2005-04-16 16:20:36 -06:00
|
|
|
/*
|
|
|
|
* Access vector cache interface for object managers.
|
|
|
|
*
|
|
|
|
* Author : Stephen Smalley, <sds@epoch.ncsc.mil>
|
|
|
|
*/
|
|
|
|
#ifndef _SELINUX_AVC_H_
|
|
|
|
#define _SELINUX_AVC_H_
|
|
|
|
|
|
|
|
#include <linux/stddef.h>
|
|
|
|
#include <linux/errno.h>
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
#include <linux/kdev_t.h>
|
|
|
|
#include <linux/spinlock.h>
|
|
|
|
#include <linux/init.h>
|
2008-08-28 01:35:57 -06:00
|
|
|
#include <linux/audit.h>
|
2009-07-14 10:14:09 -06:00
|
|
|
#include <linux/lsm_audit.h>
|
2005-04-16 16:20:36 -06:00
|
|
|
#include <linux/in6.h>
|
|
|
|
#include "flask.h"
|
|
|
|
#include "av_permissions.h"
|
|
|
|
#include "security.h"
|
|
|
|
|
|
|
|
#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
|
|
|
|
extern int selinux_enforcing;
|
|
|
|
#else
|
|
|
|
#define selinux_enforcing 1
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/*
|
|
|
|
* An entry in the AVC.
|
|
|
|
*/
|
|
|
|
struct avc_entry;
|
|
|
|
|
|
|
|
struct task_struct;
|
|
|
|
struct inode;
|
|
|
|
struct sock;
|
|
|
|
struct sk_buff;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* AVC statistics
|
|
|
|
*/
|
2008-05-14 09:27:45 -06:00
|
|
|
struct avc_cache_stats {
|
2005-04-16 16:20:36 -06:00
|
|
|
unsigned int lookups;
|
|
|
|
unsigned int misses;
|
|
|
|
unsigned int allocations;
|
|
|
|
unsigned int reclaims;
|
|
|
|
unsigned int frees;
|
|
|
|
};
|
|
|
|
|
2012-04-03 10:38:00 -06:00
|
|
|
/*
|
|
|
|
* We only need this data after we have decided to send an audit message.
|
|
|
|
*/
|
2012-04-04 13:01:43 -06:00
|
|
|
struct selinux_audit_data {
|
2012-04-03 10:37:02 -06:00
|
|
|
u32 ssid;
|
|
|
|
u32 tsid;
|
|
|
|
u16 tclass;
|
|
|
|
u32 requested;
|
|
|
|
u32 audited;
|
|
|
|
u32 denied;
|
2012-04-03 10:38:00 -06:00
|
|
|
int result;
|
|
|
|
};
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
/*
|
|
|
|
* AVC operations
|
|
|
|
*/
|
|
|
|
|
|
|
|
void __init avc_init(void);
|
|
|
|
|
2012-04-04 13:01:42 -06:00
|
|
|
static inline u32 avc_audit_required(u32 requested,
|
|
|
|
struct av_decision *avd,
|
|
|
|
int result,
|
|
|
|
u32 auditdeny,
|
|
|
|
u32 *deniedp)
|
|
|
|
{
|
|
|
|
u32 denied, audited;
|
|
|
|
denied = requested & ~avd->allowed;
|
|
|
|
if (unlikely(denied)) {
|
|
|
|
audited = denied & avd->auditdeny;
|
|
|
|
/*
|
|
|
|
* auditdeny is TRICKY! Setting a bit in
|
|
|
|
* this field means that ANY denials should NOT be audited if
|
|
|
|
* the policy contains an explicit dontaudit rule for that
|
|
|
|
* permission. Take notice that this is unrelated to the
|
|
|
|
* actual permissions that were denied. As an example lets
|
|
|
|
* assume:
|
|
|
|
*
|
|
|
|
* denied == READ
|
|
|
|
* avd.auditdeny & ACCESS == 0 (not set means explicit rule)
|
|
|
|
* auditdeny & ACCESS == 1
|
|
|
|
*
|
|
|
|
* We will NOT audit the denial even though the denied
|
|
|
|
* permission was READ and the auditdeny checks were for
|
|
|
|
* ACCESS
|
|
|
|
*/
|
|
|
|
if (auditdeny && !(auditdeny & avd->auditdeny))
|
|
|
|
audited = 0;
|
|
|
|
} else if (result)
|
|
|
|
audited = denied = requested;
|
|
|
|
else
|
|
|
|
audited = requested & avd->auditallow;
|
|
|
|
*deniedp = denied;
|
|
|
|
return audited;
|
|
|
|
}
|
|
|
|
|
|
|
|
int slow_avc_audit(u32 ssid, u32 tsid, u16 tclass,
|
|
|
|
u32 requested, u32 audited, u32 denied,
|
|
|
|
struct common_audit_data *a,
|
|
|
|
unsigned flags);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* avc_audit - Audit the granting or denial of permissions.
