2 * Implementation of the kernel access vector cache (AVC).
4 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
5 * James Morris <jmorris@redhat.com>
7 * Update: KaiGai, Kohei <kaigai@ak.jp.nec.com>
8 * Replaced the avc_lock spinlock by RCU.
10 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
12 * This program is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU General Public License version 2,
14 * as published by the Free Software Foundation.
16 #include <linux/types.h>
17 #include <linux/stddef.h>
18 #include <linux/kernel.h>
19 #include <linux/slab.h>
21 #include <linux/dcache.h>
22 #include <linux/init.h>
23 #include <linux/skbuff.h>
24 #include <linux/percpu.h>
25 #include <linux/list.h>
28 #include <net/af_unix.h>
30 #include <linux/audit.h>
31 #include <linux/ipv6.h>
37 #define AVC_CACHE_SLOTS 512
38 #define AVC_DEF_CACHE_THRESHOLD 512
39 #define AVC_CACHE_RECLAIM 16
41 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
42 #define avc_cache_stats_incr(field) this_cpu_inc(avc_cache_stats.field)
44 #define avc_cache_stats_incr(field) do {} while (0)
51 struct av_decision avd;
52 struct avc_xperms_node *xp_node;
57 struct hlist_node list; /* anchored in avc_cache->slots[i] */
58 struct rcu_head rhead;
61 struct avc_xperms_decision_node {
62 struct extended_perms_decision xpd;
63 struct list_head xpd_list; /* list of extended_perms_decision */
66 struct avc_xperms_node {
67 struct extended_perms xp;
68 struct list_head xpd_head; /* list head of extended_perms_decision */
72 struct hlist_head slots[AVC_CACHE_SLOTS]; /* head for avc_node->list */
73 spinlock_t slots_lock[AVC_CACHE_SLOTS]; /* lock for writes */
74 atomic_t lru_hint; /* LRU hint for reclaim scan */
75 atomic_t active_nodes;
76 u32 latest_notif; /* latest revocation notification */
79 struct avc_callback_node {
80 int (*callback) (u32 event);
82 struct avc_callback_node *next;
85 /* Exported via selinufs */
86 unsigned int avc_cache_threshold = AVC_DEF_CACHE_THRESHOLD;
88 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
89 DEFINE_PER_CPU(struct avc_cache_stats, avc_cache_stats) = { 0 };
92 static struct avc_cache avc_cache;
93 static struct avc_callback_node *avc_callbacks;
94 static struct kmem_cache *avc_node_cachep;
95 static struct kmem_cache *avc_xperms_data_cachep;
96 static struct kmem_cache *avc_xperms_decision_cachep;
97 static struct kmem_cache *avc_xperms_cachep;
99 static inline int avc_hash(u32 ssid, u32 tsid, u16 tclass)
101 return (ssid ^ (tsid<<2) ^ (tclass<<4)) & (AVC_CACHE_SLOTS - 1);
105 * avc_dump_av - Display an access vector in human-readable form.
106 * @tclass: target security class
109 static void avc_dump_av(struct audit_buffer *ab, u16 tclass, u32 av)
115 audit_log_format(ab, " null");
119 BUG_ON(!tclass || tclass >= ARRAY_SIZE(secclass_map));
120 perms = secclass_map[tclass-1].perms;
122 audit_log_format(ab, " {");
125 while (i < (sizeof(av) * 8)) {
126 if ((perm & av) && perms[i]) {
127 audit_log_format(ab, " %s", perms[i]);
135 audit_log_format(ab, " 0x%x", av);
137 audit_log_format(ab, " }");
141 * avc_dump_query - Display a SID pair and a class in human-readable form.
142 * @ssid: source security identifier
143 * @tsid: target security identifier
144 * @tclass: target security class
146 static void avc_dump_query(struct audit_buffer *ab, u32 ssid, u32 tsid, u16 tclass)
152 rc = security_sid_to_context(ssid, &scontext, &scontext_len);
154 audit_log_format(ab, "ssid=%d", ssid);
156 audit_log_format(ab, "scontext=%s", scontext);
160 rc = security_sid_to_context(tsid, &scontext, &scontext_len);
162 audit_log_format(ab, " tsid=%d", tsid);
164 audit_log_format(ab, " tcontext=%s", scontext);
168 BUG_ON(!tclass || tclass >= ARRAY_SIZE(secclass_map));
169 audit_log_format(ab, " tclass=%s", secclass_map[tclass-1].name);
173 * avc_init - Initialize the AVC.
