sidtab.h (976e3645923bdd2fe7893aae33fd7a21098bfb28) sidtab.h (66f8e2f03c02e812002f8e9e465681cc62edda5b)
1/* SPDX-License-Identifier: GPL-2.0 */
2/*
3 * A security identifier table (sidtab) is a lookup table
4 * of security context structures indexed by SID value.
5 *
6 * Original author: Stephen Smalley, <sds@tycho.nsa.gov>
7 * Author: Ondrej Mosnacek, <omosnacek@gmail.com>
8 *
9 * Copyright (C) 2018 Red Hat, Inc.
10 */
11#ifndef _SS_SIDTAB_H_
12#define _SS_SIDTAB_H_
13
14#include <linux/spinlock_types.h>
15#include <linux/log2.h>
1/* SPDX-License-Identifier: GPL-2.0 */
2/*
3 * A security identifier table (sidtab) is a lookup table
4 * of security context structures indexed by SID value.
5 *
6 * Original author: Stephen Smalley, <sds@tycho.nsa.gov>
7 * Author: Ondrej Mosnacek, <omosnacek@gmail.com>
8 *
9 * Copyright (C) 2018 Red Hat, Inc.
10 */
11#ifndef _SS_SIDTAB_H_
12#define _SS_SIDTAB_H_
13
14#include <linux/spinlock_types.h>
15#include <linux/log2.h>
16#include <linux/hashtable.h>
16
17#include "context.h"
18
19struct sidtab_entry_leaf {
17
18#include "context.h"
19
20struct sidtab_entry_leaf {
21 u32 sid;
20 struct context context;
22 struct context context;
23 struct hlist_node list;
21};
22
23struct sidtab_node_inner;
24struct sidtab_node_leaf;
25
26union sidtab_entry_inner {
27 struct sidtab_node_inner *ptr_inner;
28 struct sidtab_node_leaf *ptr_leaf;

--- 23 unchanged lines hidden (view full) ---

52};
53
54struct sidtab_node_inner {
55 union sidtab_entry_inner entries[SIDTAB_INNER_ENTRIES];
56};
57
58struct sidtab_isid_entry {
59 int set;
24};
25
26struct sidtab_node_inner;
27struct sidtab_node_leaf;
28
29union sidtab_entry_inner {
30 struct sidtab_node_inner *ptr_inner;
31 struct sidtab_node_leaf *ptr_leaf;

--- 23 unchanged lines hidden (view full) ---

55};
56
57struct sidtab_node_inner {
58 union sidtab_entry_inner entries[SIDTAB_INNER_ENTRIES];
59};
60
61struct sidtab_isid_entry {
62 int set;
60 struct context context;
63 struct sidtab_entry_leaf leaf;
61};
62
63struct sidtab_convert_params {
64 int (*func)(struct context *oldc, struct context *newc, void *args);
65 void *args;
66 struct sidtab *target;
67};
68
64};
65
66struct sidtab_convert_params {
67 int (*func)(struct context *oldc, struct context *newc, void *args);
68 void *args;
69 struct sidtab *target;
70};
71
69#define SIDTAB_RCACHE_SIZE 3
72#define SIDTAB_HASH_BITS CONFIG_SECURITY_SELINUX_SIDTAB_HASH_BITS
73#define SIDTAB_HASH_BUCKETS (1 << SIDTAB_HASH_BITS)
70
71struct sidtab {
72 /*
73 * lock-free read access only for as many items as a prior read of
74 * 'count'
75 */
76 union sidtab_entry_inner roots[SIDTAB_MAX_LEVEL + 1];
77 /*
78 * access atomically via {READ|WRITE}_ONCE(); only increment under
79 * spinlock
80 */
81 u32 count;
82 /* access only under spinlock */
83 struct sidtab_convert_params *convert;
84 spinlock_t lock;
85
74
75struct sidtab {
76 /*
77 * lock-free read access only for as many items as a prior read of
78 * 'count'
79 */
80 union sidtab_entry_inner roots[SIDTAB_MAX_LEVEL + 1];
81 /*
82 * access atomically via {READ|WRITE}_ONCE(); only increment under
83 * spinlock
84 */
85 u32 count;
86 /* access only under spinlock */
87 struct sidtab_convert_params *convert;
88 spinlock_t lock;
89
86 /* reverse lookup cache - access atomically via {READ|WRITE}_ONCE() */
87 u32 rcache[SIDTAB_RCACHE_SIZE];
88
89 /* index == SID - 1 (no entry for SECSID_NULL) */
90 struct sidtab_isid_entry isids[SECINITSID_NUM];
90 /* index == SID - 1 (no entry for SECSID_NULL) */
91 struct sidtab_isid_entry isids[SECINITSID_NUM];
92
93 /* Hash table for fast reverse context-to-sid lookups. */
94 DECLARE_HASHTABLE(context_to_sid, SIDTAB_HASH_BITS);
91};
92
93int sidtab_init(struct sidtab *s);
94int sidtab_set_initial(struct sidtab *s, u32 sid, struct context *context);
95struct context *sidtab_search(struct sidtab *s, u32 sid);
96struct context *sidtab_search_force(struct sidtab *s, u32 sid);
97
98int sidtab_convert(struct sidtab *s, struct sidtab_convert_params *params);
99
100int sidtab_context_to_sid(struct sidtab *s, struct context *context, u32 *sid);
101
102void sidtab_destroy(struct sidtab *s);
103
95};
96
97int sidtab_init(struct sidtab *s);
98int sidtab_set_initial(struct sidtab *s, u32 sid, struct context *context);
99struct context *sidtab_search(struct sidtab *s, u32 sid);
100struct context *sidtab_search_force(struct sidtab *s, u32 sid);
101
102int sidtab_convert(struct sidtab *s, struct sidtab_convert_params *params);
103
104int sidtab_context_to_sid(struct sidtab *s, struct context *context, u32 *sid);
105
106void sidtab_destroy(struct sidtab *s);
107
108int sidtab_hash_stats(struct sidtab *sidtab, char *page);
109
104#endif /* _SS_SIDTAB_H_ */
105
106
110#endif /* _SS_SIDTAB_H_ */
111
112