDaniel Jurgens list_add_rcu(&pkey->list, &sel_ib_pkey_hash[idx].list);
102409dcf31SDaniel Jurgens if (sel_ib_pkey_hash[idx].size == SEL_PKEY_HASH_BKT_LIMIT) {
103409dcf31SDaniel Jurgens struct sel_ib_pkey *tail;
104409dcf31SDaniel Jurgens
105409dcf31SDaniel Jurgens tail = list_entry(
106409dcf31SDaniel Jurgens rcu_dereference_protected(
1070e326df0SPaul Moore list_tail_rcu(&sel_ib_pkey_hash[idx].list),
108409dcf31SDaniel Jurgens lockdep_is_held(&sel_ib_pkey_lock)),
109409dcf31SDaniel Jurgens struct sel_ib_pkey, list);
110409dcf31SDaniel Jurgens list_del_rcu(&tail->list);
111409dcf31SDaniel Jurgens kfree_rcu(tail, rcu);
112409dcf31SDaniel Jurgens } else {
113409dcf31SDaniel Jurgens sel_ib_pkey_hash[idx].size++;
114409dcf31SDaniel Jurgens }
115409dcf31SDaniel Jurgens }
116409dcf31SDaniel Jurgens
117409dcf31SDaniel Jurgens /**
118409dcf31SDaniel Jurgens * sel_ib_pkey_sid_slow - Lookup the SID of a pkey using the policy
119409dcf31SDaniel Jurgens * @subnet_prefix: subnet prefix
120409dcf31SDaniel Jurgens * @pkey_num: pkey number
121409dcf31SDaniel Jurgens * @sid: pkey SID
122409dcf31SDaniel Jurgens *
123409dcf31SDaniel Jurgens * Description:
124409dcf31SDaniel Jurgens * This function determines the SID of a pkey by querying the security
125409dcf31SDaniel Jurgens * policy. The result is added to the pkey table to speedup future
126409dcf31SDaniel Jurgens * queries. Returns zero on success, negative values on failure.
127409dcf31SDaniel Jurgens *
128409dcf31SDaniel Jurgens */
sel_ib_pkey_sid_slow(u64 subnet_prefix,u16 pkey_num,u32 * sid)129409dcf31SDaniel Jurgens static int sel_ib_pkey_sid_slow(u64 subnet_prefix, u16 pkey_num, u32 *sid)
130409dcf31SDaniel Jurgens {
131409dcf31SDaniel Jurgens int ret;
132409dcf31SDaniel Jurgens struct sel_ib_pkey *pkey;
133409dcf31SDaniel Jurgens struct sel_ib_pkey *new = NULL;
134409dcf31SDaniel Jurgens unsigned long flags;
135409dcf31SDaniel Jurgens
136409dcf31SDaniel Jurgens spin_lock_irqsave(&sel_ib_pkey_lock, flags);
137409dcf31SDaniel Jurgens pkey = sel_ib_pkey_find(subnet_prefix, pkey_num);
138409dcf31SDaniel Jurgens if (pkey) {
139409dcf31SDaniel Jurgens *sid = pkey->psec.sid;
140409dcf31SDaniel Jurgens spin_unlock_irqrestore(&sel_ib_pkey_lock, flags);
141409dcf31SDaniel Jurgens return 0;
142409dcf31SDaniel Jurgens }
143409dcf31SDaniel Jurgens
144*e67b7985SStephen Smalley ret = security_ib_pkey_sid(subnet_prefix, pkey_num,
145aa8e712cSStephen Smalley sid);
146409dcf31SDaniel Jurgens if (ret)
147409dcf31SDaniel Jurgens goto out;
148409dcf31SDaniel Jurgens
149409dcf31SDaniel Jurgens /* If this memory allocation fails still return 0. The SID
150409dcf31SDaniel Jurgens * is valid, it just won't be added to the cache.
151409dcf31SDaniel Jurgens */
152409dcf31SDaniel Jurgens new = kzalloc(sizeof(*new), GFP_ATOMIC);
153c350f8beSChen Zhou if (!new) {
154c350f8beSChen Zhou ret = -ENOMEM;
155409dcf31SDaniel Jurgens goto out;
156c350f8beSChen Zhou }
157409dcf31SDaniel Jurgens
158409dcf31SDaniel Jurgens new->psec.subnet_prefix = subnet_prefix;
159409dcf31SDaniel Jurgens new->psec.pkey = pkey_num;
160409dcf31SDaniel Jurgens new->psec.sid = *sid;
161409dcf31SDaniel Jurgens sel_ib_pkey_insert(new);
162409dcf31SDaniel Jurgens
163409dcf31SDaniel Jurgens out:
164409dcf31SDaniel Jurgens spin_unlock_irqrestore(&sel_ib_pkey_lock, flags);
165409dcf31SDaniel Jurgens return ret;
166409dcf31SDaniel Jurgens }
167409dcf31SDaniel Jurgens
168409dcf31SDaniel Jurgens /**
169409dcf31SDaniel Jurgens * sel_ib_pkey_sid - Lookup the SID of a PKEY
170409dcf31SDaniel Jurgens * @subnet_prefix: subnet_prefix
171409dcf31SDaniel Jurgens * @pkey_num: pkey number
172409dcf31SDaniel Jurgens * @sid: pkey SID
173409dcf31SDaniel Jurgens *
174409dcf31SDaniel Jurgens * Description:
175409dcf31SDaniel Jurgens * This function determines the SID of a PKEY using the fastest method
176409dcf31SDaniel Jurgens * possible. First the pkey table is queried, but if an entry can't be found
177409dcf31SDaniel Jurgens * then the policy is queried and the result is added to the table to speedup
178409dcf31SDaniel Jurgens * future queries. Returns zero on success, negative values on failure.