175 * Initialize the access vector cache.
177 void __init avc_init(void)
181 for (i = 0; i < AVC_CACHE_SLOTS; i++) {
182 INIT_HLIST_HEAD(&avc_cache.slots[i]);
183 spin_lock_init(&avc_cache.slots_lock[i]);
185 atomic_set(&avc_cache.active_nodes, 0);
186 atomic_set(&avc_cache.lru_hint, 0);
188 avc_node_cachep = kmem_cache_create("avc_node", sizeof(struct avc_node),
189 0, SLAB_PANIC, NULL);
190 avc_xperms_cachep = kmem_cache_create("avc_xperms_node",
191 sizeof(struct avc_xperms_node),
192 0, SLAB_PANIC, NULL);
193 avc_xperms_decision_cachep = kmem_cache_create(
194 "avc_xperms_decision_node",
195 sizeof(struct avc_xperms_decision_node),
196 0, SLAB_PANIC, NULL);
197 avc_xperms_data_cachep = kmem_cache_create("avc_xperms_data",
198 sizeof(struct extended_perms_data),
199 0, SLAB_PANIC, NULL);
202 int avc_get_hash_stats(char *page)
204 int i, chain_len, max_chain_len, slots_used;
205 struct avc_node *node;
206 struct hlist_head *head;
212 for (i = 0; i < AVC_CACHE_SLOTS; i++) {
213 head = &avc_cache.slots[i];
214 if (!hlist_empty(head)) {
217 hlist_for_each_entry_rcu(node, head, list)
219 if (chain_len > max_chain_len)
220 max_chain_len = chain_len;
226 return scnprintf(page, PAGE_SIZE, "entries: %d\nbuckets used: %d/%d\n"
227 "longest chain: %d\n",
228 atomic_read(&avc_cache.active_nodes),
229 slots_used, AVC_CACHE_SLOTS, max_chain_len);
233 * using a linked list for extended_perms_decision lookup because the list is
234 * always small. i.e. less than 5, typically 1
236 static struct extended_perms_decision *avc_xperms_decision_lookup(u8 driver,
237 struct avc_xperms_node *xp_node)
239 struct avc_xperms_decision_node *xpd_node;
241 list_for_each_entry(xpd_node, &xp_node->xpd_head, xpd_list) {
242 if (xpd_node->xpd.driver == driver)
243 return &xpd_node->xpd;
248 static inline unsigned int
249 avc_xperms_has_perm(struct extended_perms_decision *xpd,
254 if ((which == XPERMS_ALLOWED) &&
255 (xpd->used & XPERMS_ALLOWED))
256 rc = security_xperm_test(xpd->allowed->p, perm);
257 else if ((which == XPERMS_AUDITALLOW) &&
258 (xpd->used & XPERMS_AUDITALLOW))
259 rc = security_xperm_test(xpd->auditallow->p, perm);
260 else if ((which == XPERMS_DONTAUDIT) &&
261 (xpd->used & XPERMS_DONTAUDIT))
262 rc = security_xperm_test(xpd->dontaudit->p, perm);
266 static void avc_xperms_allow_perm(struct avc_xperms_node *xp_node,
269 struct extended_perms_decision *xpd;
270 security_xperm_set(xp_node->xp.drivers.p, driver);
271 xpd = avc_xperms_decision_lookup(driver, xp_node);
272 if (xpd && xpd->allowed)
273 security_xperm_set(xpd->allowed->p, perm);
276 static void avc_xperms_decision_free(struct avc_xperms_decision_node *xpd_node)
278 struct extended_perms_decision *xpd;
280 xpd = &xpd_node->xpd;
282 kmem_cache_free(avc_xperms_data_cachep, xpd->allowed);
284 kmem_cache_free(avc_xperms_data_cachep, xpd->auditallow);
286 kmem_cache_free(avc_xperms_data_cachep, xpd->dontaudit);
287 kmem_cache_free(avc_xperms_decision_cachep, xpd_node);
290 static void avc_xperms_free(struct avc_xperms_node *xp_node)
292 struct avc_xperms_decision_node *xpd_node, *tmp;
297 list_for_each_entry_safe(xpd_node, tmp, &xp_node->xpd_head, xpd_list) {
298 list_del(&xpd_node->xpd_list);
299 avc_xperms_decision_free(xpd_node);
301 kmem_cache_free(avc_xperms_cachep, xp_node);
