1/* 2 * Implementation of the kernel access vector cache (AVC). 3 * 4 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil> 5 * James Morris <jmorris@redhat.com> 6 * 7 * Update: KaiGai, Kohei <kaigai@ak.jp.nec.com> 8 * Replaced the avc_lock spinlock by RCU. 9 * 10 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 11 * 12 * This program is free software; you can redistribute it and/or modify 13 * it under the terms of the GNU General Public License version 2, 14 * as published by the Free Software Foundation. 15 */ 16#include <linux/types.h> 17#include <linux/stddef.h> 18#include <linux/kernel.h> 19#include <linux/slab.h> 20#include <linux/fs.h> 21#include <linux/dcache.h> 22#include <linux/init.h> 23#include <linux/skbuff.h> 24#include <linux/percpu.h> 25#include <net/sock.h> 26#include <linux/un.h> 27#include <net/af_unix.h> 28#include <linux/ip.h> 29#include <linux/audit.h> 30#include <linux/ipv6.h> 31#include <net/ipv6.h> 32#include "avc.h" 33#include "avc_ss.h" 34#include "classmap.h" 35 36#define AVC_CACHE_SLOTS 512 37#define AVC_DEF_CACHE_THRESHOLD 512 38#define AVC_CACHE_RECLAIM 16 39 40#ifdef CONFIG_SECURITY_SELINUX_AVC_STATS 41#define avc_cache_stats_incr(field) \ 42do { \ 43 per_cpu(avc_cache_stats, get_cpu()).field++; \ 44 put_cpu(); \ 45} while (0) 46#else 47#define avc_cache_stats_incr(field) do {} while (0) 48#endif 49 50struct avc_entry { 51 u32 ssid; 52 u32 tsid; 53 u16 tclass; 54 struct av_decision avd; 55}; 56 57struct avc_node { 58 struct avc_entry ae; 59 struct hlist_node list; /* anchored in avc_cache->slots[i] */ 60 struct rcu_head rhead; 61}; 62 63struct avc_cache { 64 struct hlist_head slots[AVC_CACHE_SLOTS]; /* head for avc_node->list */ 65 spinlock_t slots_lock[AVC_CACHE_SLOTS]; /* lock for writes */ 66 atomic_t lru_hint; /* LRU hint for reclaim scan */ 67 atomic_t active_nodes; 68 u32 latest_notif; /* latest revocation notification */ 69}; 70 71struct avc_callback_node { 72 int (*callback) (u32 event, u32 ssid, u32 tsid, 73 u16 tclass, u32 perms, 74 u32 *out_retained); 75 u32 events; 76 u32 ssid; 77 u32 tsid; 78 u16 tclass; 79 u32 perms; 80 struct avc_callback_node *next; 81}; 82 83/* Exported via selinufs */ 84unsigned int avc_cache_threshold = AVC_DEF_CACHE_THRESHOLD; 85 86#ifdef CONFIG_SECURITY_SELINUX_AVC_STATS 87DEFINE_PER_CPU(struct avc_cache_stats, avc_cache_stats) = { 0 }; 88#endif 89 90static struct avc_cache avc_cache; 91static struct avc_callback_node *avc_callbacks; 92static struct kmem_cache *avc_node_cachep; 93 94static inline int avc_hash(u32 ssid, u32 tsid, u16 tclass) 95{ 96 return (ssid ^ (tsid<<2) ^ (tclass<<4)) & (AVC_CACHE_SLOTS - 1); 97} 98 99/** 100 * avc_dump_av - Display an access vector in human-readable form. 101 * @tclass: target security class 102 * @av: access vector 103 */ 104static void avc_dump_av(struct audit_buffer *ab, u16 tclass, u32 av) 105{ 106 const char **perms; 107 int i, perm; 108 109 if (av == 0) { 110 audit_log_format(ab, " null"); 111 return; 112 } 113 114 perms = secclass_map[tclass-1].perms; 115 116 audit_log_format(ab, " {"); 117 i = 0; 118 perm = 1; 119 while (i < (sizeof(av) * 8)) { 120 if ((perm & av) && perms[i]) { 121 audit_log_format(ab, " %s", perms[i]); 122 av &= ~perm; 123 } 124 i++; 125 perm <<= 1; 126 } 127 128 if (av) 129 audit_log_format(ab, " 0x%x", av); 130 131 audit_log_format(ab, " }"); 132} 133 134/** 135 * avc_dump_query - Display a SID pair and a class in human-readable form. 136 * @ssid: source security identifier 137 * @tsid: target security identifier 138 * @tclass: target security class 139 */ 140static void avc_dump_query(struct audit_buffer *ab, u32 ssid, u32 tsid, u16 tclass) 141{ 142 int rc; 143 char *scontext; 144 u32 scontext_len; 145 146 rc = security_sid_to_context(ssid, &scontext, &scontext_len); 147 if (rc) 148 audit_log_format(ab, "ssid=%d", ssid); 149 else { 150 audit_log_format(ab, "scontext=%s", scontext); 151 kfree(scontext); 152 } 153 154 rc = security_sid_to_context(tsid, &scontext, &scontext_len); 155 if (rc) 156 audit_log_format(ab, " tsid=%d", tsid); 157 else { 158 audit_log_format(ab, " tcontext=%s", scontext); 159 kfree(scontext); 160 } 161 162 BUG_ON(tclass >= ARRAY_SIZE(secclass_map)); 163 audit_log_format(ab, " tclass=%s", secclass_map[tclass-1].name); 164} 165 166/** 167 * avc_init - Initialize the AVC. 168 * 169 * Initialize the access vector cache. 170 */ 171void __init avc_init(void) 172{ 173 int i; 174 175 for (i = 0; i < AVC_CACHE_SLOTS; i++) { 176 INIT_HLIST_HEAD(&avc_cache.slots[i]); 177 spin_lock_init(&avc_cache.slots_lock[i]); 178 } 179 atomic_set(&avc_cache.active_nodes, 0); 180 atomic_set(&avc_cache.lru_hint, 0); 181 182 avc_node_cachep = kmem_cache_create("avc_node", sizeof(struct avc_node), 183 0, SLAB_PANIC, NULL); 184 185 audit_log(current->audit_context, GFP_KERNEL, AUDIT_KERNEL, "AVC INITIALIZED\n"); 186} 187 188int avc_get_hash_stats(char *page) 189{ 190 int i, chain_len, max_chain_len, slots_used; 191 struct avc_node *node; 192 struct hlist_head *head; 193 194 rcu_read_lock(); 195 196 slots_used = 0; 197 max_chain_len = 0; 198 for (i = 0; i < AVC_CACHE_SLOTS; i++) { 199 head = &avc_cache.slots[i]; 200 if (!hlist_empty(head)) { 201 struct hlist_node *next; 202 203 slots_used++; 204 chain_len = 0; 205 hlist_for_each_entry_rcu(node, next, head, list) 206 chain_len++; 207 if (chain_len > max_chain_len) 208 max_chain_len = chain_len; 209 } 210 } 211 212 rcu_read_unlock(); 213 214 return scnprintf(page, PAGE_SIZE, "entries: %d\nbuckets used: %d/%d\n" 215 "longest chain: %d\n", 216 atomic_read(&avc_cache.active_nodes), 217 slots_used, AVC_CACHE_SLOTS, max_chain_len); 218} 219 220static void avc_node_free(struct rcu_head *rhead) 221{ 222 struct avc_node *node = container_of(rhead, struct avc_node, rhead); 223 kmem_cache_free(avc_node_cachep, node); 224 avc_cache_stats_incr(frees); 225} 226 227static void avc_node_delete(struct avc_node *node) 228{ 229 hlist_del_rcu(&node->list); 230 call_rcu(&node->rhead, avc_node_free); 231 atomic_dec(&avc_cache.active_nodes); 232} 233 234static void avc_node_kill(struct avc_node *node) 235{ 236 kmem_cache_free(avc_node_cachep, node); 237 avc_cache_stats_incr(frees); 238 atomic_dec(&avc_cache.active_nodes); 239} 240 241static void avc_node_replace(struct avc_node *new, struct avc_node *old) 242{ 243 hlist_replace_rcu(&old->list, &new->list); 244 call_rcu(&old->rhead, avc_node_free); 245 atomic_dec(&avc_cache.active_nodes); 246} 247 248static inline int avc_reclaim_node(void) 249{ 250 struct avc_node *node; 251 int hvalue, try, ecx; 252 unsigned long flags; 253 struct hlist_head *head; 254 struct hlist_node *next; 255 spinlock_t *lock; 256 257 for (try = 0, ecx = 0; try < AVC_CACHE_SLOTS; try++) { 258 hvalue = atomic_inc_return(&avc_cache.lru_hint) & (AVC_CACHE_SLOTS - 1); 259 head = &avc_cache.slots[hvalue]; 260 lock = &avc_cache.slots_lock[hvalue]; 261 262 if (!spin_trylock_irqsave(lock, flags)) 263 continue; 264 265 rcu_read_lock(); 266 hlist_for_each_entry(node, next, head, list) { 267 avc_node_delete(node); 268 avc_cache_stats_incr(reclaims); 269 ecx++; 270 if (ecx >= AVC_CACHE_RECLAIM) { 271 rcu_read_unlock(); 272 spin_unlock_irqrestore(lock, flags); 273 goto out; 274 } 275 } 276 rcu_read_unlock(); 277 spin_unlock_irqrestore(lock, flags); 278 } 279out: 280 return ecx; 281} 282 283static struct avc_node *avc_alloc_node(void) 284{ 285 struct avc_node *node; 286 287 node = kmem_cache_zalloc(avc_node_cachep, GFP_ATOMIC); 288 if (!node) 289 goto out; 290 291 INIT_HLIST_NODE(&node->list); 292 avc_cache_stats_incr(allocations); 293 294 if (atomic_inc_return(&avc_cache.active_nodes) > avc_cache_threshold) 295 avc_reclaim_node(); 296 297out: 298 return node; 299} 300 301static void avc_node_populate(struct avc_node *node, u32 ssid, u32 tsid, u16 tclass, struct av_decision *avd) 302{ 303 node->ae.ssid = ssid; 304 node->ae.tsid = tsid; 305 node->ae.tclass = tclass; 306 memcpy(&node->ae.avd, avd, sizeof(node->ae.avd)); 307} 308 309static inline struct avc_node *avc_search_node(u32 ssid, u32 tsid, u16 tclass) 310{ 311 struct avc_node *node, *ret = NULL; 312 int hvalue; 313 struct hlist_head *head; 314 struct hlist_node *next; 315 316 hvalue = avc_hash(ssid, tsid, tclass); 317 head = &avc_cache.slots[hvalue]; 318 hlist_for_each_entry_rcu(node, next, head, list) { 319 if (ssid == node->ae.ssid && 320 tclass == node->ae.tclass && 321 tsid == node->ae.tsid) { 322 ret = node; 323 break; 324 } 325 } 326 327 return ret; 328} 329 330/** 331 * avc_lookup - Look up an AVC entry. 332 * @ssid: source security identifier 333 * @tsid: target security identifier 334 * @tclass: target security class 335 * 336 * Look up an AVC entry that is valid for the 337 * (@ssid, @tsid), interpreting the permissions 338 * based on @tclass. If a valid AVC entry exists, 339 * then this function returns the avc_node. 340 * Otherwise, this function returns NULL. 341 */ 342static struct avc_node *avc_lookup(u32 ssid, u32 tsid, u16 tclass) 343{ 344 struct avc_node *node; 345 346 avc_cache_stats_incr(lookups); 347 node = avc_search_node(ssid, tsid, tclass); 348 349 if (node) 350 avc_cache_stats_incr(hits); 351 else 352 avc_cache_stats_incr(misses); 353 354 return node; 355} 356 357static int avc_latest_notif_update(int seqno, int is_insert) 358{ 359 int ret = 0; 360 static DEFINE_SPINLOCK(notif_lock); 361 unsigned long flag; 362 363 spin_lock_irqsave(¬if_lock, flag); 364 if (is_insert) { 365 if (seqno < avc_cache.latest_notif) { 366 printk(KERN_WARNING "SELinux: avc: seqno %d < latest_notif %d\n", 367 seqno, avc_cache.latest_notif); 368 ret = -EAGAIN; 369 } 370 } else { 371 if (seqno > avc_cache.latest_notif) 372 avc_cache.latest_notif = seqno; 373 } 374 spin_unlock_irqrestore(¬if_lock, flag); 375 376 return ret; 377} 378 379/** 380 * avc_insert - Insert an AVC entry. 381 * @ssid: source security identifier 382 * @tsid: target security identifier 383 * @tclass: target security class 384 * @avd: resulting av decision 385 * 386 * Insert an AVC entry for the SID pair 387 * (@ssid, @tsid) and class @tclass. 