179409dcf31SDaniel Jurgens *
180409dcf31SDaniel Jurgens */
sel_ib_pkey_sid(u64 subnet_prefix,u16 pkey_num,u32 * sid)181409dcf31SDaniel Jurgens int sel_ib_pkey_sid(u64 subnet_prefix, u16 pkey_num, u32 *sid)
182409dcf31SDaniel Jurgens {
183409dcf31SDaniel Jurgens struct sel_ib_pkey *pkey;
184409dcf31SDaniel Jurgens
185409dcf31SDaniel Jurgens rcu_read_lock();
186409dcf31SDaniel Jurgens pkey = sel_ib_pkey_find(subnet_prefix, pkey_num);
187409dcf31SDaniel Jurgens if (pkey) {
188409dcf31SDaniel Jurgens *sid = pkey->psec.sid;
189409dcf31SDaniel Jurgens rcu_read_unlock();
190409dcf31SDaniel Jurgens return 0;
191409dcf31SDaniel Jurgens }
192409dcf31SDaniel Jurgens rcu_read_unlock();
193409dcf31SDaniel Jurgens
194409dcf31SDaniel Jurgens return sel_ib_pkey_sid_slow(subnet_prefix, pkey_num, sid);
195409dcf31SDaniel Jurgens }
196409dcf31SDaniel Jurgens
197409dcf31SDaniel Jurgens /**
198409dcf31SDaniel Jurgens * sel_ib_pkey_flush - Flush the entire pkey table
199409dcf31SDaniel Jurgens *
200409dcf31SDaniel Jurgens * Description:
201409dcf31SDaniel Jurgens * Remove all entries from the pkey table
202409dcf31SDaniel Jurgens *
203409dcf31SDaniel Jurgens */
sel_ib_pkey_flush(void)204409dcf31SDaniel Jurgens void sel_ib_pkey_flush(void)
205409dcf31SDaniel Jurgens {
206409dcf31SDaniel Jurgens unsigned int idx;
207409dcf31SDaniel Jurgens struct sel_ib_pkey *pkey, *pkey_tmp;
208409dcf31SDaniel Jurgens unsigned long flags;
209409dcf31SDaniel Jurgens
210409dcf31SDaniel Jurgens spin_lock_irqsave(&sel_ib_pkey_lock, flags);
211409dcf31SDaniel Jurgens for (idx = 0; idx < SEL_PKEY_HASH_SIZE; idx++) {
212409dcf31SDaniel Jurgens list_for_each_entry_safe(pkey, pkey_tmp,
213409dcf31SDaniel Jurgens &sel_ib_pkey_hash[idx].list, list) {
214409dcf31SDaniel Jurgens list_del_rcu(&pkey->list);
215409dcf31SDaniel Jurgens kfree_rcu(pkey, rcu);
216409dcf31SDaniel Jurgens }
217409dcf31SDaniel Jurgens sel_ib_pkey_hash[idx].size = 0;
218409dcf31SDaniel Jurgens }
219409dcf31SDaniel Jurgens spin_unlock_irqrestore(&sel_ib_pkey_lock, flags);
220409dcf31SDaniel Jurgens }
221409dcf31SDaniel Jurgens
sel_ib_pkey_init(void)222409dcf31SDaniel Jurgens static __init int sel_ib_pkey_init(void)
223409dcf31SDaniel Jurgens {
224409dcf31SDaniel Jurgens int iter;
225409dcf31SDaniel Jurgens
2266c5a682eSStephen Smalley if (!selinux_enabled_boot)
227409dcf31SDaniel Jurgens return 0;
228409dcf31SDaniel Jurgens
229409dcf31SDaniel Jurgens for (iter = 0; iter < SEL_PKEY_HASH_SIZE; iter++) {
230409dcf31SDaniel Jurgens INIT_LIST_HEAD(&sel_ib_pkey_hash[iter].list);
231409dcf31SDaniel Jurgens sel_ib_pkey_hash[iter].size = 0;
232409dcf31SDaniel Jurgens }
233409dcf31SDaniel Jurgens
234409dcf31SDaniel Jurgens return 0;
235409dcf31SDaniel Jurgens }
236409dcf31SDaniel Jurgens
237409dcf31SDaniel Jurgens subsys_initcall(sel_ib_pkey_init);
238