Diff markup
1 /* 1 /*
2 * Implementation of the kernel access vector 2 * Implementation of the kernel access vector cache (AVC).
3 * 3 *
4 * Authors: Stephen Smalley, <sds@epoch.ncsc. 4 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
5 * James Morris <jmorris@redhat.com> !! 5 * James Morris <jmorris@redhat.com>
6 * 6 *
7 * Update: KaiGai, Kohei <kaigai@ak.jp.nec.c 7 * Update: KaiGai, Kohei <kaigai@ak.jp.nec.com>
8 * Replaced the avc_lock spinlock by RCU. !! 8 * Replaced the avc_lock spinlock by RCU.
9 * 9 *
10 * Copyright (C) 2003 Red Hat, Inc., James Mor 10 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
11 * 11 *
12 * This program is free software; you can 12 * This program is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU General 13 * it under the terms of the GNU General Public License version 2,
14 * as published by the Free Software Foun !! 14 * as published by the Free Software Foundation.
15 */ 15 */
16 #include <linux/types.h> 16 #include <linux/types.h>
17 #include <linux/stddef.h> 17 #include <linux/stddef.h>
18 #include <linux/kernel.h> 18 #include <linux/kernel.h>
19 #include <linux/slab.h> 19 #include <linux/slab.h>
20 #include <linux/fs.h> 20 #include <linux/fs.h>
21 #include <linux/dcache.h> 21 #include <linux/dcache.h>
22 #include <linux/init.h> 22 #include <linux/init.h>
23 #include <linux/skbuff.h> 23 #include <linux/skbuff.h>
24 #include <linux/percpu.h> 24 #include <linux/percpu.h>
25 #include <net/sock.h> 25 #include <net/sock.h>
26 #include <linux/un.h> 26 #include <linux/un.h>
27 #include <net/af_unix.h> 27 #include <net/af_unix.h>
28 #include <linux/ip.h> 28 #include <linux/ip.h>
29 #include <linux/audit.h> 29 #include <linux/audit.h>
30 #include <linux/ipv6.h> 30 #include <linux/ipv6.h>
31 #include <net/ipv6.h> 31 #include <net/ipv6.h>
32 #include "avc.h" 32 #include "avc.h"
33 #include "avc_ss.h" 33 #include "avc_ss.h"
34 34
35 static const struct av_perm_to_string av_perm_ 35 static const struct av_perm_to_string av_perm_to_string[] = {
36 #define S_(c, v, s) { c, v, s }, 36 #define S_(c, v, s) { c, v, s },
37 #include "av_perm_to_string.h" 37 #include "av_perm_to_string.h"
38 #undef S_ 38 #undef S_
39 }; 39 };
40 40
41 static const char *class_to_string[] = { 41 static const char *class_to_string[] = {
42 #define S_(s) s, 42 #define S_(s) s,
43 #include "class_to_string.h" 43 #include "class_to_string.h"
44 #undef S_ 44 #undef S_
45 }; 45 };
46 46
47 #define TB_(s) static const char * s [] = { !! 47 #define TB_(s) static const char *s[] = {
48 #define TE_(s) }; 48 #define TE_(s) };
49 #define S_(s) s, 49 #define S_(s) s,
50 #include "common_perm_to_string.h" 50 #include "common_perm_to_string.h"
51 #undef TB_ 51 #undef TB_
52 #undef TE_ 52 #undef TE_
53 #undef S_ 53 #undef S_
54 54
55 static const struct av_inherit av_inherit[] = 55 static const struct av_inherit av_inherit[] = {
56 #define S_(c, i, b) { c, common_##i##_perm_to_ !! 56 #define S_(c, i, b) { .tclass = c,\
>> 57 .common_pts = common_##i##_perm_to_string,\
>> 58 .common_base = b },
57 #include "av_inherit.h" 59 #include "av_inherit.h"
58 #undef S_ 60 #undef S_
59 }; 61 };
60 62
61 const struct selinux_class_perm selinux_class_ 63 const struct selinux_class_perm selinux_class_perm = {
62 av_perm_to_string, !! 64 .av_perm_to_string = av_perm_to_string,
63 ARRAY_SIZE(av_perm_to_string), !! 65 .av_pts_len = ARRAY_SIZE(av_perm_to_string),
64 class_to_string, !! 66 .class_to_string = class_to_string,
65 ARRAY_SIZE(class_to_string), !! 67 .cts_len = ARRAY_SIZE(class_to_string),
66 av_inherit, !! 68 .av_inherit = av_inherit,
67 ARRAY_SIZE(av_inherit) !! 69 .av_inherit_len = ARRAY_SIZE(av_inherit)
68 }; 70 };
69 71
70 #define AVC_CACHE_SLOTS 512 72 #define AVC_CACHE_SLOTS 512
71 #define AVC_DEF_CACHE_THRESHOLD 512 73 #define AVC_DEF_CACHE_THRESHOLD 512
72 #define AVC_CACHE_RECLAIM 16 74 #define AVC_CACHE_RECLAIM 16
73 75
74 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS 76 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
75 #define avc_cache_stats_incr(field) !! 77 #define avc_cache_stats_incr(field) \
76 do { 78 do { \
77 per_cpu(avc_cache_stats, get_cpu()).fi 79 per_cpu(avc_cache_stats, get_cpu()).field++; \
78 put_cpu(); 80 put_cpu(); \
79 } while (0) 81 } while (0)
80 #else 82 #else
81 #define avc_cache_stats_incr(field) do {} 83 #define avc_cache_stats_incr(field) do {} while (0)
82 #endif 84 #endif
83 85
84 struct avc_entry { 86 struct avc_entry {
85 u32 ssid; 87 u32 ssid;
86 u32 tsid; 88 u32 tsid;
87 u16 tclass; 89 u16 tclass;
88 struct av_decision avd; 90 struct av_decision avd;
89 atomic_t used; /* use <<
90 }; 91 };
91 92
92 struct avc_node { 93 struct avc_node {
93 struct avc_entry ae; 94 struct avc_entry ae;
94 struct list_head list; !! 95 struct hlist_node list; /* anchored in avc_cache->slots[i] */
95 struct rcu_head rhead; !! 96 struct rcu_head rhead;
96 }; 97 };
97 98
98 struct avc_cache { 99 struct avc_cache {
99 struct list_head slots[AVC_CACH !! 100 struct hlist_head slots[AVC_CACHE_SLOTS]; /* head for avc_node->list */
100 spinlock_t slots_lock[AVC 101 spinlock_t slots_lock[AVC_CACHE_SLOTS]; /* lock for writes */
101 atomic_t lru_hint; 102 atomic_t lru_hint; /* LRU hint for reclaim scan */
102 atomic_t active_nodes; 103 atomic_t active_nodes;
103 u32 latest_notif; 104 u32 latest_notif; /* latest revocation notification */
104 }; 105 };
105 106
106 struct avc_callback_node { 107 struct avc_callback_node {
107 int (*callback) (u32 event, u32 ssid, 108 int (*callback) (u32 event, u32 ssid, u32 tsid,
108 u16 tclass, u32 perms !! 109 u16 tclass, u32 perms,
109 u32 *out_retained); !! 110 u32 *out_retained);
110 u32 events; 111 u32 events;
111 u32 ssid; 112 u32 ssid;
112 u32 tsid; 113 u32 tsid;
113 u16 tclass; 114 u16 tclass;
114 u32 perms; 115 u32 perms;
115 struct avc_callback_node *next; 116 struct avc_callback_node *next;
116 }; 117 };
117 118
118 /* Exported via selinufs */ 119 /* Exported via selinufs */
119 unsigned int avc_cache_threshold = AVC_DEF_CAC 120 unsigned int avc_cache_threshold = AVC_DEF_CACHE_THRESHOLD;
120 121
121 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS 122 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
122 DEFINE_PER_CPU(struct avc_cache_stats, avc_cac 123 DEFINE_PER_CPU(struct avc_cache_stats, avc_cache_stats) = { 0 };
123 #endif 124 #endif
124 125
125 static struct avc_cache avc_cache; 126 static struct avc_cache avc_cache;
126 static struct avc_callback_node *avc_callbacks 127 static struct avc_callback_node *avc_callbacks;
127 static struct kmem_cache *avc_node_cachep; 128 static struct kmem_cache *avc_node_cachep;
128 129
129 static inline int avc_hash(u32 ssid, u32 tsid, 130 static inline int avc_hash(u32 ssid, u32 tsid, u16 tclass)
130 { 131 {
131 return (ssid ^ (tsid<<2) ^ (tclass<<4) 132 return (ssid ^ (tsid<<2) ^ (tclass<<4)) & (AVC_CACHE_SLOTS - 1);
132 } 133 }
133 134
134 /** 135 /**
135 * avc_dump_av - Display an access vector in h 136 * avc_dump_av - Display an access vector in human-readable form.