388 * The access vectors and the sequence number are 389 * normally provided by the security server in 390 * response to a security_compute_av() call. If the 391 * sequence number @avd->seqno is not less than the latest 392 * revocation notification, then the function copies 393 * the access vectors into a cache entry, returns 394 * avc_node inserted. Otherwise, this function returns NULL. 395 */ 396static struct avc_node *avc_insert(u32 ssid, u32 tsid, u16 tclass, struct av_decision *avd) 397{ 398 struct avc_node *pos, *node = NULL; 399 int hvalue; 400 unsigned long flag; 401 402 if (avc_latest_notif_update(avd->seqno, 1)) 403 goto out; 404 405 node = avc_alloc_node(); 406 if (node) { 407 struct hlist_head *head; 408 struct hlist_node *next; 409 spinlock_t *lock; 410 411 hvalue = avc_hash(ssid, tsid, tclass); 412 avc_node_populate(node, ssid, tsid, tclass, avd); 413 414 head = &avc_cache.slots[hvalue]; 415 lock = &avc_cache.slots_lock[hvalue]; 416 417 spin_lock_irqsave(lock, flag); 418 hlist_for_each_entry(pos, next, head, list) { 419 if (pos->ae.ssid == ssid && 420 pos->ae.tsid == tsid && 421 pos->ae.tclass == tclass) { 422 avc_node_replace(node, pos); 423 goto found; 424 } 425 } 426 hlist_add_head_rcu(&node->list, head); 427found: 428 spin_unlock_irqrestore(lock, flag); 429 } 430out: 431 return node; 432} 433 434/** 435 * avc_audit_pre_callback - SELinux specific information 436 * will be called by generic audit code 437 * @ab: the audit buffer 438 * @a: audit_data 439 */ 440static void avc_audit_pre_callback(struct audit_buffer *ab, void *a) 441{ 442 struct common_audit_data *ad = a; 443 audit_log_format(ab, "avc: %s ", 444 ad->selinux_audit_data.denied ? "denied" : "granted"); 445 avc_dump_av(ab, ad->selinux_audit_data.tclass, 446 ad->selinux_audit_data.audited); 447 audit_log_format(ab, " for "); 448} 449 450/** 451 * avc_audit_post_callback - SELinux specific information 452 * will be called by generic audit code 453 * @ab: the audit buffer 454 * @a: audit_data 455 */ 456static void avc_audit_post_callback(struct audit_buffer *ab, void *a) 457{ 458 struct common_audit_data *ad = a; 459 audit_log_format(ab, " "); 460 avc_dump_query(ab, ad->selinux_audit_data.ssid, 461 ad->selinux_audit_data.tsid, 462 ad->selinux_audit_data.tclass); 463} 464 465/** 466 * avc_audit - Audit the granting or denial of permissions. 467 * @ssid: source security identifier 468 * @tsid: target security identifier 469 * @tclass: target security class 470 * @requested: requested permissions 471 * @avd: access vector decisions 472 * @result: result from avc_has_perm_noaudit 473 * @a: auxiliary audit data 474 * 475 * Audit the granting or denial of permissions in accordance 476 * with the policy. This function is typically called by 477 * avc_has_perm() after a permission check, but can also be 478 * called directly by callers who use avc_has_perm_noaudit() 479 * in order to separate the permission check from the auditing. 480 * For example, this separation is useful when the permission check must 481 * be performed under a lock, to allow the lock to be released 482 * before calling the auditing code. 483 */ 484void avc_audit(u32 ssid, u32 tsid, 485 u16 tclass, u32 requested, 486 struct av_decision *avd, int result, struct common_audit_data *a) 487{ 488 struct common_audit_data stack_data; 489 u32 denied, audited; 490 denied = requested & ~avd->allowed; 491 if (denied) { 492 audited = denied & avd->auditdeny; 493 /* 494 * a->selinux_audit_data.auditdeny