|
|
|
|
* @ssid: source security identifier
|
|
|
|
* @tsid: target security identifier
|
|
|
|
* @tclass: target security class
|
|
|
|
* @requested: requested permissions
|
|
|
|
* @avd: access vector decisions
|
|
|
|
* @result: result from avc_has_perm_noaudit
|
|
|
|
* @a: auxiliary audit data
|
|
|
|
* @flags: VFS walk flags
|
|
|
|
*
|
|
|
|
* Audit the granting or denial of permissions in accordance
|
|
|
|
* with the policy. This function is typically called by
|
|
|
|
* avc_has_perm() after a permission check, but can also be
|
|
|
|
* called directly by callers who use avc_has_perm_noaudit()
|
|
|
|
* in order to separate the permission check from the auditing.
|
|
|
|
* For example, this separation is useful when the permission check must
|
|
|
|
* be performed under a lock, to allow the lock to be released
|
|
|
|
* before calling the auditing code.
|
|
|
|
*/
|
|
|
|
static inline int avc_audit(u32 ssid, u32 tsid,
|
|
|
|
u16 tclass, u32 requested,
|
|
|
|
struct av_decision *avd,
|
|
|
|
int result,
|
|
|
|
struct common_audit_data *a, unsigned flags)
|
|
|
|
{
|
|
|
|
u32 audited, denied;
|
2012-04-04 13:01:43 -06:00
|
|
|
audited = avc_audit_required(requested, avd, result, 0, &denied);
|
2012-04-04 13:01:42 -06:00
|
|
|
if (likely(!audited))
|
|
|
|
return 0;
|
|
|
|
return slow_avc_audit(ssid, tsid, tclass,
|
|
|
|
requested, audited, denied,
|
|
|
|
a, flags);
|
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2007-06-07 13:34:10 -06:00
|
|
|
#define AVC_STRICT 1 /* Ignore permissive mode. */
|
2005-04-16 16:20:36 -06:00
|
|
|
int avc_has_perm_noaudit(u32 ssid, u32 tsid,
|
2007-06-07 13:34:10 -06:00
|
|
|
u16 tclass, u32 requested,
|
|
|
|
unsigned flags,
|
|
|
|
struct av_decision *avd);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2011-04-25 14:26:29 -06:00
|
|
|
int avc_has_perm_flags(u32 ssid, u32 tsid,
|
|
|
|
u16 tclass, u32 requested,
|
|
|
|
struct common_audit_data *auditdata,
|
|
|
|
unsigned);
|
|
|
|
|
|
|
|
static inline int avc_has_perm(u32 ssid, u32 tsid,
|
|
|
|
u16 tclass, u32 requested,
|
|
|
|
struct common_audit_data *auditdata)
|
|
|
|
{
|
|
|
|
return avc_has_perm_flags(ssid, tsid, tclass, requested, auditdata, 0);
|
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2007-09-13 18:27:07 -06:00
|
|
|
u32 avc_policy_seqno(void);
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
#define AVC_CALLBACK_GRANT 1
|
|
|
|
#define AVC_CALLBACK_TRY_REVOKE 2
|
|
|
|
#define AVC_CALLBACK_REVOKE 4
|
|
|
|
#define AVC_CALLBACK_RESET 8
|
|
|
|
#define AVC_CALLBACK_AUDITALLOW_ENABLE 16
|
|
|
|
#define AVC_CALLBACK_AUDITALLOW_DISABLE 32
|
|
|
|
#define AVC_CALLBACK_AUDITDENY_ENABLE 64
|
|
|
|
#define AVC_CALLBACK_AUDITDENY_DISABLE 128
|
|
|
|
|
2012-03-07 07:17:14 -07:00
|
|
|
int avc_add_callback(int (*callback)(u32 event), u32 events);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
/* Exported to selinuxfs */
|
|
|
|
int avc_get_hash_stats(char *page);
|
|
|
|
extern unsigned int avc_cache_threshold;
|
|
|
|
|
2009-06-24 15:58:05 -06:00
|
|
|
/* Attempt to free avc node cache */
|
|
|
|
void avc_disable(void);
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
#ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
|
|
|
|
DECLARE_PER_CPU(struct avc_cache_stats, avc_cache_stats);
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#endif /* _SELINUX_AVC_H_ */
|
|
|
|
|