136 * @tclass: target security class 137 * @tclass: target security class
137 * @av: access vector 138 * @av: access vector
138 */ 139 */
139 static void avc_dump_av(struct audit_buffer *a !! 140 void avc_dump_av(struct audit_buffer *ab, u16 tclass, u32 av)
140 { 141 {
141 const char **common_pts = NULL; 142 const char **common_pts = NULL;
142 u32 common_base = 0; 143 u32 common_base = 0;
143 int i, i2, perm; 144 int i, i2, perm;
144 145
145 if (av == 0) { 146 if (av == 0) {
146 audit_log_format(ab, " null"); 147 audit_log_format(ab, " null");
147 return; 148 return;
148 } 149 }
149 150
150 for (i = 0; i < ARRAY_SIZE(av_inherit) 151 for (i = 0; i < ARRAY_SIZE(av_inherit); i++) {
151 if (av_inherit[i].tclass == tc 152 if (av_inherit[i].tclass == tclass) {
152 common_pts = av_inheri 153 common_pts = av_inherit[i].common_pts;
153 common_base = av_inher 154 common_base = av_inherit[i].common_base;
154 break; 155 break;
155 } 156 }
156 } 157 }
157 158
158 audit_log_format(ab, " {"); 159 audit_log_format(ab, " {");
159 i = 0; 160 i = 0;
160 perm = 1; 161 perm = 1;
161 while (perm < common_base) { 162 while (perm < common_base) {
162 if (perm & av) { 163 if (perm & av) {
163 audit_log_format(ab, " 164 audit_log_format(ab, " %s", common_pts[i]);
164 av &= ~perm; 165 av &= ~perm;
165 } 166 }
166 i++; 167 i++;
167 perm <<= 1; 168 perm <<= 1;
168 } 169 }
169 170
170 while (i < sizeof(av) * 8) { 171 while (i < sizeof(av) * 8) {
171 if (perm & av) { 172 if (perm & av) {
172 for (i2 = 0; i2 < ARRA 173 for (i2 = 0; i2 < ARRAY_SIZE(av_perm_to_string); i2++) {
173 if ((av_perm_t 174 if ((av_perm_to_string[i2].tclass == tclass) &&
174 (av_perm_t 175 (av_perm_to_string[i2].value == perm))
175 break; 176 break;
176 } 177 }
177 if (i2 < ARRAY_SIZE(av 178 if (i2 < ARRAY_SIZE(av_perm_to_string)) {
178 audit_log_form 179 audit_log_format(ab, " %s",
179 180 av_perm_to_string[i2].name);
180 av &= ~perm; 181 av &= ~perm;
181 } 182 }
182 } 183 }
183 i++; 184 i++;
184 perm <<= 1; 185 perm <<= 1;
185 } 186 }
186 187
187 if (av) 188 if (av)
188 audit_log_format(ab, " 0x%x", 189 audit_log_format(ab, " 0x%x", av);
189 190
190 audit_log_format(ab, " }"); 191 audit_log_format(ab, " }");
191 } 192 }
192 193
193 /** 194 /**
194 * avc_dump_query - Display a SID pair and a c 195 * avc_dump_query - Display a SID pair and a class in human-readable form.
195 * @ssid: source security identifier 196 * @ssid: source security identifier
196 * @tsid: target security identifier 197 * @tsid: target security identifier
197 * @tclass: target security class 198 * @tclass: target security class
198 */ 199 */
199 static void avc_dump_query(struct audit_buffer 200 static void avc_dump_query(struct audit_buffer *ab, u32 ssid, u32 tsid, u16 tclass)
200 { 201 {
201 int rc; 202 int rc;
202 char *scontext; 203 char *scontext;
203 u32 scontext_len; 204 u32 scontext_len;
204 205
205 rc = security_sid_to_context(ssid, &sc !! 206 rc = security_sid_to_context(ssid, &scontext, &scontext_len);
206 if (rc) 207 if (rc)
207 audit_log_format(ab, "ssid=%d" 208 audit_log_format(ab, "ssid=%d", ssid);
208 else { 209 else {
209 audit_log_format(ab, "scontext 210 audit_log_format(ab, "scontext=%s", scontext);
210 kfree(scontext); 211 kfree(scontext);
211 } 212 }
212 213
213 rc = security_sid_to_context(tsid, &sc 214 rc = security_sid_to_context(tsid, &scontext, &scontext_len);
214 if (rc) 215 if (rc)
215 audit_log_format(ab, " tsid=%d 216 audit_log_format(ab, " tsid=%d", tsid);
216 else { 217 else {
217 audit_log_format(ab, " tcontex 218 audit_log_format(ab, " tcontext=%s", scontext);
218 kfree(scontext); 219 kfree(scontext);
219 } 220 }
220 221
221 BUG_ON(tclass >= ARRAY_SIZE(class_to_s 222 BUG_ON(tclass >= ARRAY_SIZE(class_to_string) || !class_to_string[tclass]);
222 audit_log_format(ab, " tclass=%s", cla 223 audit_log_format(ab, " tclass=%s", class_to_string[tclass]);
223 } 224 }
224 225
225 /** 226 /**
226 * avc_init - Initialize the AVC. 227 * avc_init - Initialize the AVC.
227 * 228 *
228 * Initialize the access vector cache. 229 * Initialize the access vector cache.