is TRICKY! Setting a bit in 495 * this field means that ANY denials should NOT be audited if 496 * the policy contains an explicit dontaudit rule for that 497 * permission. Take notice that this is unrelated to the 498 * actual permissions that were denied. As an example lets 499 * assume: 500 * 501 * denied == READ 502 * avd.auditdeny & ACCESS == 0 (not set means explicit rule) 503 * selinux_audit_data.auditdeny & ACCESS == 1 504 * 505 * We will NOT audit the denial even though the denied 506 * permission was READ and the auditdeny checks were for 507 * ACCESS 508 */ 509 if (a && 510 a->selinux_audit_data.auditdeny && 511 !(a->selinux_audit_data.auditdeny & avd->auditdeny)) 512 audited = 0; 513 } else if (result) 514 audited = denied = requested; 515 else 516 audited = requested & avd->auditallow; 517 if (!audited) 518 return; 519 if (!a) { 520 a = &stack_data; 521 COMMON_AUDIT_DATA_INIT(a, NONE); 522 } 523 a->selinux_audit_data.tclass = tclass; 524 a->selinux_audit_data.requested = requested; 525 a->selinux_audit_data.ssid = ssid; 526 a->selinux_audit_data.tsid = tsid; 527 a->selinux_audit_data.audited = audited; 528 a->selinux_audit_data.denied = denied; 529 a->lsm_pre_audit = avc_audit_pre_callback; 530 a->lsm_post_audit = avc_audit_post_callback; 531 common_lsm_audit(a); 532} 533 534/** 535 * avc_add_callback - Register a callback for security events. 536 * @callback: callback function 537 * @events: security events 538 * @ssid: source security identifier or %SECSID_WILD 539 * @tsid: target security identifier or %SECSID_WILD 540 * @tclass: target security class 541 * @perms: permissions 542 * 543 * Register a callback function for events in the set @events 544 * related to the SID pair (@ssid, @tsid) 545 * and the permissions @perms, interpreting 546 * @perms based on @tclass. Returns %0 on success or 547 * -%ENOMEM if insufficient memory exists to add the callback. 548 */ 549int avc_add_callback(int (*callback)(u32 event, u32 ssid, u32 tsid, 550 u16 tclass, u32 perms, 551 u32 *out_retained), 552 u32 events, u32 ssid, u32 tsid, 553 u16 tclass, u32 perms) 554{ 555 struct avc_callback_node *c; 556 int rc = 0; 557 558 c = kmalloc(sizeof(*c), GFP_ATOMIC); 559 if (!c) { 560 rc = -ENOMEM; 561 goto out; 562 } 563 564 c->callback = callback; 565 c->events = events; 566 c->ssid = ssid; 567 c->tsid = tsid; 568 c->perms = perms; 569 c->next = avc_callbacks; 570 avc_callbacks = c; 571out: 572 return rc; 573} 574 575static inline int avc_sidcmp(u32 x, u32 y) 576{ 577 return (x == y || x == SECSID_WILD || y == SECSID_WILD); 578} 579 580/** 581 * avc_update_node Update an AVC entry 582 * @event : Updating event 583 * @perms : Permission mask bits 584 * @ssid,@tsid,@tclass : identifier of an AVC entry 585 * @seqno : sequence number when decision was made 586 * 587 * if a valid AVC entry doesn't exist,this function returns -ENOENT. 588 * if kmalloc() called internal returns NULL, this function returns -ENOMEM. 