304 static void avc_copy_xperms_decision(struct extended_perms_decision *dest,
305 struct extended_perms_decision *src)
307 dest->driver = src->driver;
308 dest->used = src->used;
309 if (dest->used & XPERMS_ALLOWED)
310 memcpy(dest->allowed->p, src->allowed->p,
311 sizeof(src->allowed->p));
312 if (dest->used & XPERMS_AUDITALLOW)
313 memcpy(dest->auditallow->p, src->auditallow->p,
314 sizeof(src->auditallow->p));
315 if (dest->used & XPERMS_DONTAUDIT)
316 memcpy(dest->dontaudit->p, src->dontaudit->p,
317 sizeof(src->dontaudit->p));
321 * similar to avc_copy_xperms_decision, but only copy decision
322 * information relevant to this perm
324 static inline void avc_quick_copy_xperms_decision(u8 perm,
325 struct extended_perms_decision *dest,
326 struct extended_perms_decision *src)
329 * compute index of the u32 of the 256 bits (8 u32s) that contain this
334 dest->used = src->used;
335 if (dest->used & XPERMS_ALLOWED)
336 dest->allowed->p[i] = src->allowed->p[i];
337 if (dest->used & XPERMS_AUDITALLOW)
338 dest->auditallow->p[i] = src->auditallow->p[i];
339 if (dest->used & XPERMS_DONTAUDIT)
340 dest->dontaudit->p[i] = src->dontaudit->p[i];
343 static struct avc_xperms_decision_node
344 *avc_xperms_decision_alloc(u8 which)
346 struct avc_xperms_decision_node *xpd_node;
347 struct extended_perms_decision *xpd;
349 xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep,
350 GFP_NOWAIT | __GFP_NOWARN);
354 xpd = &xpd_node->xpd;
355 if (which & XPERMS_ALLOWED) {
356 xpd->allowed = kmem_cache_zalloc(avc_xperms_data_cachep,
357 GFP_NOWAIT | __GFP_NOWARN);
361 if (which & XPERMS_AUDITALLOW) {
362 xpd->auditallow = kmem_cache_zalloc(avc_xperms_data_cachep,
363 GFP_NOWAIT | __GFP_NOWARN);
364 if (!xpd->auditallow)
367 if (which & XPERMS_DONTAUDIT) {
368 xpd->dontaudit = kmem_cache_zalloc(avc_xperms_data_cachep,
369 GFP_NOWAIT | __GFP_NOWARN);
375 avc_xperms_decision_free(xpd_node);
379 static int avc_add_xperms_decision(struct avc_node *node,
380 struct extended_perms_decision *src)
382 struct avc_xperms_decision_node *dest_xpd;
384 node->ae.xp_node->xp.len++;
385 dest_xpd = avc_xperms_decision_alloc(src->used);
388 avc_copy_xperms_decision(&dest_xpd->xpd, src);
389 list_add(&dest_xpd->xpd_list, &node->ae.xp_node->xpd_head);
393 static struct avc_xperms_node *avc_xperms_alloc(void)
395 struct avc_xperms_node *xp_node;
397 xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT | __GFP_NOWARN);
400 INIT_LIST_HEAD(&xp_node->xpd_head);
404 static int avc_xperms_populate(struct avc_node *node,
405 struct avc_xperms_node *src)
407 struct avc_xperms_node *dest;
408 struct avc_xperms_decision_node *dest_xpd;
409 struct avc_xperms_decision_node *src_xpd;
411 if (src->xp.len == 0)
413 dest = avc_xperms_alloc();
417 memcpy(dest->xp.drivers.p, src->xp.drivers.p, sizeof(dest->xp.drivers.p));
418 dest->xp.len = src->xp.len;
420 /* for each source xpd allocate a destination xpd and copy */
421 list_for_each_entry(src_xpd, &src->xpd_head, xpd_list) {
422 dest_xpd = avc_xperms_decision_alloc(src_xpd->xpd.used);
425 avc_copy_xperms_decision(&dest_xpd->xpd, &src_xpd->xpd);
426 list_add(&dest_xpd->xpd_list, &dest->xpd_head);
428 node->ae.xp_node = dest;
431 avc_xperms_free(dest);
436 static inline u32 avc_xperms_audit_required(u32 requested,