229 */ 230 */
230 void __init avc_init(void) 231 void __init avc_init(void)
231 { 232 {
232 int i; 233 int i;
233 234
234 for (i = 0; i < AVC_CACHE_SLOTS; i++) 235 for (i = 0; i < AVC_CACHE_SLOTS; i++) {
235 INIT_LIST_HEAD(&avc_cache.slot !! 236 INIT_HLIST_HEAD(&avc_cache.slots[i]);
236 spin_lock_init(&avc_cache.slot 237 spin_lock_init(&avc_cache.slots_lock[i]);
237 } 238 }
238 atomic_set(&avc_cache.active_nodes, 0) 239 atomic_set(&avc_cache.active_nodes, 0);
239 atomic_set(&avc_cache.lru_hint, 0); 240 atomic_set(&avc_cache.lru_hint, 0);
240 241
241 avc_node_cachep = kmem_cache_create("a 242 avc_node_cachep = kmem_cache_create("avc_node", sizeof(struct avc_node),
242 0 243 0, SLAB_PANIC, NULL);
243 244
244 audit_log(current->audit_context, GFP_ 245 audit_log(current->audit_context, GFP_KERNEL, AUDIT_KERNEL, "AVC INITIALIZED\n");
245 } 246 }
246 247
247 int avc_get_hash_stats(char *page) 248 int avc_get_hash_stats(char *page)
248 { 249 {
249 int i, chain_len, max_chain_len, slots 250 int i, chain_len, max_chain_len, slots_used;
250 struct avc_node *node; 251 struct avc_node *node;
>> 252 struct hlist_head *head;
251 253
252 rcu_read_lock(); 254 rcu_read_lock();
253 255
254 slots_used = 0; 256 slots_used = 0;
255 max_chain_len = 0; 257 max_chain_len = 0;
256 for (i = 0; i < AVC_CACHE_SLOTS; i++) 258 for (i = 0; i < AVC_CACHE_SLOTS; i++) {
257 if (!list_empty(&avc_cache.slo !! 259 head = &avc_cache.slots[i];
>> 260 if (!hlist_empty(head)) {
>> 261 struct hlist_node *next;
>> 262
258 slots_used++; 263 slots_used++;
259 chain_len = 0; 264 chain_len = 0;
260 list_for_each_entry_rc !! 265 hlist_for_each_entry_rcu(node, next, head, list)
261 chain_len++; 266 chain_len++;
262 if (chain_len > max_ch 267 if (chain_len > max_chain_len)
263 max_chain_len 268 max_chain_len = chain_len;
264 } 269 }
265 } 270 }
266 271
267 rcu_read_unlock(); 272 rcu_read_unlock();
268 273
269 return scnprintf(page, PAGE_SIZE, "ent 274 return scnprintf(page, PAGE_SIZE, "entries: %d\nbuckets used: %d/%d\n"
270 "longest chain: %d\n" 275 "longest chain: %d\n",
271 atomic_read(&avc_cach 276 atomic_read(&avc_cache.active_nodes),
272 slots_used, AVC_CACHE 277 slots_used, AVC_CACHE_SLOTS, max_chain_len);
273 } 278 }
274 279
275 static void avc_node_free(struct rcu_head *rhe 280 static void avc_node_free(struct rcu_head *rhead)
276 { 281 {
277 struct avc_node *node = container_of(r 282 struct avc_node *node = container_of(rhead, struct avc_node, rhead);
278 kmem_cache_free(avc_node_cachep, node) 283 kmem_cache_free(avc_node_cachep, node);
279 avc_cache_stats_incr(frees); 284 avc_cache_stats_incr(frees);
280 } 285 }
281 286
282 static void avc_node_delete(struct avc_node *n 287 static void avc_node_delete(struct avc_node *node)
283 { 288 {
284 list_del_rcu(&node->list); !! 289 hlist_del_rcu(&node->list);
285 call_rcu(&node->rhead, avc_node_free); 290 call_rcu(&node->rhead, avc_node_free);
286 atomic_dec(&avc_cache.active_nodes); 291 atomic_dec(&avc_cache.active_nodes);
287 } 292 }
288 293
289 static void avc_node_kill(struct avc_node *nod 294 static void avc_node_kill(struct avc_node *node)
290 { 295 {
291 kmem_cache_free(avc_node_cachep, node) 296 kmem_cache_free(avc_node_cachep, node);
292 avc_cache_stats_incr(frees); 297 avc_cache_stats_incr(frees);
293 atomic_dec(&avc_cache.active_nodes); 298 atomic_dec(&avc_cache.active_nodes);
294 } 299 }
295 300
296 static void avc_node_replace(struct avc_node * 301 static void avc_node_replace(struct avc_node *new, struct avc_node *old)
297 { 302 {
298 list_replace_rcu(&old->list, &new->lis !! 303 hlist_replace_rcu(&old->list, &new->list);
299 call_rcu(&old->rhead, avc_node_free); 304 call_rcu(&old->rhead, avc_node_free);
300 atomic_dec(&avc_cache.active_nodes); 305 atomic_dec(&avc_cache.active_nodes);
301 } 306 }
302 307
303 static inline int avc_reclaim_node(void) 308 static inline int avc_reclaim_node(void)
304 { 309 {
305 struct avc_node *node; 310 struct avc_node *node;
306 int hvalue, try, ecx; 311 int hvalue, try, ecx;
307 unsigned long flags; 312 unsigned long flags;
>> 313 struct hlist_head *head;
>> 314 struct hlist_node *next;
>> 315 spinlock_t *lock;
308 316
309 for (try = 0, ecx = 0; try < AVC_CACHE !! 317 for (try = 0, ecx = 0; try < AVC_CACHE_SLOTS; try++) {
310 hvalue = atomic_inc_return(&av 318 hvalue = atomic_inc_return(&avc_cache.lru_hint) & (AVC_CACHE_SLOTS - 1);
>> 319 head = &avc_cache.slots[hvalue];
>> 320 lock = &avc_cache.slots_lock[hvalue];
311 321
312 if (!spin_trylock_irqsave(&avc !! 322 if (!spin_trylock_irqsave(lock, flags))
313 continue; 323 continue;
314 324
315 rcu_read_lock(); 325 rcu_read_lock();
316 list_for_each_entry(node, &avc !! 326 hlist_for_each_entry(node, next, head, list) {
317 if (atomic_dec_and_tes !! 327 avc_node_delete(node);
318 /* Recently Un !! 328 avc_cache_stats_incr(reclaims);
319 avc_node_delet !! 329 ecx++;
320 avc_cache_stat !! 330 if (ecx >= AVC_CACHE_RECLAIM) {
321 ecx++; !! 331 rcu_read_unlock();
322 if (ecx >= AVC !! 332 spin_unlock_irqrestore(lock, flags);
323 rcu_re !! 333 goto out;
324 spin_u <<
325 goto o <<
326 } <<
327 } 334 }
328 } 335 }
329 rcu_read_unlock(); 336 rcu_read_unlock();
330 spin_unlock_irqrestore(&avc_ca !! 337 spin_unlock_irqrestore(lock, flags);
331 } 338 }
332 out: 339 out:
333 return ecx; 340 return ecx;
334 } 341 }
335 342
336 static struct avc_node *avc_alloc_node(void) 343 static struct avc_node *avc_alloc_node(void)
337 { 344 {
338 struct avc_node *node; 345 struct avc_node *node;
339 346
340 node = kmem_cache_zalloc(avc_node_cach 347 node = kmem_cache_zalloc(avc_node_cachep, GFP_ATOMIC);
341 if (!node) 348 if (!node)
342 goto out; 349 goto out;
343 350
344 INIT_RCU_HEAD(&node->rhead); 351 INIT_RCU_HEAD(&node->rhead);
345 INIT_LIST_HEAD(&node->list); !! 352 INIT_HLIST_NODE(&node->list);
346 atomic_set(&node->ae.used, 1); <<
347 avc_cache_stats_incr(allocations); 353 avc_cache_stats_incr(allocations);
348 354
349 if (atomic_inc_return(&avc_cache.activ 355 if (atomic_inc_return(&avc_cache.active_nodes) > avc_cache_threshold)
350 avc_reclaim_node(); 356 avc_reclaim_node();
351 357
352 out: 358 out:
353 return node; 359 return node;
354 } 360 }
355 361
356 static void avc_node_populate(struct avc_node !! 362 static void avc_node_populate(struct avc_node *node, u32 ssid, u32 tsid, u16 tclass, struct av_decision *avd)
357 { 363 {
358 node->ae.ssid = ssid; 364 node->ae.ssid = ssid;
359 node->ae.tsid = tsid; 365 node->ae.tsid = tsid;
360 node->ae.tclass = tclass; 366 node->ae.tclass = tclass;
361 memcpy(&node->ae.avd, &ae->avd, sizeof !! 367 memcpy(&node->ae.avd, avd, sizeof(node->ae.avd));
362 } 368 }
363 369
364 static inline struct avc_node *avc_search_node 370 static inline struct avc_node *avc_search_node(u32 ssid, u32 tsid, u16 tclass)
365 { 371 {
366 struct avc_node *node, *ret = NULL; 372 struct avc_node *node, *ret = NULL;
367 int hvalue; 373 int hvalue;
>> 374 struct hlist_head *head;
>> 375 struct hlist_node *next;
368 376
369 hvalue = avc_hash(ssid, tsid, tclass); 377 hvalue = avc_hash(ssid, tsid, tclass);
370 list_for_each_entry_rcu(node, &avc_cac !! 378 head = &avc_cache.slots[hvalue];
>> 379 hlist_for_each_entry_rcu(node, next, head, list) {
371 if (ssid == node->ae.ssid && 380 if (ssid == node->ae.ssid &&
372 tclass == node->ae.tclass 381 tclass == node->ae.tclass &&
373 tsid == node->ae.tsid) { 382 tsid == node->ae.tsid) {
374 ret = node; 383 ret = node;
375 break; 384 break;
376 } 385 }
377 } 386 }
378 387
379 if (ret == NULL) { <<
380 /* cache miss */ <<
381 goto out; <<
382 } <<
383 <<
384 /* cache hit */ <<
385 if (atomic_read(&ret->ae.used) != 1) <<
386 atomic_set(&ret->ae.used, 1); <<
387 out: <<
388 return ret; 388 return ret;
389 } 389 }
390 390
391 /** 391 /**
392 * avc_lookup - Look up an AVC entry. 392 * avc_lookup - Look up an AVC entry.