589 * otherwise, this function updates the AVC entry. The original AVC-entry object 590 * will release later by RCU. 591 */ 592static int avc_update_node(u32 event, u32 perms, u32 ssid, u32 tsid, u16 tclass, 593 u32 seqno) 594{ 595 int hvalue, rc = 0; 596 unsigned long flag; 597 struct avc_node *pos, *node, *orig = NULL; 598 struct hlist_head *head; 599 struct hlist_node *next; 600 spinlock_t *lock; 601 602 node = avc_alloc_node(); 603 if (!node) { 604 rc = -ENOMEM; 605 goto out; 606 } 607 608 /* Lock the target slot */ 609 hvalue = avc_hash(ssid, tsid, tclass); 610 611 head = &avc_cache.slots[hvalue]; 612 lock = &avc_cache.slots_lock[hvalue]; 613 614 spin_lock_irqsave(lock, flag); 615 616 hlist_for_each_entry(pos, next, head, list) { 617 if (ssid == pos->ae.ssid && 618 tsid == pos->ae.tsid && 619 tclass == pos->ae.tclass && 620 seqno == pos->ae.avd.seqno){ 621 orig = pos; 622 break; 623 } 624 } 625 626 if (!orig) { 627 rc = -ENOENT; 628 avc_node_kill(node); 629 goto out_unlock; 630 } 631 632 /* 633 * Copy and replace original node. 634 */ 635 636 avc_node_populate(node, ssid, tsid, tclass, &orig->ae.avd); 637 638 switch (event) { 639 case AVC_CALLBACK_GRANT: 640 node->ae.avd.allowed |= perms; 641 break; 642 case AVC_CALLBACK_TRY_REVOKE: 643 case AVC_CALLBACK_REVOKE: 644 node->ae.avd.allowed &= ~perms; 645 break; 646 case AVC_CALLBACK_AUDITALLOW_ENABLE: 647 node->ae.avd.auditallow |= perms; 648 break; 649 case AVC_CALLBACK_AUDITALLOW_DISABLE: 650 node->ae.avd.auditallow &= ~perms; 651 break; 652 case AVC_CALLBACK_AUDITDENY_ENABLE: 653 node->ae.avd.auditdeny |= perms; 654 break; 655 case AVC_CALLBACK_AUDITDENY_DISABLE: 656 node->ae.avd.auditdeny &= ~perms; 657 break; 658 } 659 avc_node_replace(node, orig); 660out_unlock: 661 spin_unlock_irqrestore(lock, flag); 662out: 663 return rc; 664} 665 666/** 667 * avc_flush - Flush the cache 668 */ 669static void avc_flush(void) 670{ 671 struct hlist_head *head; 672 struct hlist_node *next; 673 struct avc_node *node; 674 spinlock_t *lock; 675 unsigned long flag; 676 int i; 677 678 for (i = 0; i < AVC_CACHE_SLOTS; i++) { 679 head = &avc_cache.slots[i]; 680 lock = &avc_cache.slots_lock[i]; 681 682 spin_lock_irqsave(lock, flag); 683 /* 684 * With preemptable RCU, the outer spinlock does not 685 * prevent RCU grace periods from ending. 686 */ 687 rcu_read_lock(); 688 hlist_for_each_entry(node, next, head, list) 689 avc_node_delete(node); 690 rcu_read_unlock(); 691 spin_unlock_irqrestore(lock, flag); 692 } 693} 694 695/** 696 * avc_ss_reset - Flush the cache and revalidate migrated permissions. 697 * @seqno: policy sequence number 698 */ 699int avc_ss_reset(u32 seqno) 700{ 701 struct avc_callback_node *c; 702 int rc = 0, tmprc; 703 704 avc_flush(); 705 706 for (c = avc_callbacks; c; c = c->next) { 707 if (c->events & AVC_CALLBACK_RESET) { 708 tmprc = c->callback(AVC_CALLBACK_RESET, 709 0, 0, 0, 0, NULL); 710 /* save the first error encountered for the return 711 value and continue processing the callbacks */ 712 if (!rc) 713 rc = tmprc; 714 } 715 } 716 717 avc_latest_notif_update(seqno, 0); 718 return rc; 719} 720 721/** 722 * avc_has_perm_noaudit - Check permissions but perform no auditing. 723 * @ssid: source security identifier 724 * @tsid: target security identifier 725 * @tclass: target security class 726 * @requested: requested permissions, interpreted based on @tclass 727 * @flags: AVC_STRICT or 0 728 * @avd: access vector decisions 729 * 730 * Check the AVC to determine whether the @requested permissions are granted 731 * for the SID pair (@ssid, @tsid), interpreting the permissions 732 * based on @tclass, and call the security server on a cache miss to obtain 733 * a new decision and add it to the cache. Return a copy of the decisions 734 * in @avd. Return %0 if all @requested permissions are granted, 735 * -%EACCES if any permissions are denied, or another -errno upon 736 * other errors. This function is typically called by avc_has_perm(), 737 * but may also be called directly to separate permission checking from 738 * auditing, e.g. in cases where a lock must be held for the check but 739 * should be released for the auditing. 