437 struct av_decision *avd,
438 struct extended_perms_decision *xpd,
445 denied = requested & ~avd->allowed;
446 if (unlikely(denied)) {
447 audited = denied & avd->auditdeny;
448 if (audited && xpd) {
449 if (avc_xperms_has_perm(xpd, perm, XPERMS_DONTAUDIT))
450 audited &= ~requested;
453 audited = denied = requested;
455 audited = requested & avd->auditallow;
456 if (audited && xpd) {
457 if (!avc_xperms_has_perm(xpd, perm, XPERMS_AUDITALLOW))
458 audited &= ~requested;
466 static inline int avc_xperms_audit(u32 ssid, u32 tsid, u16 tclass,
467 u32 requested, struct av_decision *avd,
468 struct extended_perms_decision *xpd,
470 struct common_audit_data *ad)
474 audited = avc_xperms_audit_required(
475 requested, avd, xpd, perm, result, &denied);
476 if (likely(!audited))
478 return slow_avc_audit(ssid, tsid, tclass, requested,
479 audited, denied, result, ad, 0);
482 static void avc_node_free(struct rcu_head *rhead)
484 struct avc_node *node = container_of(rhead, struct avc_node, rhead);
485 avc_xperms_free(node->ae.xp_node);
486 kmem_cache_free(avc_node_cachep, node);
487 avc_cache_stats_incr(frees);
490 static void avc_node_delete(struct avc_node *node)
492 hlist_del_rcu(&node->list);
493 call_rcu(&node->rhead, avc_node_free);
494 atomic_dec(&avc_cache.active_nodes);
497 static void avc_node_kill(struct avc_node *node)
499 avc_xperms_free(node->ae.xp_node);
500 kmem_cache_free(avc_node_cachep, node);
501 avc_cache_stats_incr(frees);
502 atomic_dec(&avc_cache.active_nodes);
505 static void avc_node_replace(struct avc_node *new, struct avc_node *old)
507 hlist_replace_rcu(&old->list, &new->list);
508 call_rcu(&old->rhead, avc_node_free);
509 atomic_dec(&avc_cache.active_nodes);
512 static inline int avc_reclaim_node(void)
514 struct avc_node *node;
515 int hvalue, try, ecx;
517 struct hlist_head *head;
520 for (try = 0, ecx = 0; try < AVC_CACHE_SLOTS; try++) {
521 hvalue = atomic_inc_return(&avc_cache.lru_hint) & (AVC_CACHE_SLOTS - 1);
522 head = &avc_cache.slots[hvalue];
523 lock = &avc_cache.slots_lock[hvalue];
525 if (!spin_trylock_irqsave(lock, flags))
529 hlist_for_each_entry(node, head, list) {
530 avc_node_delete(node);
531 avc_cache_stats_incr(reclaims);
533 if (ecx >= AVC_CACHE_RECLAIM) {
535 spin_unlock_irqrestore(lock, flags);
540 spin_unlock_irqrestore(lock, flags);
546 static struct avc_node *avc_alloc_node(void)
548 struct avc_node *node;
550 node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT | __GFP_NOWARN);
554 INIT_HLIST_NODE(&node->list);
555 avc_cache_stats_incr(allocations);
557 if (atomic_inc_return(&avc_cache.active_nodes) > avc_cache_threshold)
564 static void avc_node_populate(struct avc_node *node, u32 ssid, u32 tsid, u16 tclass, struct av_decision *avd)
566 node->ae.ssid = ssid;
567 node->ae.tsid = tsid;
568 node->ae.tclass = tclass;
569 memcpy(&node->ae.avd, avd, sizeof(node->ae.avd));
572 static inline struct avc_node *avc_search_node(u32 ssid, u32 tsid, u16 tclass)
574 struct avc_node *node, *ret = NULL;
576 struct hlist_head *head;
578 hvalue = avc_hash(ssid, tsid, tclass);
579 head = &avc_cache.slots[hvalue];
580 hlist_for_each_entry_rcu(node, head, list) {
581 if (ssid == node->ae.ssid &&
582 tclass == node->ae.tclass &&
583 tsid == node->ae.tsid) {
593 * avc_lookup - Look up an AVC entry.