393 * @ssid: source security identifier 393 * @ssid: source security identifier
394 * @tsid: target security identifier 394 * @tsid: target security identifier
395 * @tclass: target security class 395 * @tclass: target security class
396 * @requested: requested permissions, interpre <<
397 * 396 *
398 * Look up an AVC entry that is valid for the 397 * Look up an AVC entry that is valid for the
399 * @requested permissions between the SID pair <<
400 * (@ssid, @tsid), interpreting the permission 398 * (@ssid, @tsid), interpreting the permissions
401 * based on @tclass. If a valid AVC entry exi 399 * based on @tclass. If a valid AVC entry exists,
402 * then this function return the avc_node. 400 * then this function return the avc_node.
403 * Otherwise, this function returns NULL. 401 * Otherwise, this function returns NULL.
404 */ 402 */
405 static struct avc_node *avc_lookup(u32 ssid, u !! 403 static struct avc_node *avc_lookup(u32 ssid, u32 tsid, u16 tclass)
406 { 404 {
407 struct avc_node *node; 405 struct avc_node *node;
408 406
409 avc_cache_stats_incr(lookups); 407 avc_cache_stats_incr(lookups);
410 node = avc_search_node(ssid, tsid, tcl 408 node = avc_search_node(ssid, tsid, tclass);
411 409
412 if (node && ((node->ae.avd.decided & r !! 410 if (node)
413 avc_cache_stats_incr(hits); 411 avc_cache_stats_incr(hits);
414 goto out; !! 412 else
415 } !! 413 avc_cache_stats_incr(misses);
416 414
417 node = NULL; <<
418 avc_cache_stats_incr(misses); <<
419 out: <<
420 return node; 415 return node;
421 } 416 }
422 417
423 static int avc_latest_notif_update(int seqno, 418 static int avc_latest_notif_update(int seqno, int is_insert)
424 { 419 {
425 int ret = 0; 420 int ret = 0;
426 static DEFINE_SPINLOCK(notif_lock); 421 static DEFINE_SPINLOCK(notif_lock);
427 unsigned long flag; 422 unsigned long flag;
428 423
429 spin_lock_irqsave(¬if_lock, flag); 424 spin_lock_irqsave(¬if_lock, flag);
430 if (is_insert) { 425 if (is_insert) {
431 if (seqno < avc_cache.latest_n 426 if (seqno < avc_cache.latest_notif) {
432 printk(KERN_WARNING "a !! 427 printk(KERN_WARNING "SELinux: avc: seqno %d < latest_notif %d\n",
433 seqno, avc_cach 428 seqno, avc_cache.latest_notif);
434 ret = -EAGAIN; 429 ret = -EAGAIN;
435 } 430 }
436 } else { 431 } else {
437 if (seqno > avc_cache.latest_n 432 if (seqno > avc_cache.latest_notif)
438 avc_cache.latest_notif 433 avc_cache.latest_notif = seqno;
439 } 434 }
440 spin_unlock_irqrestore(¬if_lock, fl 435 spin_unlock_irqrestore(¬if_lock, flag);
441 436
442 return ret; 437 return ret;
443 } 438 }
444 439
445 /** 440 /**
446 * avc_insert - Insert an AVC entry. 441 * avc_insert - Insert an AVC entry.
447 * @ssid: source security identifier 442 * @ssid: source security identifier
448 * @tsid: target security identifier 443 * @tsid: target security identifier
449 * @tclass: target security class 444 * @tclass: target security class
450 * @ae: AVC entry !! 445 * @avd: resulting av decision
451 * 446 *
452 * Insert an AVC entry for the SID pair 447 * Insert an AVC entry for the SID pair
453 * (@ssid, @tsid) and class @tclass. 448 * (@ssid, @tsid) and class @tclass.
454 * The access vectors and the sequence number 449 * The access vectors and the sequence number are
455 * normally provided by the security server in 450 * normally provided by the security server in
456 * response to a security_compute_av() call. 451 * response to a security_compute_av() call. If the
457 * sequence number @ae->avd.seqno is not less !! 452 * sequence number @avd->seqno is not less than the latest
458 * revocation notification, then the function 453 * revocation notification, then the function copies
459 * the access vectors into a cache entry, retu 454 * the access vectors into a cache entry, returns
460 * avc_node inserted. Otherwise, this function 455 * avc_node inserted. Otherwise, this function returns NULL.
