1 /* 2 * Access vector cache interface for object managers. 3 * 4 * Author : Stephen Smalley, <sds@epoch.ncsc.mil> 5 */ 6 #ifndef _SELINUX_AVC_H_ 7 #define _SELINUX_AVC_H_ 8 9 #include <linux/stddef.h> 10 #include <linux/errno.h> 11 #include <linux/kernel.h> 12 #include <linux/kdev_t.h> 13 #include <linux/spinlock.h> 14 #include <linux/init.h> 15 #include <linux/in6.h> 16 #include <linux/path.h> 17 #include <asm/system.h> 18 #include "flask.h" 19 #include "av_permissions.h" 20 #include "security.h" 21 22 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP 23 extern int selinux_enforcing; 24 #else 25 #define selinux_enforcing 1 26 #endif 27 28 /* 29 * An entry in the AVC. 30 */ 31 struct avc_entry; 32 33 struct task_struct; 34 struct inode; 35 struct sock; 36 struct sk_buff; 37 38 /* Auxiliary data to use in generating the audit record. */ 39 struct avc_audit_data { 40 char type; 41 #define AVC_AUDIT_DATA_FS 1 42 #define AVC_AUDIT_DATA_NET 2 43 #define AVC_AUDIT_DATA_CAP 3 44 #define AVC_AUDIT_DATA_IPC 4 45 struct task_struct *tsk; 46 union { 47 struct { 48 struct path path; 49 struct inode *inode; 50 } fs; 51 struct { 52 int netif; 53 struct sock *sk; 54 u16 family; 55 __be16 dport; 56 __be16 sport; 57 union { 58 struct { 59 __be32 daddr; 60 __be32 saddr; 61 } v4; 62 struct { 63 struct in6_addr daddr; 64 struct in6_addr saddr; 65 } v6; 66 } fam; 67 } net; 68 int cap; 69 int ipc_id; 70 } u; 71 }; 72 73 #define v4info fam.v4 74 #define v6info fam.v6 75 76 /* Initialize an AVC audit data structure. */ 77 #define AVC_AUDIT_DATA_INIT(_d,_t) \ 78 { memset((_d), 0, sizeof(struct avc_audit_data)); (_d)->type = AVC_AUDIT_DATA_##_t; } 79 80 /* 81 * AVC statistics 82 */ 83 struct avc_cache_stats { 84 unsigned int lookups; 85 unsigned int hits; 86 unsigned int misses; 87 unsigned int allocations; 88 unsigned int reclaims; 89 unsigned int frees; 90 }; 91 92 /* 93 * AVC operations 94 */ 95 96 void __init avc_init(void); 97 98 void avc_audit(u32 ssid, u32 tsid, 99 u16 tclass, u32 requested, 100 struct av_decision *avd, int result, struct avc_audit_data *auditdata); 101 102 #define AVC_STRICT 1 /* Ignore permissive mode. */ 103 int avc_has_perm_noaudit(u32 ssid, u32 tsid, 104 u16 tclass, u32 requested, 105 unsigned flags, 106 struct av_decision *avd); 107 108 int avc_has_perm(u32 ssid, u32 tsid, 109 u16 tclass, u32 requested, 110 struct avc_audit_data *auditdata); 111 112 u32 avc_policy_seqno(void); 113 114 #define AVC_CALLBACK_GRANT 1 115 #define AVC_CALLBACK_TRY_REVOKE 2 116 #define AVC_CALLBACK_REVOKE 4 117 #define AVC_CALLBACK_RESET 8 118 #define AVC_CALLBACK_AUDITALLOW_ENABLE 16 119 #define AVC_CALLBACK_AUDITALLOW_DISABLE 32 120 #define AVC_CALLBACK_AUDITDENY_ENABLE 64 121 #define AVC_CALLBACK_AUDITDENY_DISABLE 128 122 123 int avc_add_callback(int (*callback)(u32 event, u32 ssid, u32 tsid, 124 u16 tclass, u32 perms, 125 u32 *out_retained), 126 u32 events, u32 ssid, u32 tsid, 127 u16 tclass, u32 perms); 128 129 /* Exported to selinuxfs */ 130 int avc_get_hash_stats(char *page); 131 extern unsigned int avc_cache_threshold; 132 133 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS 134 DECLARE_PER_CPU(struct avc_cache_stats, avc_cache_stats); 135 #endif 136 137 #endif /* _SELINUX_AVC_H_ */ 138 139