594 * @ssid: source security identifier
595 * @tsid: target security identifier
596 * @tclass: target security class
598 * Look up an AVC entry that is valid for the
599 * (@ssid, @tsid), interpreting the permissions
600 * based on @tclass. If a valid AVC entry exists,
601 * then this function returns the avc_node.
602 * Otherwise, this function returns NULL.
604 static struct avc_node *avc_lookup(u32 ssid, u32 tsid, u16 tclass)
606 struct avc_node *node;
608 avc_cache_stats_incr(lookups);
609 node = avc_search_node(ssid, tsid, tclass);
614 avc_cache_stats_incr(misses);
618 static int avc_latest_notif_update(int seqno, int is_insert)
621 static DEFINE_SPINLOCK(notif_lock);
624 spin_lock_irqsave(¬if_lock, flag);
626 if (seqno < avc_cache.latest_notif) {
627 printk(KERN_WARNING "SELinux: avc: seqno %d < latest_notif %d\n",
628 seqno, avc_cache.latest_notif);
632 if (seqno > avc_cache.latest_notif)
633 avc_cache.latest_notif = seqno;
635 spin_unlock_irqrestore(¬if_lock, flag);
641 * avc_insert - Insert an AVC entry.
642 * @ssid: source security identifier
643 * @tsid: target security identifier
644 * @tclass: target security class
645 * @avd: resulting av decision
646 * @xp_node: resulting extended permissions
648 * Insert an AVC entry for the SID pair
649 * (@ssid, @tsid) and class @tclass.
650 * The access vectors and the sequence number are
651 * normally provided by the security server in
652 * response to a security_compute_av() call. If the
653 * sequence number @avd->seqno is not less than the latest
654 * revocation notification, then the function copies
655 * the access vectors into a cache entry, returns
656 * avc_node inserted. Otherwise, this function returns NULL.
658 static struct avc_node *avc_insert(u32 ssid, u32 tsid, u16 tclass,
659 struct av_decision *avd,
660 struct avc_xperms_node *xp_node)
662 struct avc_node *pos, *node = NULL;
666 if (avc_latest_notif_update(avd->seqno, 1))
669 node = avc_alloc_node();
671 struct hlist_head *head;
675 hvalue = avc_hash(ssid, tsid, tclass);
676 avc_node_populate(node, ssid, tsid, tclass, avd);
677 rc = avc_xperms_populate(node, xp_node);
679 kmem_cache_free(avc_node_cachep, node);
682 head = &avc_cache.slots[hvalue];
683 lock = &avc_cache.slots_lock[hvalue];
685 spin_lock_irqsave(lock, flag);
686 hlist_for_each_entry(pos, head, list) {
687 if (pos->ae.ssid == ssid &&
688 pos->ae.tsid == tsid &&
689 pos->ae.tclass == tclass) {
690 avc_node_replace(node, pos);
694 hlist_add_head_rcu(&node->list, head);
696 spin_unlock_irqrestore(lock, flag);
703 * avc_audit_pre_callback - SELinux specific information
704 * will be called by generic audit code
705 * @ab: the audit buffer
708 static void avc_audit_pre_callback(struct audit_buffer *ab, void *a)
710 struct common_audit_data *ad = a;
711 audit_log_format(ab, "avc: %s ",
712 ad->selinux_audit_data->denied ? "denied" : "granted");
713 avc_dump_av(ab, ad->selinux_audit_data->tclass,
714 ad->selinux_audit_data->audited);
715 audit_log_format(ab, " for ");
719 * avc_audit_post_callback - SELinux specific information
720 * will be called by generic audit code
721 * @ab: the audit buffer
724 static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
726 struct common_audit_data *ad = a;
727 audit_log_format(ab, " ");
728 avc_dump_query(ab, ad->selinux_audit_data->ssid,
729 ad->selinux_audit_data->tsid,
730 ad->selinux_audit_data->tclass);
731 if (ad->selinux_audit_data->denied) {
732 audit_log_format(ab, " permissive=%u",
733 ad->selinux_audit_data->result ? 0 : 1);
737 /* This is the slow part of avc audit with big stack footprint */
738 noinline int slow_avc_audit(u32 ssid, u32 tsid, u16 tclass,
739 u32 requested, u32 audited, u32 denied, int result,
740 struct common_audit_data *a,
743 struct common_audit_data stack_data;
744 struct selinux_audit_data sad;
748 a->type = LSM_AUDIT_DATA_NONE;
752 * When in a RCU walk do the audit on the RCU retry. This is because
753 * the collection of the dname in an inode audit message is not RCU
754 * safe. Note this may drop some audits when the situation changes
755 * during retry. However this is logically just as if the operation
756 * happened a little later.
