Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* |
2 | * Implementation of the kernel access vector cache (AVC). | |
3 | * | |
4 | * Authors: Stephen Smalley, <sds@epoch.ncsc.mil> | |
95fff33b | 5 | * James Morris <jmorris@redhat.com> |
1da177e4 LT |
6 | * |
7 | * Update: KaiGai, Kohei <kaigai@ak.jp.nec.com> | |
95fff33b | 8 | * Replaced the avc_lock spinlock by RCU. |
1da177e4 LT |
9 | * |
10 | * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> | |
11 | * | |
12 | * This program is free software; you can redistribute it and/or modify | |
13 | * it under the terms of the GNU General Public License version 2, | |
95fff33b | 14 | * as published by the Free Software Foundation. |
1da177e4 LT |
15 | */ |
16 | #include <linux/types.h> | |
17 | #include <linux/stddef.h> | |
18 | #include <linux/kernel.h> | |
19 | #include <linux/slab.h> | |
20 | #include <linux/fs.h> | |
21 | #include <linux/dcache.h> | |
22 | #include <linux/init.h> | |
23 | #include <linux/skbuff.h> | |
24 | #include <linux/percpu.h> | |
25 | #include <net/sock.h> | |
26 | #include <linux/un.h> | |
27 | #include <net/af_unix.h> | |
28 | #include <linux/ip.h> | |
29 | #include <linux/audit.h> | |
30 | #include <linux/ipv6.h> | |
31 | #include <net/ipv6.h> | |
32 | #include "avc.h" | |
33 | #include "avc_ss.h" | |
c6d3aaa4 | 34 | #include "classmap.h" |
5c458998 | 35 | |
1da177e4 LT |
36 | #define AVC_CACHE_SLOTS 512 |
37 | #define AVC_DEF_CACHE_THRESHOLD 512 | |
38 | #define AVC_CACHE_RECLAIM 16 | |
39 | ||
40 | #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS | |
044aea9b | 41 | #define avc_cache_stats_incr(field) this_cpu_inc(avc_cache_stats.field) |
1da177e4 LT |
42 | #else |
43 | #define avc_cache_stats_incr(field) do {} while (0) | |
44 | #endif | |
45 | ||
46 | struct avc_entry { | |
47 | u32 ssid; | |
48 | u32 tsid; | |
49 | u16 tclass; | |
50 | struct av_decision avd; | |
1da177e4 LT |
51 | }; |
52 | ||
53 | struct avc_node { | |
54 | struct avc_entry ae; | |
26036651 | 55 | struct hlist_node list; /* anchored in avc_cache->slots[i] */ |
95fff33b | 56 | struct rcu_head rhead; |
1da177e4 LT |
57 | }; |
58 | ||
59 | struct avc_cache { | |
26036651 | 60 | struct hlist_head slots[AVC_CACHE_SLOTS]; /* head for avc_node->list */ |
1da177e4 LT |
61 | spinlock_t slots_lock[AVC_CACHE_SLOTS]; /* lock for writes */ |
62 | atomic_t lru_hint; /* LRU hint for reclaim scan */ | |
63 | atomic_t active_nodes; | |
64 | u32 latest_notif; /* latest revocation notification */ | |
65 | }; | |
66 | ||
67 | struct avc_callback_node { | |
562c99f2 | 68 | int (*callback) (u32 event); |
1da177e4 | 69 | u32 events; |
1da177e4 LT |
70 | struct avc_callback_node *next; |
71 | }; | |
72 | ||
73 | /* Exported via selinufs */ | |
74 | unsigned int avc_cache_threshold = AVC_DEF_CACHE_THRESHOLD; | |
75 | ||
76 | #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS | |
77 | DEFINE_PER_CPU(struct avc_cache_stats, avc_cache_stats) = { 0 }; | |
78 | #endif | |
79 | ||
80 | static struct avc_cache avc_cache; | |
81 | static struct avc_callback_node *avc_callbacks; | |
e18b890b | 82 | static struct kmem_cache *avc_node_cachep; |
1da177e4 LT |
83 | |
84 | static inline int avc_hash(u32 ssid, u32 tsid, u16 tclass) | |
85 | { | |
86 | return (ssid ^ (tsid<<2) ^ (tclass<<4)) & (AVC_CACHE_SLOTS - 1); | |
87 | } | |
88 | ||
89 | /** | |
90 | * avc_dump_av - Display an access vector in human-readable form. | |
91 | * @tclass: target security class | |
92 | * @av: access vector | |
93 | */ | |
44c2d9bd | 94 | static void avc_dump_av(struct audit_buffer *ab, u16 tclass, u32 av) |
1da177e4 | 95 | { |
c6d3aaa4 SS |
96 | const char **perms; |
97 | int i, perm; | |
1da177e4 LT |
98 | |
99 | if (av == 0) { | |