461 */ 456 */
462 static struct avc_node *avc_insert(u32 ssid, u !! 457 static struct avc_node *avc_insert(u32 ssid, u32 tsid, u16 tclass, struct av_decision *avd)
463 { 458 {
464 struct avc_node *pos, *node = NULL; 459 struct avc_node *pos, *node = NULL;
465 int hvalue; 460 int hvalue;
466 unsigned long flag; 461 unsigned long flag;
467 462
468 if (avc_latest_notif_update(ae->avd.se !! 463 if (avc_latest_notif_update(avd->seqno, 1))
469 goto out; 464 goto out;
470 465
471 node = avc_alloc_node(); 466 node = avc_alloc_node();
472 if (node) { 467 if (node) {
>> 468 struct hlist_head *head;
>> 469 struct hlist_node *next;
>> 470 spinlock_t *lock;
>> 471
473 hvalue = avc_hash(ssid, tsid, 472 hvalue = avc_hash(ssid, tsid, tclass);
474 avc_node_populate(node, ssid, !! 473 avc_node_populate(node, ssid, tsid, tclass, avd);
>> 474
>> 475 head = &avc_cache.slots[hvalue];
>> 476 lock = &avc_cache.slots_lock[hvalue];
475 477
476 spin_lock_irqsave(&avc_cache.s !! 478 spin_lock_irqsave(lock, flag);
477 list_for_each_entry(pos, &avc_ !! 479 hlist_for_each_entry(pos, next, head, list) {
478 if (pos->ae.ssid == ss 480 if (pos->ae.ssid == ssid &&
479 pos->ae.tsid == ts 481 pos->ae.tsid == tsid &&
480 pos->ae.tclass == 482 pos->ae.tclass == tclass) {
481 avc_node_repla !! 483 avc_node_replace(node, pos);
482 goto found; 484 goto found;
483 } 485 }
484 } 486 }
485 list_add_rcu(&node->list, &avc !! 487 hlist_add_head_rcu(&node->list, head);
486 found: 488 found:
487 spin_unlock_irqrestore(&avc_ca !! 489 spin_unlock_irqrestore(lock, flag);
488 } 490 }
489 out: 491 out:
490 return node; 492 return node;
491 } 493 }
492 494
493 static inline void avc_print_ipv6_addr(struct 495 static inline void avc_print_ipv6_addr(struct audit_buffer *ab,
494 struct 496 struct in6_addr *addr, __be16 port,
495 char *n 497 char *name1, char *name2)
496 { 498 {
497 if (!ipv6_addr_any(addr)) 499 if (!ipv6_addr_any(addr))
498 audit_log_format(ab, " %s=" NI !! 500 audit_log_format(ab, " %s=%pI6", name1, addr);
499 if (port) 501 if (port)
500 audit_log_format(ab, " %s=%d", 502 audit_log_format(ab, " %s=%d", name2, ntohs(port));
501 } 503 }
502 504
503 static inline void avc_print_ipv4_addr(struct 505 static inline void avc_print_ipv4_addr(struct audit_buffer *ab, __be32 addr,
504 __be16 506 __be16 port, char *name1, char *name2)
505 { 507 {
506 if (addr) 508 if (addr)
507 audit_log_format(ab, " %s=" NI !! 509 audit_log_format(ab, " %s=%pI4", name1, &addr);
508 if (port) 510 if (port)
509 audit_log_format(ab, " %s=%d", 511 audit_log_format(ab, " %s=%d", name2, ntohs(port));
510 } 512 }
511 513
512 /** 514 /**
513 * avc_audit - Audit the granting or denial of 515 * avc_audit - Audit the granting or denial of permissions.
514 * @ssid: source security identifier 516 * @ssid: source security identifier
515 * @tsid: target security identifier 517 * @tsid: target security identifier
516 * @tclass: target security class 518 * @tclass: target security class
517 * @requested: requested permissions 519 * @requested: requested permissions
518 * @avd: access vector decisions 520 * @avd: access vector decisions
519 * @result: result from avc_has_perm_noaudit 521 * @result: result from avc_has_perm_noaudit
520 * @a: auxiliary audit data 522 * @a: auxiliary audit data
521 * 523 *
522 * Audit the granting or denial of permissions 524 * Audit the granting or denial of permissions in accordance
523 * with the policy. This function is typicall 525 * with the policy. This function is typically called by
524 * avc_has_perm() after a permission check, bu 526 * avc_has_perm() after a permission check, but can also be
525 * called directly by callers who use avc_has_ 527 * called directly by callers who use avc_has_perm_noaudit()
526 * in order to separate the permission check f 528 * in order to separate the permission check from the auditing.
527 * For example, this separation is useful when 529 * For example, this separation is useful when the permission check must
528 * be performed under a lock, to allow the loc 530 * be performed under a lock, to allow the lock to be released
529 * before calling the auditing code. 531 * before calling the auditing code.
530 */ 532 */
531 void avc_audit(u32 ssid, u32 tsid, 533 void avc_audit(u32 ssid, u32 tsid,
532 u16 tclass, u32 requested, !! 534 u16 tclass, u32 requested,
533 struct av_decision *avd, int re !! 535 struct av_decision *avd, int result, struct avc_audit_data *a)
534 { 536 {
535 struct task_struct *tsk = current; 537 struct task_struct *tsk = current;
536 struct inode *inode = NULL; 538 struct inode *inode = NULL;
537 u32 denied, audited; 539 u32 denied, audited;
538 struct audit_buffer *ab; 540 struct audit_buffer *ab;
539 541
540 denied = requested & ~avd->allowed; 542 denied = requested & ~avd->allowed;
541 if (denied) { 543 if (denied) {
542 audited = denied; 544 audited = denied;
543 if (!(audited & avd->auditdeny 545 if (!(audited & avd->auditdeny))
544 return; 546 return;
545 } else if (result) { 547 } else if (result) {
546 audited = denied = requested; 548 audited = denied = requested;
547 } else { !! 549 } else {
548 audited = requested; 550 audited = requested;
549 if (!(audited & avd->auditallo 551 if (!(audited & avd->auditallow))
550 return; 552 return;
551 } 553 }
552 554
553 ab = audit_log_start(current->audit_co 555 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_AVC);
554 if (!ab) 556 if (!ab)
555 return; /* audit_panic 557 return; /* audit_panic has been called */
556 audit_log_format(ab, "avc: %s ", deni 558 audit_log_format(ab, "avc: %s ", denied ? "denied" : "granted");
557 avc_dump_av(ab, tclass,audited); !! 559 avc_dump_av(ab, tclass, audited);
558 audit_log_format(ab, " for "); 560 audit_log_format(ab, " for ");
559 if (a && a->tsk) 561 if (a && a->tsk)
560 tsk = a->tsk; 562 tsk = a->tsk;
561 if (tsk && tsk->pid) { 563 if (tsk && tsk->pid) {
562 audit_log_format(ab, " pid=%d 564 audit_log_format(ab, " pid=%d comm=", tsk->pid);
563 audit_log_untrustedstring(ab, 565 audit_log_untrustedstring(ab, tsk->comm);
564 } 566 }
565 if (a) { 567 if (a) {
566 switch (a->type) { 568 switch (a->type) {
567 case AVC_AUDIT_DATA_IPC: 569 case AVC_AUDIT_DATA_IPC:
568 audit_log_format(ab, " 570 audit_log_format(ab, " key=%d", a->u.ipc_id);
569 break; 571 break;
570 case AVC_AUDIT_DATA_CAP: 572 case AVC_AUDIT_DATA_CAP:
571 audit_log_format(ab, " 573 audit_log_format(ab, " capability=%d", a->u.cap);
572 break; 574 break;
573 case AVC_AUDIT_DATA_FS: 575 case AVC_AUDIT_DATA_FS:
574 if (a->u.fs.path.dentr 576 if (a->u.fs.path.dentry) {
575 struct dentry 577 struct dentry *dentry = a->u.fs.path.dentry;
576 if (a->u.fs.pa 578 if (a->u.fs.path.mnt) {
577 audit_ 579 audit_log_d_path(ab, "path=",
578 580 &a->u.fs.path);
579 } else { 581 } else {