758 if ((a->type == LSM_AUDIT_DATA_INODE) &&
759 (flags & MAY_NOT_BLOCK))
763 sad.requested = requested;
766 sad.audited = audited;
770 a->selinux_audit_data = &sad;
772 common_lsm_audit(a, avc_audit_pre_callback, avc_audit_post_callback);
777 * avc_add_callback - Register a callback for security events.
778 * @callback: callback function
779 * @events: security events
781 * Register a callback function for events in the set @events.
782 * Returns %0 on success or -%ENOMEM if insufficient memory
783 * exists to add the callback.
785 int __init avc_add_callback(int (*callback)(u32 event), u32 events)
787 struct avc_callback_node *c;
790 c = kmalloc(sizeof(*c), GFP_KERNEL);
796 c->callback = callback;
798 c->next = avc_callbacks;
805 * avc_update_node Update an AVC entry
806 * @event : Updating event
807 * @perms : Permission mask bits
808 * @ssid,@tsid,@tclass : identifier of an AVC entry
809 * @seqno : sequence number when decision was made
810 * @xpd: extended_perms_decision to be added to the node
812 * if a valid AVC entry doesn't exist,this function returns -ENOENT.
813 * if kmalloc() called internal returns NULL, this function returns -ENOMEM.
814 * otherwise, this function updates the AVC entry. The original AVC-entry object
815 * will release later by RCU.
817 static int avc_update_node(u32 event, u32 perms, u8 driver, u8 xperm, u32 ssid,
818 u32 tsid, u16 tclass, u32 seqno,
819 struct extended_perms_decision *xpd,
824 struct avc_node *pos, *node, *orig = NULL;
825 struct hlist_head *head;
828 node = avc_alloc_node();
834 /* Lock the target slot */
835 hvalue = avc_hash(ssid, tsid, tclass);
837 head = &avc_cache.slots[hvalue];
838 lock = &avc_cache.slots_lock[hvalue];
840 spin_lock_irqsave(lock, flag);
842 hlist_for_each_entry(pos, head, list) {
843 if (ssid == pos->ae.ssid &&
844 tsid == pos->ae.tsid &&
845 tclass == pos->ae.tclass &&
846 seqno == pos->ae.avd.seqno){
859 * Copy and replace original node.
862 avc_node_populate(node, ssid, tsid, tclass, &orig->ae.avd);
864 if (orig->ae.xp_node) {
865 rc = avc_xperms_populate(node, orig->ae.xp_node);
873 case AVC_CALLBACK_GRANT:
874 node->ae.avd.allowed |= perms;
875 if (node->ae.xp_node && (flags & AVC_EXTENDED_PERMS))
876 avc_xperms_allow_perm(node->ae.xp_node, driver, xperm);
878 case AVC_CALLBACK_TRY_REVOKE:
879 case AVC_CALLBACK_REVOKE:
880 node->ae.avd.allowed &= ~perms;
882 case AVC_CALLBACK_AUDITALLOW_ENABLE:
883 node->ae.avd.auditallow |= perms;
885 case AVC_CALLBACK_AUDITALLOW_DISABLE:
886 node->ae.avd.auditallow &= ~perms;
888 case AVC_CALLBACK_AUDITDENY_ENABLE:
889 node->ae.avd.auditdeny |= perms;
891 case AVC_CALLBACK_AUDITDENY_DISABLE:
892 node->ae.avd.auditdeny &= ~perms;
894 case AVC_CALLBACK_ADD_XPERMS:
895 avc_add_xperms_decision(node, xpd);
898 avc_node_replace(node, orig);
900 spin_unlock_irqrestore(lock, flag);
906 * avc_flush - Flush the cache
908 static void avc_flush(void)
910 struct hlist_head *head;
911 struct avc_node *node;
916 for (i = 0; i < AVC_CACHE_SLOTS; i++) {
917 head = &avc_cache.slots[i];
918 lock = &avc_cache.slots_lock[i];
920 spin_lock_irqsave(lock, flag);
922 * With preemptable RCU, the outer spinlock does not
923 * prevent RCU grace periods from ending.