100 | audit_log_format(ab, " null"); | |
101 | return; | |
102 | } | |
103 | ||
c6d3aaa4 | 104 | perms = secclass_map[tclass-1].perms; |
1da177e4 LT |
105 | |
106 | audit_log_format(ab, " {"); | |
107 | i = 0; | |
108 | perm = 1; | |
c6d3aaa4 | 109 | while (i < (sizeof(av) * 8)) { |
0bce9527 | 110 | if ((perm & av) && perms[i]) { |
c6d3aaa4 | 111 | audit_log_format(ab, " %s", perms[i]); |
1da177e4 LT |
112 | av &= ~perm; |
113 | } | |
114 | i++; | |
115 | perm <<= 1; | |
116 | } | |
117 | ||
1da177e4 LT |
118 | if (av) |
119 | audit_log_format(ab, " 0x%x", av); | |
120 | ||
121 | audit_log_format(ab, " }"); | |
122 | } | |
123 | ||
124 | /** | |
125 | * avc_dump_query - Display a SID pair and a class in human-readable form. | |
126 | * @ssid: source security identifier | |
127 | * @tsid: target security identifier | |
128 | * @tclass: target security class | |
129 | */ | |
130 | static void avc_dump_query(struct audit_buffer *ab, u32 ssid, u32 tsid, u16 tclass) | |
131 | { | |
132 | int rc; | |
133 | char *scontext; | |
134 | u32 scontext_len; | |
135 | ||
95fff33b | 136 | rc = security_sid_to_context(ssid, &scontext, &scontext_len); |
1da177e4 LT |
137 | if (rc) |
138 | audit_log_format(ab, "ssid=%d", ssid); | |
139 | else { | |
140 | audit_log_format(ab, "scontext=%s", scontext); | |
141 | kfree(scontext); | |
142 | } | |
143 | ||
144 | rc = security_sid_to_context(tsid, &scontext, &scontext_len); | |
145 | if (rc) | |
146 | audit_log_format(ab, " tsid=%d", tsid); | |
147 | else { | |
148 | audit_log_format(ab, " tcontext=%s", scontext); | |
149 | kfree(scontext); | |
150 | } | |
a764ae4b | 151 | |
c6d3aaa4 SS |
152 | BUG_ON(tclass >= ARRAY_SIZE(secclass_map)); |
153 | audit_log_format(ab, " tclass=%s", secclass_map[tclass-1].name); | |
1da177e4 LT |
154 | } |
155 | ||
156 | /** | |
157 | * avc_init - Initialize the AVC. | |
158 | * | |
159 | * Initialize the access vector cache. | |
160 | */ | |
161 | void __init avc_init(void) | |
162 | { | |
163 | int i; | |
164 | ||
165 | for (i = 0; i < AVC_CACHE_SLOTS; i++) { | |
26036651 | 166 | INIT_HLIST_HEAD(&avc_cache.slots[i]); |
1da177e4 LT |
167 | spin_lock_init(&avc_cache.slots_lock[i]); |
168 | } | |
169 | atomic_set(&avc_cache.active_nodes, 0); | |
170 | atomic_set(&avc_cache.lru_hint, 0); | |
171 | ||
172 | avc_node_cachep = kmem_cache_create("avc_node", sizeof(struct avc_node), | |
20c2df83 | 173 | 0, SLAB_PANIC, NULL); |
1da177e4 | 174 | |
9ad9ad38 | 175 | audit_log(current->audit_context, GFP_KERNEL, AUDIT_KERNEL, "AVC INITIALIZED\n"); |
1da177e4 LT |
176 | } |
177 | ||
178 | int avc_get_hash_stats(char *page) | |
179 | { | |
180 | int i, chain_len, max_chain_len, slots_used; | |
181 | struct avc_node *node; | |
26036651 | 182 | struct hlist_head *head; |
1da177e4 LT |
183 | |
184 | rcu_read_lock(); | |
185 | ||
186 | slots_used = 0; | |
187 | max_chain_len = 0; | |
188 | for (i = 0; i < AVC_CACHE_SLOTS; i++) { | |
edf3d1ae | 189 | head = &avc_cache.slots[i]; |
26036651 EP |
190 | if (!hlist_empty(head)) { |
191 | struct hlist_node *next; | |
192 | ||
1da177e4 LT |
193 | slots_used++; |
194 | chain_len = 0; | |
26036651 | 195 | hlist_for_each_entry_rcu(node, next, head, list) |
1da177e4 LT |
196 | chain_len++; |
197 | if (chain_len > max_chain_len) | |
198 | max_chain_len = chain_len; | |
199 | } | |
200 | } | |
201 | ||
202 | rcu_read_unlock(); | |
203 | ||
204 | return scnprintf(page, PAGE_SIZE, "entries: %d\nbuckets used: %d/%d\n" | |
205 | "longest chain: %d\n", | |
206 | atomic_read(&avc_cache.active_nodes), | |
207 | slots_used, AVC_CACHE_SLOTS, max_chain_len); | |
208 | } | |
209 | ||
210 | static void avc_node_free(struct rcu_head *rhead) | |
211 | { | |