580 audit_ 582 audit_log_format(ab, " name=");
581 audit_ 583 audit_log_untrustedstring(ab, dentry->d_name.name);
582 } 584 }
583 inode = dentry 585 inode = dentry->d_inode;
584 } else if (a->u.fs.ino 586 } else if (a->u.fs.inode) {
585 struct dentry 587 struct dentry *dentry;
586 inode = a->u.f 588 inode = a->u.fs.inode;
587 dentry = d_fin 589 dentry = d_find_alias(inode);
588 if (dentry) { 590 if (dentry) {
589 audit_ 591 audit_log_format(ab, " name=");
590 audit_ 592 audit_log_untrustedstring(ab, dentry->d_name.name);
591 dput(d 593 dput(dentry);
592 } 594 }
593 } 595 }
594 if (inode) 596 if (inode)
595 audit_log_form 597 audit_log_format(ab, " dev=%s ino=%lu",
596 598 inode->i_sb->s_id,
597 599 inode->i_ino);
598 break; 600 break;
599 case AVC_AUDIT_DATA_NET: 601 case AVC_AUDIT_DATA_NET:
600 if (a->u.net.sk) { 602 if (a->u.net.sk) {
601 struct sock *s 603 struct sock *sk = a->u.net.sk;
602 struct unix_so 604 struct unix_sock *u;
603 int len = 0; 605 int len = 0;
604 char *p = NULL 606 char *p = NULL;
605 607
606 switch (sk->sk 608 switch (sk->sk_family) {
607 case AF_INET: 609 case AF_INET: {
608 struct 610 struct inet_sock *inet = inet_sk(sk);
609 611
610 avc_pr 612 avc_print_ipv4_addr(ab, inet->rcv_saddr,
611 613 inet->sport,
612 614 "laddr", "lport");
613 avc_pr 615 avc_print_ipv4_addr(ab, inet->daddr,
614 616 inet->dport,
615 617 "faddr", "fport");
616 break; 618 break;
617 } 619 }
618 case AF_INET6: 620 case AF_INET6: {
619 struct 621 struct inet_sock *inet = inet_sk(sk);
620 struct 622 struct ipv6_pinfo *inet6 = inet6_sk(sk);
621 623
622 avc_pr 624 avc_print_ipv6_addr(ab, &inet6->rcv_saddr,
623 625 inet->sport,
624 626 "laddr", "lport");
625 avc_pr 627 avc_print_ipv6_addr(ab, &inet6->daddr,
626 628 inet->dport,
627 629 "faddr", "fport");
628 break; 630 break;
629 } 631 }
630 case AF_UNIX: 632 case AF_UNIX:
631 u = un 633 u = unix_sk(sk);
632 if (u- 634 if (u->dentry) {
633 635 struct path path = {
634 636 .dentry = u->dentry,
635 637 .mnt = u->mnt
636 638 };
637 639 audit_log_d_path(ab, "path=",
638 640 &path);
639 641 break;
640 } 642 }
641 if (!u 643 if (!u->addr)
642 644 break;
643 len = 645 len = u->addr->len-sizeof(short);
644 p = &u 646 p = &u->addr->name->sun_path[0];
645 audit_ 647 audit_log_format(ab, " path=");
646 if (*p 648 if (*p)
647 649 audit_log_untrustedstring(ab, p);
648 else 650 else
649 !! 651 audit_log_n_hex(ab, p, len);
650 break; 652 break;
651 } 653 }
652 } 654 }
653 !! 655
654 switch (a->u.net.famil 656 switch (a->u.net.family) {
655 case AF_INET: 657 case AF_INET:
656 avc_print_ipv4 658 avc_print_ipv4_addr(ab, a->u.net.v4info.saddr,
657 659 a->u.net.sport,
658 660 "saddr", "src");
659 avc_print_ipv4 661 avc_print_ipv4_addr(ab, a->u.net.v4info.daddr,
660 662 a->u.net.dport,
661 663 "daddr", "dest");
662 break; 664 break;
663 case AF_INET6: 665 case AF_INET6:
664 avc_print_ipv6 666 avc_print_ipv6_addr(ab, &a->u.net.v6info.saddr,
665 667 a->u.net.sport,
666 668 "saddr", "src");
667 avc_print_ipv6 669 avc_print_ipv6_addr(ab, &a->u.net.v6info.daddr,
668 670 a->u.net.dport,
669 671 "daddr", "dest");
670 break; 672 break;
671 } 673 }
672 if (a->u.net.netif > 0 674 if (a->u.net.netif > 0) {
673 struct net_dev 675 struct net_device *dev;
674 676
675 /* NOTE: we al 677 /* NOTE: we always use init's namespace */
676 dev = dev_get_ 678 dev = dev_get_by_index(&init_net,
677 679 a->u.net.netif);
678 if (dev) { 680 if (dev) {
679 audit_ 681 audit_log_format(ab, " netif=%s",
680 682 dev->name);
681 dev_pu 683 dev_put(dev);
682 } 684 }
683 } 685 }
684 break; 686 break;
685 } 687 }
686 } 688 }
687 audit_log_format(ab, " "); 689 audit_log_format(ab, " ");
688 avc_dump_query(ab, ssid, tsid, tclass) 690 avc_dump_query(ab, ssid, tsid, tclass);
689 audit_log_end(ab); 691 audit_log_end(ab);
690 } 692 }
691 693
692 /** 694 /**
693 * avc_add_callback - Register a callback for 695 * avc_add_callback - Register a callback for security events.
694 * @callback: callback function 696 * @callback: callback function
695 * @events: security events 697 * @events: security events
696 * @ssid: source security identifier or %SECSI 698 * @ssid: source security identifier or %SECSID_WILD
697 * @tsid: target security identifier or %SECSI 699 * @tsid: target security identifier or %SECSID_WILD
698 * @tclass: target security class 700 * @tclass: target security class
699 * @perms: permissions 701 * @perms: permissions
700 * 702 *
701 * Register a callback function for events in 703 * Register a callback function for events in the set @events
702 * related to the SID pair (@ssid, @tsid) and 704 * related to the SID pair (@ssid, @tsid) and
703 * and the permissions @perms, interpreting 705 * and the permissions @perms, interpreting
704 * @perms based on @tclass. Returns %0 on suc 706 * @perms based on @tclass. Returns %0 on success or
705 * -%ENOMEM if insufficient memory exists to a 707 * -%ENOMEM if insufficient memory exists to add the callback.
706 */ 708 */
707 int avc_add_callback(int (*callback)(u32 event 709 int avc_add_callback(int (*callback)(u32 event, u32 ssid, u32 tsid,
708 u16 tclas !! 710 u16 tclass, u32 perms,
709 u32 *out_ !! 711 u32 *out_retained),
710 u32 events, u32 ssid, u32 !! 712 u32 events, u32 ssid, u32 tsid,
711 u16 tclass, u32 perms) !! 713 u16 tclass, u32 perms)
712 { 714 {
713 struct avc_callback_node *c; 715 struct avc_callback_node *c;
714 int rc = 0; 716 int rc = 0;
715 717
716 c = kmalloc(sizeof(*c), GFP_ATOMIC); 718 c = kmalloc(sizeof(*c), GFP_ATOMIC);
717 if (!c) { 719 if (!c) {
718 rc = -ENOMEM; 720 rc = -ENOMEM;
719 goto out; 721 goto out;
720 } 722 }
721 723
722 c->callback = callback; 724 c->callback = callback;
723 c->events = events; 725 c->events = events;
724 c->ssid = ssid; 726 c->ssid = ssid;
725 c->tsid = tsid; 727 c->tsid = tsid;
726 c->perms = perms; 728 c->perms = perms;
727 c->next = avc_callbacks; 729 c->next = avc_callbacks;
728 avc_callbacks = c; 730 avc_callbacks = c;
729 out: 731 out:
730 return rc; 732 return rc;
731 } 733 }
732 734
733 static inline int avc_sidcmp(u32 x, u32 y) 735 static inline int avc_sidcmp(u32 x, u32 y)
734 { 736 {
735 return (x == y || x == SECSID_WILD || 737 return (x == y || x == SECSID_WILD || y == SECSID_WILD);
736 } 738 }
737 739
738 /** 740 /**
739 * avc_update_node Update an AVC entry 741 * avc_update_node Update an AVC entry
740 * @event : Updating event 742 * @event : Updating event
741 * @perms : Permission mask bits 743 * @perms : Permission mask bits
742 * @ssid,@tsid,@tclass : identifier of an AVC 744 * @ssid,@tsid,@tclass : identifier of an AVC entry
>> 745 * @seqno : sequence number when decision was made
743 * 746 *
744 * if a valid AVC entry doesn't exist,this fun 747 * if a valid AVC entry doesn't exist,this function returns -ENOENT.