926 hlist_for_each_entry(node, head, list)
927 avc_node_delete(node);
929 spin_unlock_irqrestore(lock, flag);
934 * avc_ss_reset - Flush the cache and revalidate migrated permissions.
935 * @seqno: policy sequence number
937 int avc_ss_reset(u32 seqno)
939 struct avc_callback_node *c;
944 for (c = avc_callbacks; c; c = c->next) {
945 if (c->events & AVC_CALLBACK_RESET) {
946 tmprc = c->callback(AVC_CALLBACK_RESET);
947 /* save the first error encountered for the return
948 value and continue processing the callbacks */
954 avc_latest_notif_update(seqno, 0);
959 * Slow-path helper function for avc_has_perm_noaudit,
960 * when the avc_node lookup fails. We get called with
961 * the RCU read lock held, and need to return with it
962 * still held, but drop if for the security compute.
964 * Don't inline this, since it's the slow-path and just
965 * results in a bigger stack frame.
967 static noinline struct avc_node *avc_compute_av(u32 ssid, u32 tsid,
968 u16 tclass, struct av_decision *avd,
969 struct avc_xperms_node *xp_node)
972 INIT_LIST_HEAD(&xp_node->xpd_head);
973 security_compute_av(ssid, tsid, tclass, avd, &xp_node->xp);
975 return avc_insert(ssid, tsid, tclass, avd, xp_node);
978 static noinline int avc_denied(u32 ssid, u32 tsid,
979 u16 tclass, u32 requested,
980 u8 driver, u8 xperm, unsigned flags,
981 struct av_decision *avd)
983 if (flags & AVC_STRICT)
986 if (selinux_enforcing && !(avd->flags & AVD_FLAGS_PERMISSIVE))
989 avc_update_node(AVC_CALLBACK_GRANT, requested, driver, xperm, ssid,
990 tsid, tclass, avd->seqno, NULL, flags);
995 * The avc extended permissions logic adds an additional 256 bits of
996 * permissions to an avc node when extended permissions for that node are
997 * specified in the avtab. If the additional 256 permissions is not adequate,
998 * as-is the case with ioctls, then multiple may be chained together and the
999 * driver field is used to specify which set contains the permission.
1001 int avc_has_extended_perms(u32 ssid, u32 tsid, u16 tclass, u32 requested,
1002 u8 driver, u8 xperm, struct common_audit_data *ad)
1004 struct avc_node *node;
1005 struct av_decision avd;
1007 struct extended_perms_decision local_xpd;
1008 struct extended_perms_decision *xpd = NULL;
1009 struct extended_perms_data allowed;
1010 struct extended_perms_data auditallow;
1011 struct extended_perms_data dontaudit;
1012 struct avc_xperms_node local_xp_node;
1013 struct avc_xperms_node *xp_node;
1016 xp_node = &local_xp_node;
1021 node = avc_lookup(ssid, tsid, tclass);
1022 if (unlikely(!node)) {
1023 node = avc_compute_av(ssid, tsid, tclass, &avd, xp_node);
1025 memcpy(&avd, &node->ae.avd, sizeof(avd));
1026 xp_node = node->ae.xp_node;
1028 /* if extended permissions are not defined, only consider av_decision */
1029 if (!xp_node || !xp_node->xp.len)
1032 local_xpd.allowed = &allowed;
1033 local_xpd.auditallow = &auditallow;
1034 local_xpd.dontaudit = &dontaudit;
1036 xpd = avc_xperms_decision_lookup(driver, xp_node);
1037 if (unlikely(!xpd)) {
1039 * Compute the extended_perms_decision only if the driver
1042 if (!security_xperm_test(xp_node->xp.drivers.p, driver)) {
1043 avd.allowed &= ~requested;
1047 security_compute_xperms_decision(ssid, tsid, tclass, driver,
1050 avc_update_node(AVC_CALLBACK_ADD_XPERMS, requested, driver, xperm,
1051 ssid, tsid, tclass, avd.seqno, &local_xpd, 0);
1053 avc_quick_copy_xperms_decision(xperm, &local_xpd, xpd);
1057 if (!avc_xperms_has_perm(xpd, xperm, XPERMS_ALLOWED))
1058 avd.allowed &= ~requested;
1061 denied = requested & ~(avd.allowed);
1062 if (unlikely(denied))
1063 rc = avc_denied(ssid, tsid, tclass, requested, driver, xperm,
1064 AVC_EXTENDED_PERMS, &avd);
1068 rc2 = avc_xperms_audit(ssid, tsid, tclass, requested,
1069 &avd, xpd, xperm, rc, ad);
1076 * avc_has_perm_noaudit - Check permissions but perform no auditing.