212 | struct avc_node *node = container_of(rhead, struct avc_node, rhead); | |
213 | kmem_cache_free(avc_node_cachep, node); | |
214 | avc_cache_stats_incr(frees); | |
215 | } | |
216 | ||
217 | static void avc_node_delete(struct avc_node *node) | |
218 | { | |
26036651 | 219 | hlist_del_rcu(&node->list); |
1da177e4 LT |
220 | call_rcu(&node->rhead, avc_node_free); |
221 | atomic_dec(&avc_cache.active_nodes); | |
222 | } | |
223 | ||
224 | static void avc_node_kill(struct avc_node *node) | |
225 | { | |
226 | kmem_cache_free(avc_node_cachep, node); | |
227 | avc_cache_stats_incr(frees); | |
228 | atomic_dec(&avc_cache.active_nodes); | |
229 | } | |
230 | ||
231 | static void avc_node_replace(struct avc_node *new, struct avc_node *old) | |
232 | { | |
26036651 | 233 | hlist_replace_rcu(&old->list, &new->list); |
1da177e4 LT |
234 | call_rcu(&old->rhead, avc_node_free); |
235 | atomic_dec(&avc_cache.active_nodes); | |
236 | } | |
237 | ||
238 | static inline int avc_reclaim_node(void) | |
239 | { | |
240 | struct avc_node *node; | |
241 | int hvalue, try, ecx; | |
242 | unsigned long flags; | |
26036651 EP |
243 | struct hlist_head *head; |
244 | struct hlist_node *next; | |
edf3d1ae | 245 | spinlock_t *lock; |
1da177e4 | 246 | |
95fff33b | 247 | for (try = 0, ecx = 0; try < AVC_CACHE_SLOTS; try++) { |
1da177e4 | 248 | hvalue = atomic_inc_return(&avc_cache.lru_hint) & (AVC_CACHE_SLOTS - 1); |
edf3d1ae EP |
249 | head = &avc_cache.slots[hvalue]; |
250 | lock = &avc_cache.slots_lock[hvalue]; | |
1da177e4 | 251 | |
edf3d1ae | 252 | if (!spin_trylock_irqsave(lock, flags)) |
1da177e4 LT |
253 | continue; |
254 | ||
61844250 | 255 | rcu_read_lock(); |
26036651 | 256 | hlist_for_each_entry(node, next, head, list) { |
906d27d9 EP |
257 | avc_node_delete(node); |
258 | avc_cache_stats_incr(reclaims); | |
259 | ecx++; | |
260 | if (ecx >= AVC_CACHE_RECLAIM) { | |
261 | rcu_read_unlock(); | |
edf3d1ae | 262 | spin_unlock_irqrestore(lock, flags); |
906d27d9 | 263 | goto out; |
1da177e4 LT |
264 | } |
265 | } | |
61844250 | 266 | rcu_read_unlock(); |
edf3d1ae | 267 | spin_unlock_irqrestore(lock, flags); |
1da177e4 LT |
268 | } |
269 | out: | |
270 | return ecx; | |
271 | } | |
272 | ||
273 | static struct avc_node *avc_alloc_node(void) | |
274 | { | |
275 | struct avc_node *node; | |
276 | ||
6290c2c4 | 277 | node = kmem_cache_zalloc(avc_node_cachep, GFP_ATOMIC|__GFP_NOMEMALLOC); |
1da177e4 LT |
278 | if (!node) |
279 | goto out; | |
280 | ||
26036651 | 281 | INIT_HLIST_NODE(&node->list); |
1da177e4 LT |
282 | avc_cache_stats_incr(allocations); |
283 | ||
284 | if (atomic_inc_return(&avc_cache.active_nodes) > avc_cache_threshold) | |
285 | avc_reclaim_node(); | |
286 | ||
287 | out: | |
288 | return node; | |
289 | } | |
290 | ||
21193dcd | 291 | static void avc_node_populate(struct avc_node *node, u32 ssid, u32 tsid, u16 tclass, struct av_decision *avd) |
1da177e4 LT |
292 | { |
293 | node->ae.ssid = ssid; | |
294 | node->ae.tsid = tsid; | |
295 | node->ae.tclass = tclass; | |
21193dcd | 296 | memcpy(&node->ae.avd, avd, sizeof(node->ae.avd)); |
1da177e4 LT |
297 | } |
298 | ||
299 | static inline struct avc_node *avc_search_node(u32 ssid, u32 tsid, u16 tclass) | |
300 | { | |
301 | struct avc_node *node, *ret = NULL; | |
302 | int hvalue; | |
26036651 EP |
303 | struct hlist_head *head; |
304 | struct hlist_node *next; | |
1da177e4 LT |
305 | |
306 | hvalue = avc_hash(ssid, tsid, tclass); | |
edf3d1ae | 307 | head = &avc_cache.slots[hvalue]; |
26036651 | 308 | hlist_for_each_entry_rcu(node, next, head, list) { |
1da177e4 LT |
309 | if (ssid == node->ae.ssid && |
310 | tclass == node->ae.tclass && | |
311 | tsid == node->ae.tsid) { | |
312 | ret = node; | |
313 | break; | |
314 | } | |