745 * if kmalloc() called internal returns NULL, 748 * if kmalloc() called internal returns NULL, this function returns -ENOMEM.
746 * otherwise, this function update the AVC ent 749 * otherwise, this function update the AVC entry. The original AVC-entry object
747 * will release later by RCU. 750 * will release later by RCU.
748 */ 751 */
749 static int avc_update_node(u32 event, u32 perm !! 752 static int avc_update_node(u32 event, u32 perms, u32 ssid, u32 tsid, u16 tclass,
>> 753 u32 seqno)
750 { 754 {
751 int hvalue, rc = 0; 755 int hvalue, rc = 0;
752 unsigned long flag; 756 unsigned long flag;
753 struct avc_node *pos, *node, *orig = N 757 struct avc_node *pos, *node, *orig = NULL;
>> 758 struct hlist_head *head;
>> 759 struct hlist_node *next;
>> 760 spinlock_t *lock;
754 761
755 node = avc_alloc_node(); 762 node = avc_alloc_node();
756 if (!node) { 763 if (!node) {
757 rc = -ENOMEM; 764 rc = -ENOMEM;
758 goto out; 765 goto out;
759 } 766 }
760 767
761 /* Lock the target slot */ 768 /* Lock the target slot */
762 hvalue = avc_hash(ssid, tsid, tclass); 769 hvalue = avc_hash(ssid, tsid, tclass);
763 spin_lock_irqsave(&avc_cache.slots_loc <<
764 770
765 list_for_each_entry(pos, &avc_cache.sl !! 771 head = &avc_cache.slots[hvalue];
766 if ( ssid==pos->ae.ssid && !! 772 lock = &avc_cache.slots_lock[hvalue];
767 tsid==pos->ae.tsid && !! 773
768 tclass==pos->ae.tclass ){ !! 774 spin_lock_irqsave(lock, flag);
>> 775
>> 776 hlist_for_each_entry(pos, next, head, list) {
>> 777 if (ssid == pos->ae.ssid &&
>> 778 tsid == pos->ae.tsid &&
>> 779 tclass == pos->ae.tclass &&
>> 780 seqno == pos->ae.avd.seqno){
769 orig = pos; 781 orig = pos;
770 break; 782 break;
771 } 783 }
772 } 784 }
773 785
774 if (!orig) { 786 if (!orig) {
775 rc = -ENOENT; 787 rc = -ENOENT;
776 avc_node_kill(node); 788 avc_node_kill(node);
777 goto out_unlock; 789 goto out_unlock;
778 } 790 }
779 791
780 /* 792 /*
781 * Copy and replace original node. 793 * Copy and replace original node.
782 */ 794 */
783 795
784 avc_node_populate(node, ssid, tsid, tc !! 796 avc_node_populate(node, ssid, tsid, tclass, &orig->ae.avd);
785 797
786 switch (event) { 798 switch (event) {
787 case AVC_CALLBACK_GRANT: 799 case AVC_CALLBACK_GRANT:
788 node->ae.avd.allowed |= perms; 800 node->ae.avd.allowed |= perms;
789 break; 801 break;
790 case AVC_CALLBACK_TRY_REVOKE: 802 case AVC_CALLBACK_TRY_REVOKE:
791 case AVC_CALLBACK_REVOKE: 803 case AVC_CALLBACK_REVOKE:
792 node->ae.avd.allowed &= ~perms 804 node->ae.avd.allowed &= ~perms;
793 break; 805 break;
794 case AVC_CALLBACK_AUDITALLOW_ENABLE: 806 case AVC_CALLBACK_AUDITALLOW_ENABLE:
795 node->ae.avd.auditallow |= per 807 node->ae.avd.auditallow |= perms;
796 break; 808 break;
797 case AVC_CALLBACK_AUDITALLOW_DISABLE: 809 case AVC_CALLBACK_AUDITALLOW_DISABLE:
798 node->ae.avd.auditallow &= ~pe 810 node->ae.avd.auditallow &= ~perms;
799 break; 811 break;
800 case AVC_CALLBACK_AUDITDENY_ENABLE: 812 case AVC_CALLBACK_AUDITDENY_ENABLE:
801 node->ae.avd.auditdeny |= perm 813 node->ae.avd.auditdeny |= perms;
802 break; 814 break;
803 case AVC_CALLBACK_AUDITDENY_DISABLE: 815 case AVC_CALLBACK_AUDITDENY_DISABLE:
804 node->ae.avd.auditdeny &= ~per 816 node->ae.avd.auditdeny &= ~perms;
805 break; 817 break;
806 } 818 }
807 avc_node_replace(node, orig); 819 avc_node_replace(node, orig);
808 out_unlock: 820 out_unlock:
809 spin_unlock_irqrestore(&avc_cache.slot !! 821 spin_unlock_irqrestore(lock, flag);
810 out: 822 out:
811 return rc; 823 return rc;
812 } 824 }
813 825
814 /** 826 /**
815 * avc_ss_reset - Flush the cache and revalida 827 * avc_ss_reset - Flush the cache and revalidate migrated permissions.
816 * @seqno: policy sequence number 828 * @seqno: policy sequence number
817 */ 829 */
818 int avc_ss_reset(u32 seqno) 830 int avc_ss_reset(u32 seqno)
819 { 831 {
820 struct avc_callback_node *c; 832 struct avc_callback_node *c;
821 int i, rc = 0, tmprc; 833 int i, rc = 0, tmprc;
822 unsigned long flag; 834 unsigned long flag;
823 struct avc_node *node; 835 struct avc_node *node;
>> 836 struct hlist_head *head;
>> 837 struct hlist_node *next;
>> 838 spinlock_t *lock;
824 839
825 for (i = 0; i < AVC_CACHE_SLOTS; i++) 840 for (i = 0; i < AVC_CACHE_SLOTS; i++) {
826 spin_lock_irqsave(&avc_cache.s !! 841 head = &avc_cache.slots[i];
>> 842 lock = &avc_cache.slots_lock[i];
>> 843
>> 844 spin_lock_irqsave(lock, flag);
827 /* 845 /*
828 * On -rt the outer spinlock d !! 846 * With preemptable RCU, the outer spinlock does not
829 * from being performed: !! 847 * prevent RCU grace periods from ending.