1077 * @ssid: source security identifier
1078 * @tsid: target security identifier
1079 * @tclass: target security class
1080 * @requested: requested permissions, interpreted based on @tclass
1081 * @flags: AVC_STRICT or 0
1082 * @avd: access vector decisions
1084 * Check the AVC to determine whether the @requested permissions are granted
1085 * for the SID pair (@ssid, @tsid), interpreting the permissions
1086 * based on @tclass, and call the security server on a cache miss to obtain
1087 * a new decision and add it to the cache. Return a copy of the decisions
1088 * in @avd. Return %0 if all @requested permissions are granted,
1089 * -%EACCES if any permissions are denied, or another -errno upon
1090 * other errors. This function is typically called by avc_has_perm(),
1091 * but may also be called directly to separate permission checking from
1092 * auditing, e.g. in cases where a lock must be held for the check but
1093 * should be released for the auditing.
1095 inline int avc_has_perm_noaudit(u32 ssid, u32 tsid,
1096 u16 tclass, u32 requested,
1098 struct av_decision *avd)
1100 struct avc_node *node;
1101 struct avc_xperms_node xp_node;
1109 node = avc_lookup(ssid, tsid, tclass);
1110 if (unlikely(!node))
1111 node = avc_compute_av(ssid, tsid, tclass, avd, &xp_node);
1113 memcpy(avd, &node->ae.avd, sizeof(*avd));
1115 denied = requested & ~(avd->allowed);
1116 if (unlikely(denied))
1117 rc = avc_denied(ssid, tsid, tclass, requested, 0, 0, flags, avd);
1124 * avc_has_perm - Check permissions and perform any appropriate auditing.
1125 * @ssid: source security identifier
1126 * @tsid: target security identifier
1127 * @tclass: target security class
1128 * @requested: requested permissions, interpreted based on @tclass
1129 * @auditdata: auxiliary audit data
1131 * Check the AVC to determine whether the @requested permissions are granted
1132 * for the SID pair (@ssid, @tsid), interpreting the permissions
1133 * based on @tclass, and call the security server on a cache miss to obtain
1134 * a new decision and add it to the cache. Audit the granting or denial of
1135 * permissions in accordance with the policy. Return %0 if all @requested
1136 * permissions are granted, -%EACCES if any permissions are denied, or
1137 * another -errno upon other errors.
1139 int avc_has_perm(u32 ssid, u32 tsid, u16 tclass,
1140 u32 requested, struct common_audit_data *auditdata)
1142 struct av_decision avd;
1145 rc = avc_has_perm_noaudit(ssid, tsid, tclass, requested, 0, &avd);
1147 rc2 = avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata, 0);
1153 int avc_has_perm_flags(u32 ssid, u32 tsid, u16 tclass,
1154 u32 requested, struct common_audit_data *auditdata,
1157 struct av_decision avd;
1160 rc = avc_has_perm_noaudit(ssid, tsid, tclass, requested, 0, &avd);
1162 rc2 = avc_audit(ssid, tsid, tclass, requested, &avd, rc,
1169 u32 avc_policy_seqno(void)
1171 return avc_cache.latest_notif;
1174 void avc_disable(void)
1177 * If you are looking at this because you have realized that we are
1178 * not destroying the avc_node_cachep it might be easy to fix, but
1179 * I don't know the memory barrier semantics well enough to know. It's
1180 * possible that some other task dereferenced security_ops when
1181 * it still pointed to selinux operations. If that is the case it's
1182 * possible that it is about to use the avc and is about to need the
1183 * avc_node_cachep. I know I could wrap the security.c security_ops call
1184 * in an rcu_lock, but seriously, it's not worth it. Instead I just flush
1185 * the cache and get that memory back.
1187 if (avc_node_cachep) {
1189 /* kmem_cache_destroy(avc_node_cachep); */