315 | } | |
316 | ||
1da177e4 LT |
317 | return ret; |
318 | } | |
319 | ||
320 | /** | |
321 | * avc_lookup - Look up an AVC entry. | |
322 | * @ssid: source security identifier | |
323 | * @tsid: target security identifier | |
324 | * @tclass: target security class | |
1da177e4 LT |
325 | * |
326 | * Look up an AVC entry that is valid for the | |
1da177e4 LT |
327 | * (@ssid, @tsid), interpreting the permissions |
328 | * based on @tclass. If a valid AVC entry exists, | |
6382dc33 | 329 | * then this function returns the avc_node. |
1da177e4 LT |
330 | * Otherwise, this function returns NULL. |
331 | */ | |
f1c6381a | 332 | static struct avc_node *avc_lookup(u32 ssid, u32 tsid, u16 tclass) |
1da177e4 LT |
333 | { |
334 | struct avc_node *node; | |
335 | ||
336 | avc_cache_stats_incr(lookups); | |
337 | node = avc_search_node(ssid, tsid, tclass); | |
338 | ||
f1c6381a | 339 | if (node) |
257313b2 | 340 | return node; |
1da177e4 | 341 | |
257313b2 LT |
342 | avc_cache_stats_incr(misses); |
343 | return NULL; | |
1da177e4 LT |
344 | } |
345 | ||
346 | static int avc_latest_notif_update(int seqno, int is_insert) | |
347 | { | |
348 | int ret = 0; | |
349 | static DEFINE_SPINLOCK(notif_lock); | |
350 | unsigned long flag; | |
351 | ||
352 | spin_lock_irqsave(¬if_lock, flag); | |
353 | if (is_insert) { | |
354 | if (seqno < avc_cache.latest_notif) { | |
744ba35e | 355 | printk(KERN_WARNING "SELinux: avc: seqno %d < latest_notif %d\n", |
1da177e4 LT |
356 | seqno, avc_cache.latest_notif); |
357 | ret = -EAGAIN; | |
358 | } | |
359 | } else { | |
360 | if (seqno > avc_cache.latest_notif) | |
361 | avc_cache.latest_notif = seqno; | |
362 | } | |
363 | spin_unlock_irqrestore(¬if_lock, flag); | |
364 | ||
365 | return ret; | |
366 | } | |
367 | ||
368 | /** | |
369 | * avc_insert - Insert an AVC entry. | |
370 | * @ssid: source security identifier | |
371 | * @tsid: target security identifier | |
372 | * @tclass: target security class | |
21193dcd | 373 | * @avd: resulting av decision |
1da177e4 LT |
374 | * |
375 | * Insert an AVC entry for the SID pair | |
376 | * (@ssid, @tsid) and class @tclass. | |
377 | * The access vectors and the sequence number are | |
378 | * normally provided by the security server in | |
379 | * response to a security_compute_av() call. If the | |
21193dcd | 380 | * sequence number @avd->seqno is not less than the latest |
1da177e4 LT |
381 | * revocation notification, then the function copies |
382 | * the access vectors into a cache entry, returns | |
383 | * avc_node inserted. Otherwise, this function returns NULL. | |
384 | */ | |
21193dcd | 385 | static struct avc_node *avc_insert(u32 ssid, u32 tsid, u16 tclass, struct av_decision *avd) |
1da177e4 LT |
386 | { |
387 | struct avc_node *pos, *node = NULL; | |
388 | int hvalue; | |
389 | unsigned long flag; | |
390 | ||
21193dcd | 391 | if (avc_latest_notif_update(avd->seqno, 1)) |
1da177e4 LT |
392 | goto out; |
393 | ||
394 | node = avc_alloc_node(); | |
395 | if (node) { | |
26036651 EP |
396 | struct hlist_head *head; |
397 | struct hlist_node *next; | |
edf3d1ae EP |
398 | spinlock_t *lock; |
399 | ||
1da177e4 | 400 | hvalue = avc_hash(ssid, tsid, tclass); |
21193dcd | 401 | avc_node_populate(node, ssid, tsid, tclass, avd); |
1da177e4 | 402 | |
edf3d1ae EP |
403 | head = &avc_cache.slots[hvalue]; |
404 | lock = &avc_cache.slots_lock[hvalue]; | |
405 | ||
406 | spin_lock_irqsave(lock, flag); | |
26036651 | 407 | hlist_for_each_entry(pos, next, head, list) { |
1da177e4 LT |
408 | if (pos->ae.ssid == ssid && |
409 | pos->ae.tsid == tsid && | |
410 | pos->ae.tclass == tclass) { | |
95fff33b | 411 | avc_node_replace(node, pos); |
1da177e4 LT |
412 | goto found; |
413 | } | |