830 */ 848 */
831 rcu_read_lock(); 849 rcu_read_lock();
832 list_for_each_entry(node, &avc !! 850 hlist_for_each_entry(node, next, head, list)
833 avc_node_delete(node); 851 avc_node_delete(node);
834 rcu_read_unlock(); 852 rcu_read_unlock();
835 spin_unlock_irqrestore(&avc_ca !! 853 spin_unlock_irqrestore(lock, flag);
836 } 854 }
837 855
838 for (c = avc_callbacks; c; c = c->next 856 for (c = avc_callbacks; c; c = c->next) {
839 if (c->events & AVC_CALLBACK_R 857 if (c->events & AVC_CALLBACK_RESET) {
840 tmprc = c->callback(AV 858 tmprc = c->callback(AVC_CALLBACK_RESET,
841 0, !! 859 0, 0, 0, 0, NULL);
842 /* save the first erro 860 /* save the first error encountered for the return
843 value and continue 861 value and continue processing the callbacks */
844 if (!rc) 862 if (!rc)
845 rc = tmprc; 863 rc = tmprc;
846 } 864 }
847 } 865 }
848 866
849 avc_latest_notif_update(seqno, 0); 867 avc_latest_notif_update(seqno, 0);
850 return rc; 868 return rc;
851 } 869 }
852 870
853 /** 871 /**
854 * avc_has_perm_noaudit - Check permissions bu 872 * avc_has_perm_noaudit - Check permissions but perform no auditing.
855 * @ssid: source security identifier 873 * @ssid: source security identifier
856 * @tsid: target security identifier 874 * @tsid: target security identifier
857 * @tclass: target security class 875 * @tclass: target security class
858 * @requested: requested permissions, interpre 876 * @requested: requested permissions, interpreted based on @tclass
859 * @flags: AVC_STRICT or 0 877 * @flags: AVC_STRICT or 0
860 * @avd: access vector decisions 878 * @avd: access vector decisions
861 * 879 *
862 * Check the AVC to determine whether the @req 880 * Check the AVC to determine whether the @requested permissions are granted
863 * for the SID pair (@ssid, @tsid), interpreti 881 * for the SID pair (@ssid, @tsid), interpreting the permissions
864 * based on @tclass, and call the security ser 882 * based on @tclass, and call the security server on a cache miss to obtain
865 * a new decision and add it to the cache. Re 883 * a new decision and add it to the cache. Return a copy of the decisions
866 * in @avd. Return %0 if all @requested permi 884 * in @avd. Return %0 if all @requested permissions are granted,
867 * -%EACCES if any permissions are denied, or 885 * -%EACCES if any permissions are denied, or another -errno upon
868 * other errors. This function is typically c 886 * other errors. This function is typically called by avc_has_perm(),
869 * but may also be called directly to separate 887 * but may also be called directly to separate permission checking from
870 * auditing, e.g. in cases where a lock must b 888 * auditing, e.g. in cases where a lock must be held for the check but
871 * should be released for the auditing. 889 * should be released for the auditing.
872 */ 890 */
873 int avc_has_perm_noaudit(u32 ssid, u32 tsid, 891 int avc_has_perm_noaudit(u32 ssid, u32 tsid,
874 u16 tclass, u32 reque 892 u16 tclass, u32 requested,
875 unsigned flags, 893 unsigned flags,
876 struct av_decision *a !! 894 struct av_decision *in_avd)
877 { 895 {
878 struct avc_node *node; 896 struct avc_node *node;
879 struct avc_entry entry, *p_ae; !! 897 struct av_decision avd_entry, *avd;
880 int rc = 0; 898 int rc = 0;
881 u32 denied; 899 u32 denied;
882 900
>> 901 BUG_ON(!requested);
>> 902
883 rcu_read_lock(); 903 rcu_read_lock();
884 904
885 node = avc_lookup(ssid, tsid, tclass, !! 905 node = avc_lookup(ssid, tsid, tclass);
886 if (!node) { 906 if (!node) {
887 rcu_read_unlock(); 907 rcu_read_unlock();
888 rc = security_compute_av(ssid, !! 908
>> 909 if (in_avd)
>> 910 avd = in_avd;
>> 911 else
>> 912 avd = &avd_entry;
>> 913
>> 914 rc = security_compute_av(ssid, tsid, tclass, requested, avd);
889 if (rc) 915 if (rc)
890 goto out; 916 goto out;
891 rcu_read_lock(); 917 rcu_read_lock();
892 node = avc_insert(ssid,tsid,tc !! 918 node = avc_insert(ssid, tsid, tclass, avd);
>> 919 } else {
>> 920 if (in_avd)
>> 921 memcpy(in_avd, &node->ae.avd, sizeof(*in_avd));
>> 922 avd = &node->ae.avd;
893 } 923 }
894 924
895 p_ae = node ? &node->ae : &entry; !! 925 denied = requested & ~(avd->allowed);
896 <<
897 if (avd) <<
898 memcpy(avd, &p_ae->avd, sizeof <<
899 926
900 denied = requested & ~(p_ae->avd.allow !! 927 if (denied) {
901 !! 928 if (flags & AVC_STRICT)
902 if (!requested || denied) { <<
903 if (selinux_enforcing || (flag <<
904 rc = -EACCES; 929 rc = -EACCES;
>> 930 else if (!selinux_enforcing || (avd->flags & AVD_FLAGS_PERMISSIVE))
>> 931 avc_update_node(AVC_CALLBACK_GRANT, requested, ssid,
>> 932 tsid, tclass, avd->seqno);
905 else 933 else
906 if (node) !! 934 rc = -EACCES;
907 avc_update_nod <<
908 <<
909 } 935 }
910 936
911 rcu_read_unlock(); 937 rcu_read_unlock();
912 out: 938 out:
913 return rc; 939 return rc;
914 } 940 }
915 941
916 /** 942 /**
917 * avc_has_perm - Check permissions and perfor 943 * avc_has_perm - Check permissions and perform any appropriate auditing.
918 * @ssid: source security identifier 944 * @ssid: source security identifier
919 * @tsid: target security identifier 945 * @tsid: target security identifier
920 * @tclass: target security class 946 * @tclass: target security class
921 * @requested: requested permissions, interpre 947 * @requested: requested permissions, interpreted based on @tclass
922 * @auditdata: auxiliary audit data 948 * @auditdata: auxiliary audit data
923 * 949 *
924 * Check the AVC to determine whether the @req 950 * Check the AVC to determine whether the @requested permissions are granted
925 * for the SID pair (@ssid, @tsid), interpreti 951 * for the SID pair (@ssid, @tsid), interpreting the permissions
926 * based on @tclass, and call the security ser 952 * based on @tclass, and call the security server on a cache miss to obtain
927 * a new decision and add it to the cache. Au 953 * a new decision and add it to the cache. Audit the granting or denial of
928 * permissions in accordance with the policy. 954 * permissions in accordance with the policy. Return %0 if all @requested
929 * permissions are granted, -%EACCES if any pe 955 * permissions are granted, -%EACCES if any permissions are denied, or
930 * another -errno upon other errors. 956 * another -errno upon other errors.
931 */ 957 */
932 int avc_has_perm(u32 ssid, u32 tsid, u16 tclas 958 int avc_has_perm(u32 ssid, u32 tsid, u16 tclass,
933 u32 requested, struct avc_aud !! 959 u32 requested, struct avc_audit_data *auditdata)
934 { 960 {
935 struct av_decision avd; 961 struct av_decision avd;
936 int rc; 962 int rc;
937 963
938 rc = avc_has_perm_noaudit(ssid, tsid, 964 rc = avc_has_perm_noaudit(ssid, tsid, tclass, requested, 0, &avd);
939 avc_audit(ssid, tsid, tclass, requeste 965 avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata);
940 return rc; 966 return rc;
941 } 967 }
942 968
943 u32 avc_policy_seqno(void) 969 u32 avc_policy_seqno(void)
944 { 970 {
945 return avc_cache.latest_notif; 971 return avc_cache.latest_notif;
946 } 972 }
947 973
|
This page was automatically generated by the
LXR engine.
|