1 /* SPDX-License-Identifier: GPL-2.0 */ 2 /* 3 * Access vector cache interface for object managers. 4 * 5 * Author : Stephen Smalley, <stephen.smalley.work@gmail.com> 6 */ 7 8 #ifndef _SELINUX_AVC_H_ 9 #define _SELINUX_AVC_H_ 10 11 #include <linux/stddef.h> 12 #include <linux/errno.h> 13 #include <linux/kernel.h> 14 #include <linux/kdev_t.h> 15 #include <linux/spinlock.h> 16 #include <linux/init.h> 17 #include <linux/audit.h> 18 #include <linux/lsm_audit.h> 19 #include <linux/in6.h> 20 #include "flask.h" 21 #include "av_permissions.h" 22 #include "security.h" 23 24 /* 25 * An entry in the AVC. 26 */ 27 struct avc_entry; 28 29 struct task_struct; 30 struct inode; 31 struct sock; 32 struct sk_buff; 33 34 /* 35 * AVC statistics 36 */ 37 struct avc_cache_stats { 38 unsigned int lookups; 39 unsigned int misses; 40 unsigned int allocations; 41 unsigned int reclaims; 42 unsigned int frees; 43 }; 44 45 /* 46 * We only need this data after we have decided to send an audit message. 47 */ 48 struct selinux_audit_data { 49 u32 ssid; 50 u32 tsid; 51 u16 tclass; 52 u32 requested; 53 u32 audited; 54 u32 denied; 55 int result; 56 } __randomize_layout; 57 58 /* 59 * AVC operations 60 */ 61 62 void __init avc_init(void); 63 64 static inline u32 avc_audit_required(u32 requested, 65 const struct av_decision *avd, int result, 66 u32 auditdeny, u32 *deniedp) 67 { 68 u32 denied, audited; 69 70 if (avd->flags & AVD_FLAGS_NEVERAUDIT) 71 return 0; 72 73 denied = requested & ~avd->allowed; 74 if (unlikely(denied)) { 75 audited = denied & avd->auditdeny; 76 /* 77 * auditdeny is TRICKY! Setting a bit in 78 * this field means that ANY denials should NOT be audited if 79 * the policy contains an explicit dontaudit rule for that 80 * permission. Take notice that this is unrelated to the 81 * actual permissions that were denied. As an example lets 82 * assume: 83 * 84 * denied == READ 85 * avd.auditdeny & ACCESS == 0 (not set means explicit rule) 86 * auditdeny & ACCESS == 1 87 * 88 * We will NOT audit the denial even though the denied 89 * permission was READ and the auditdeny checks were for 90 * ACCESS 91 */ 92 if (auditdeny && !(auditdeny & avd->auditdeny)) 93 audited = 0; 94 } else if (result) 95 audited = denied = requested; 96 else 97 audited = requested & avd->auditallow; 98 *deniedp = denied; 99 return audited; 100 } 101 102 int slow_avc_audit(u32 ssid, u32 tsid, u16 tclass, u32 requested, u32 audited, 103 u32 denied, int result, struct common_audit_data *a); 104 105 /** 106 * avc_audit - Audit the granting or denial of permissions. 107 * @ssid: source security identifier 108 * @tsid: target security identifier 109 * @tclass: target security class 110 * @requested: requested permissions 111 * @avd: access vector decisions 112 * @result: result from avc_has_perm_noaudit 113 * @a: auxiliary audit data 114 * 115 * Audit the granting or denial of permissions in accordance 116 * with the policy. This function is typically called by 117 * avc_has_perm() after a permission check, but can also be 118 * called directly by callers who use avc_has_perm_noaudit() 119 * in order to separate the permission check from the auditing. 120 * For example, this separation is useful when the permission check must 121 * be performed under a lock, to allow the lock to be released 122 * before calling the auditing code. 123 */ 124 static inline int avc_audit(u32 ssid, u32 tsid, u16 tclass, u32 requested, 125 const struct av_decision *avd, int result, 126 struct common_audit_data *a) 127 { 128 u32 audited, denied; 129 audited = avc_audit_required(requested, avd, result, 0, &denied); 130 if (likely(!audited)) 131 return 0; 132 return slow_avc_audit(ssid, tsid, tclass, requested, audited, denied, 133 result, a); 134 } 135 136 #define AVC_STRICT 1 /* Ignore permissive mode. */ 137 #define AVC_EXTENDED_PERMS 2 /* update extended permissions */ 138 int avc_has_perm_noaudit(u32 ssid, u32 tsid, u16 tclass, u32 requested, 139 unsigned int flags, struct av_decision *avd); 140 141 int avc_has_perm(u32 ssid, u32 tsid, u16 tclass, u32 requested, 142 struct common_audit_data *auditdata); 143 144 #define AVC_EXT_IOCTL (1 << 0) /* Cache entry for an ioctl extended permission */ 145 #define AVC_EXT_NLMSG (1 << 1) /* Cache entry for an nlmsg extended permission */ 146 int avc_has_extended_perms(u32 ssid, u32 tsid, u16 tclass, u32 requested, 147 u8 driver, u8 base_perm, u8 perm, 148 struct common_audit_data *ad); 149 150 u32 avc_policy_seqno(void); 151 152 #define AVC_CALLBACK_GRANT 1 153 #define AVC_CALLBACK_TRY_REVOKE 2 154 #define AVC_CALLBACK_REVOKE 4 155 #define AVC_CALLBACK_RESET 8 156 #define AVC_CALLBACK_AUDITALLOW_ENABLE 16 157 #define AVC_CALLBACK_AUDITALLOW_DISABLE 32 158 #define AVC_CALLBACK_AUDITDENY_ENABLE 64 159 #define AVC_CALLBACK_AUDITDENY_DISABLE 128 160 #define AVC_CALLBACK_ADD_XPERMS 256 161 162 int avc_add_callback(int (*callback)(u32 event), u32 events); 163 164 /* Exported to selinuxfs */ 165 int avc_get_hash_stats(char *page); 166 unsigned int avc_get_cache_threshold(void); 167 void avc_set_cache_threshold(unsigned int cache_threshold); 168 169 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS 170 DECLARE_PER_CPU(struct avc_cache_stats, avc_cache_stats); 171 #endif 172 173 #endif /* _SELINUX_AVC_H_ */ 174