414 | } | |
26036651 | 415 | hlist_add_head_rcu(&node->list, head); |
1da177e4 | 416 | found: |
edf3d1ae | 417 | spin_unlock_irqrestore(lock, flag); |
1da177e4 LT |
418 | } |
419 | out: | |
420 | return node; | |
421 | } | |
422 | ||
2bf49690 TL |
423 | /** |
424 | * avc_audit_pre_callback - SELinux specific information | |
425 | * will be called by generic audit code | |
426 | * @ab: the audit buffer | |
427 | * @a: audit_data | |
428 | */ | |
429 | static void avc_audit_pre_callback(struct audit_buffer *ab, void *a) | |
1da177e4 | 430 | { |
2bf49690 TL |
431 | struct common_audit_data *ad = a; |
432 | audit_log_format(ab, "avc: %s ", | |
899838b2 EP |
433 | ad->selinux_audit_data->denied ? "denied" : "granted"); |
434 | avc_dump_av(ab, ad->selinux_audit_data->tclass, | |
435 | ad->selinux_audit_data->audited); | |
2bf49690 | 436 | audit_log_format(ab, " for "); |
1da177e4 LT |
437 | } |
438 | ||
2bf49690 TL |
439 | /** |
440 | * avc_audit_post_callback - SELinux specific information | |
441 | * will be called by generic audit code | |
442 | * @ab: the audit buffer | |
443 | * @a: audit_data | |
444 | */ | |
445 | static void avc_audit_post_callback(struct audit_buffer *ab, void *a) | |
1da177e4 | 446 | { |
2bf49690 TL |
447 | struct common_audit_data *ad = a; |
448 | audit_log_format(ab, " "); | |
899838b2 EP |
449 | avc_dump_query(ab, ad->selinux_audit_data->ssid, |
450 | ad->selinux_audit_data->tsid, | |
451 | ad->selinux_audit_data->tclass); | |
1da177e4 LT |
452 | } |
453 | ||
48aab2f7 | 454 | /* This is the slow part of avc audit with big stack footprint */ |
2e334057 | 455 | noinline int slow_avc_audit(u32 ssid, u32 tsid, u16 tclass, |
48aab2f7 | 456 | u32 requested, u32 audited, u32 denied, |
f8294f11 | 457 | struct common_audit_data *a, |
48aab2f7 LT |
458 | unsigned flags) |
459 | { | |
460 | struct common_audit_data stack_data; | |
899838b2 | 461 | struct selinux_audit_data sad; |
48aab2f7 LT |
462 | |
463 | if (!a) { | |
464 | a = &stack_data; | |
50c205f5 | 465 | a->type = LSM_AUDIT_DATA_NONE; |
48aab2f7 LT |
466 | } |
467 | ||
468 | /* | |
469 | * When in a RCU walk do the audit on the RCU retry. This is because | |
470 | * the collection of the dname in an inode audit message is not RCU | |
471 | * safe. Note this may drop some audits when the situation changes | |
472 | * during retry. However this is logically just as if the operation | |
473 | * happened a little later. | |
474 | */ | |
475 | if ((a->type == LSM_AUDIT_DATA_INODE) && | |
476 | (flags & MAY_NOT_BLOCK)) | |
477 | return -ECHILD; | |
478 | ||
899838b2 EP |
479 | sad.tclass = tclass; |
480 | sad.requested = requested; | |
481 | sad.ssid = ssid; | |
482 | sad.tsid = tsid; | |
483 | sad.audited = audited; | |
484 | sad.denied = denied; | |
485 | ||
486 | a->selinux_audit_data = &sad; | |
3f0882c4 | 487 | |
b61c37f5 | 488 | common_lsm_audit(a, avc_audit_pre_callback, avc_audit_post_callback); |
48aab2f7 LT |
489 | return 0; |
490 | } | |
491 | ||
1da177e4 LT |
492 | /** |
493 | * avc_add_callback - Register a callback for security events. | |
494 | * @callback: callback function | |
495 | * @events: security events | |
1da177e4 | 496 | * |
562c99f2 WG |
497 | * Register a callback function for events in the set @events. |
498 | * Returns %0 on success or -%ENOMEM if insufficient memory | |
499 | * exists to add the callback. | |
1da177e4 | 500 | */ |
562c99f2 | 501 | int __init avc_add_callback(int (*callback)(u32 event), u32 events) |
1da177e4 LT |
502 | { |
503 | struct avc_callback_node *c; | |
504 | int rc = 0; | |
505 | ||
0b36e44c | 506 | c = kmalloc(sizeof(*c), GFP_KERNEL); |
1da177e4 LT |
507 | if (!c) { |
508 | rc = -ENOMEM; | |
509 | goto out; | |
510 | } | |