740 */ 741int avc_has_perm_noaudit(u32 ssid, u32 tsid, 742 u16 tclass, u32 requested, 743 unsigned flags, 744 struct av_decision *in_avd) 745{ 746 struct avc_node *node; 747 struct av_decision avd_entry, *avd; 748 int rc = 0; 749 u32 denied; 750 751 BUG_ON(!requested); 752 753 rcu_read_lock(); 754 755 node = avc_lookup(ssid, tsid, tclass); 756 if (!node) { 757 rcu_read_unlock(); 758 759 if (in_avd) 760 avd = in_avd; 761 else 762 avd = &avd_entry; 763 764 security_compute_av(ssid, tsid, tclass, avd); 765 rcu_read_lock(); 766 node = avc_insert(ssid, tsid, tclass, avd); 767 } else { 768 if (in_avd) 769 memcpy(in_avd, &node->ae.avd, sizeof(*in_avd)); 770 avd = &node->ae.avd; 771 } 772 773 denied = requested & ~(avd->allowed); 774 775 if (denied) { 776 if (flags & AVC_STRICT) 777 rc = -EACCES; 778 else if (!selinux_enforcing || (avd->flags & AVD_FLAGS_PERMISSIVE)) 779 avc_update_node(AVC_CALLBACK_GRANT, requested, ssid, 780 tsid, tclass, avd->seqno); 781 else 782 rc = -EACCES; 783 } 784 785 rcu_read_unlock(); 786 return rc; 787} 788 789/** 790 * avc_has_perm - Check permissions and perform any appropriate auditing. 791 * @ssid: source security identifier 792 * @tsid: target security identifier 793 * @tclass: target security class 794 * @requested: requested permissions, interpreted based on @tclass 795 * @auditdata: auxiliary audit data 796 * 797 * Check the AVC to determine whether the @requested permissions are granted 798 * for the SID pair (@ssid, @tsid), interpreting the permissions 799 * based on @tclass, and call the security server on a cache miss to obtain 800 * a new decision and add it to the cache. Audit the granting or denial of 801 * permissions in accordance with the policy. Return %0 if all @requested 802 * permissions are granted, -%EACCES if any permissions are denied, or 803 * another -errno upon other errors. 804 */ 805int avc_has_perm(u32 ssid, u32 tsid, u16 tclass, 806 u32 requested, struct common_audit_data *auditdata) 807{ 808 struct av_decision avd; 809 int rc; 810 811 rc = avc_has_perm_noaudit(ssid, tsid, tclass, requested, 0, &avd); 812 avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata); 813 return rc; 814} 815 816u32 avc_policy_seqno(void) 817{ 818 return avc_cache.latest_notif; 819} 820 821void avc_disable(void) 822{ 823 /* 824 * If you are looking at this because you have realized that we are 825 * not destroying the avc_node_cachep it might be easy to fix, but 826 * I don't know the memory barrier semantics well enough to know. It's 827 * possible that some other task dereferenced security_ops when 828 * it still pointed to selinux operations. If that is the case it's 829 * possible that it is about to use the avc and is about to need the 830 * avc_node_cachep. I know I could wrap the security.c security_ops call 831 * in an rcu_lock, but seriously, it's not worth it. Instead I just flush 832 * the cache and get that memory back. 833 */ 834 if (avc_node_cachep) { 835 avc_flush(); 836 /* kmem_cache_destroy(avc_node_cachep); */ 837 } 838} 839