511 | ||
512 | c->callback = callback; | |
513 | c->events = events; | |
1da177e4 LT |
514 | c->next = avc_callbacks; |
515 | avc_callbacks = c; | |
516 | out: | |
517 | return rc; | |
518 | } | |
519 | ||
520 | static inline int avc_sidcmp(u32 x, u32 y) | |
521 | { | |
522 | return (x == y || x == SECSID_WILD || y == SECSID_WILD); | |
523 | } | |
524 | ||
525 | /** | |
526 | * avc_update_node Update an AVC entry | |
527 | * @event : Updating event | |
528 | * @perms : Permission mask bits | |
529 | * @ssid,@tsid,@tclass : identifier of an AVC entry | |
a5dda683 | 530 | * @seqno : sequence number when decision was made |
1da177e4 LT |
531 | * |
532 | * if a valid AVC entry doesn't exist,this function returns -ENOENT. | |
533 | * if kmalloc() called internal returns NULL, this function returns -ENOMEM. | |
6382dc33 | 534 | * otherwise, this function updates the AVC entry. The original AVC-entry object |
1da177e4 LT |
535 | * will release later by RCU. |
536 | */ | |
a5dda683 EP |
537 | static int avc_update_node(u32 event, u32 perms, u32 ssid, u32 tsid, u16 tclass, |
538 | u32 seqno) | |
1da177e4 LT |
539 | { |
540 | int hvalue, rc = 0; | |
541 | unsigned long flag; | |
542 | struct avc_node *pos, *node, *orig = NULL; | |
26036651 EP |
543 | struct hlist_head *head; |
544 | struct hlist_node *next; | |
edf3d1ae | 545 | spinlock_t *lock; |
1da177e4 LT |
546 | |
547 | node = avc_alloc_node(); | |
548 | if (!node) { | |
549 | rc = -ENOMEM; | |
550 | goto out; | |
551 | } | |
552 | ||
553 | /* Lock the target slot */ | |
554 | hvalue = avc_hash(ssid, tsid, tclass); | |
1da177e4 | 555 | |
edf3d1ae EP |
556 | head = &avc_cache.slots[hvalue]; |
557 | lock = &avc_cache.slots_lock[hvalue]; | |
558 | ||
559 | spin_lock_irqsave(lock, flag); | |
560 | ||
26036651 | 561 | hlist_for_each_entry(pos, next, head, list) { |
95fff33b EP |
562 | if (ssid == pos->ae.ssid && |
563 | tsid == pos->ae.tsid && | |
a5dda683 EP |
564 | tclass == pos->ae.tclass && |
565 | seqno == pos->ae.avd.seqno){ | |
1da177e4 LT |
566 | orig = pos; |
567 | break; | |
568 | } | |
569 | } | |
570 | ||
571 | if (!orig) { | |
572 | rc = -ENOENT; | |
573 | avc_node_kill(node); | |
574 | goto out_unlock; | |
575 | } | |
576 | ||
577 | /* | |
578 | * Copy and replace original node. | |
579 | */ | |
580 | ||
21193dcd | 581 | avc_node_populate(node, ssid, tsid, tclass, &orig->ae.avd); |
1da177e4 LT |
582 | |
583 | switch (event) { | |
584 | case AVC_CALLBACK_GRANT: | |
585 | node->ae.avd.allowed |= perms; | |
586 | break; | |
587 | case AVC_CALLBACK_TRY_REVOKE: | |
588 | case AVC_CALLBACK_REVOKE: | |
589 | node->ae.avd.allowed &= ~perms; | |
590 | break; | |
591 | case AVC_CALLBACK_AUDITALLOW_ENABLE: | |
592 | node->ae.avd.auditallow |= perms; | |
593 | break; | |
594 | case AVC_CALLBACK_AUDITALLOW_DISABLE: | |
595 | node->ae.avd.auditallow &= ~perms; | |
596 | break; | |
597 | case AVC_CALLBACK_AUDITDENY_ENABLE: | |
598 | node->ae.avd.auditdeny |= perms; | |
599 | break; | |
600 | case AVC_CALLBACK_AUDITDENY_DISABLE: | |
601 | node->ae.avd.auditdeny &= ~perms; | |
602 | break; | |
603 | } | |
604 | avc_node_replace(node, orig); | |
605 | out_unlock: | |
edf3d1ae | 606 | spin_unlock_irqrestore(lock, flag); |
1da177e4 LT |
607 | out: |
608 | return rc; | |
609 | } | |
610 | ||
611 | /** | |
008574b1 | 612 | * avc_flush - Flush the cache |
1da177e4 | 613 | */ |
008574b1 | 614 | static void avc_flush(void) |
1da177e4 | 615 | { |
26036651 EP |
616 | struct hlist_head *head; |
617 | struct hlist_node *next; | |
008574b1 | 618 | struct avc_node *node; |
edf3d1ae | 619 | spinlock_t *lock; |
008574b1 EP |
620 | unsigned long flag; |
621 | int i; | |
1da177e4 LT |
622 | |
623 | for (i = 0; i < AVC_CACHE_SLOTS; i++) { | |
edf3d1ae EP |
624 | head = &avc_cache.slots[i]; |
625 | lock = &avc_cache.slots_lock[i]; | |
626 | ||
627 | spin_lock_irqsave(lock, flag); | |
61844250 PM |
628 | /* |
629 | * With preemptable RCU, the outer spinlock does not | |
630 | * prevent RCU grace periods from ending. | |
631 | */ | |
632 | rcu_read_lock(); | |
26036651 | 633 | hlist_for_each_entry(node, next, head, list) |
1da177e4 | 634 | avc_node_delete(node); |
61844250 | 635 | rcu_read_unlock(); |
edf3d1ae | 636 | spin_unlock_irqrestore(lock, flag); |
1da177e4 | 637 | } |
008574b1 EP |
638 | } |
639 | ||
640 | /** | |
641 | * avc_ss_reset - Flush the cache and revalidate migrated permissions. | |
642 | * @seqno: policy sequence number | |
643 | */ | |
644 | int avc_ss_reset(u32 seqno) | |
645 | { | |
646 | struct avc_callback_node *c; | |
647 | int rc = 0, tmprc; | |
648 | ||
649 | avc_flush(); | |
1da177e4 LT |
650 | |
651 | for (c = avc_callbacks; c; c = c->next) { | |
652 | if (c->events & AVC_CALLBACK_RESET) { | |
562c99f2 | 653 | tmprc = c->callback(AVC_CALLBACK_RESET); |
376bd9cb DG |
654 | /* save the first error encountered for the return |
655 | value and continue processing the callbacks */ | |
656 | if (!rc) | |
657 | rc = tmprc; | |
1da177e4 LT |
658 | } |
659 | } | |
660 | ||
661 | avc_latest_notif_update(seqno, 0); | |
1da177e4 LT |
662 | return rc; |
663 | } | |
664 | ||
a554bea8 LT |
665 | /* |
666 | * Slow-path helper function for avc_has_perm_noaudit, | |
667 | * when the avc_node lookup fails. We get called with | |
668 | * the RCU read lock held, and need to return with it | |
669 | * still held, but drop if for the security compute. | |
670 | * | |
671 | * Don't inline this, since it's the slow-path and just | |
672 | * results in a bigger stack frame. | |
673 | */ | |
674 | static noinline struct avc_node *avc_compute_av(u32 ssid, u32 tsid, | |
675 | u16 tclass, struct av_decision *avd) | |
676 | { | |
677 | rcu_read_unlock(); | |
678 | security_compute_av(ssid, tsid, tclass, avd); | |
679 | rcu_read_lock(); | |
680 | return avc_insert(ssid, tsid, tclass, avd); | |
681 | } | |
682 | ||
683 | static noinline int avc_denied(u32 ssid, u32 tsid, | |
684 | u16 tclass, u32 requested, | |
685 | unsigned flags, | |
686 | struct av_decision *avd) | |
687 | { | |
688 | if (flags & AVC_STRICT) | |
689 | return -EACCES; | |
690 | ||
691 | if (selinux_enforcing && !(avd->flags & AVD_FLAGS_PERMISSIVE)) | |
692 | return -EACCES; | |
693 | ||
694 | avc_update_node(AVC_CALLBACK_GRANT, requested, ssid, | |
695 | tsid, tclass, avd->seqno); | |
696 | return 0; | |
697 | } | |
698 | ||
699 | ||
1da177e4 LT |
700 | /** |
701 | * avc_has_perm_noaudit - Check permissions but perform no auditing. | |
702 | * @ssid: source security identifier | |
703 | * @tsid: target security identifier | |
704 | * @tclass: target security class | |
705 | * @requested: requested permissions, interpreted based on @tclass | |
2c3c05db | 706 | * @flags: AVC_STRICT or 0 |
1da177e4 LT |
707 | * @avd: access vector decisions |
708 | * | |
709 | * Check the AVC to determine whether the @requested permissions are granted | |
710 | * for the SID pair (@ssid, @tsid), interpreting the permissions | |
711 | * based on @tclass, and call the security server on a cache miss to obtain | |
712 | * a new decision and add it to the cache. Return a copy of the decisions | |
713 | * in @avd. Return %0 if all @requested permissions are granted, | |
714 | * -%EACCES if any permissions are denied, or another -errno upon | |
715 | * other errors. This function is typically called by avc_has_perm(), | |
716 | * but may also be called directly to separate permission checking from | |
717 | * auditing, e.g. in cases where a lock must be held for the check but | |
718 | * should be released for the auditing. | |
719 | */ | |
cdb0f9a1 | 720 | inline int avc_has_perm_noaudit(u32 ssid, u32 tsid, |
2c3c05db SS |
721 | u16 tclass, u32 requested, |
722 | unsigned flags, | |
f01e1af4 | 723 | struct av_decision *avd) |
1da177e4 LT |
724 | { |
725 | struct avc_node *node; | |
1da177e4 LT |
726 | int rc = 0; |
727 | u32 denied; | |
728 | ||
eda4f69c EP |
729 | BUG_ON(!requested); |
730 | ||
1da177e4 LT |
731 | rcu_read_lock(); |
732 | ||
f1c6381a | 733 | node = avc_lookup(ssid, tsid, tclass); |
257313b2 | 734 | if (unlikely(!node)) { |
a554bea8 | 735 | node = avc_compute_av(ssid, tsid, tclass, avd); |
21193dcd | 736 | } else { |
f01e1af4 | 737 | memcpy(avd, &node->ae.avd, sizeof(*avd)); |
21193dcd | 738 | avd = &node->ae.avd; |
1da177e4 LT |
739 | } |
740 | ||
21193dcd | 741 | denied = requested & ~(avd->allowed); |
a554bea8 LT |
742 | if (unlikely(denied)) |
743 | rc = avc_denied(ssid, tsid, tclass, requested, flags, avd); | |
1da177e4 LT |
744 | |
745 | rcu_read_unlock(); | |
1da177e4 LT |
746 | return rc; |
747 | } | |
748 | ||
749 | /** | |
750 | * avc_has_perm - Check permissions and perform any appropriate auditing. | |
751 | * @ssid: source security identifier | |
752 | * @tsid: target security identifier | |
753 | * @tclass: target security class | |
754 | * @requested: requested permissions, interpreted based on @tclass | |
755 | * @auditdata: auxiliary audit data | |
9ade0cf4 | 756 | * @flags: VFS walk flags |
1da177e4 LT |
757 | * |
758 | * Check the AVC to determine whether the @requested permissions are granted | |
759 | * for the SID pair (@ssid, @tsid), interpreting the permissions | |
760 | * based on @tclass, and call the security server on a cache miss to obtain | |
761 | * a new decision and add it to the cache. Audit the granting or denial of | |
762 | * permissions in accordance with the policy. Return %0 if all @requested | |
763 | * permissions are granted, -%EACCES if any permissions are denied, or | |
764 | * another -errno upon other errors. | |
765 | */ | |
9ade0cf4 EP |
766 | int avc_has_perm_flags(u32 ssid, u32 tsid, u16 tclass, |
767 | u32 requested, struct common_audit_data *auditdata, | |
768 | unsigned flags) | |
1da177e4 LT |
769 | { |
770 | struct av_decision avd; | |
9ade0cf4 | 771 | int rc, rc2; |
1da177e4 | 772 | |
2c3c05db | 773 | rc = avc_has_perm_noaudit(ssid, tsid, tclass, requested, 0, &avd); |
9ade0cf4 EP |
774 | |
775 | rc2 = avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata, | |
776 | flags); | |
777 | if (rc2) | |
778 | return rc2; | |
1da177e4 LT |
779 | return rc; |
780 | } | |
788e7dd4 YN |
781 | |
782 | u32 avc_policy_seqno(void) | |
783 | { | |
784 | return avc_cache.latest_notif; | |
785 | } | |
89c86576 TL |
786 | |
787 | void avc_disable(void) | |
788 | { | |
5224ee08 EP |
789 | /* |
790 | * If you are looking at this because you have realized that we are | |
791 | * not destroying the avc_node_cachep it might be easy to fix, but | |
792 | * I don't know the memory barrier semantics well enough to know. It's | |
793 | * possible that some other task dereferenced security_ops when | |
794 | * it still pointed to selinux operations. If that is the case it's | |
795 | * possible that it is about to use the avc and is about to need the | |
796 | * avc_node_cachep. I know I could wrap the security.c security_ops call | |
797 | * in an rcu_lock, but seriously, it's not worth it. Instead I just flush | |
798 | * the cache and get that memory back. | |
799 | */ | |
800 | if (avc_node_cachep) { | |
801 | avc_flush(); | |
802 | /* kmem_cache_destroy(avc_node_cachep); */ | |
803 | } | |
89c86576 | 804 | } |