Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Access vector cache interface for object managers. |
| 3 | * |
| 4 | * Author : Stephen Smalley, <sds@epoch.ncsc.mil> |
| 5 | */ |
| 6 | #ifndef _SELINUX_AVC_H_ |
| 7 | #define _SELINUX_AVC_H_ |
| 8 | |
| 9 | #include <linux/stddef.h> |
| 10 | #include <linux/errno.h> |
| 11 | #include <linux/kernel.h> |
| 12 | #include <linux/kdev_t.h> |
| 13 | #include <linux/spinlock.h> |
| 14 | #include <linux/init.h> |
KaiGai Kohei | d9250de | 2008-08-28 16:35:57 +0900 | [diff] [blame] | 15 | #include <linux/audit.h> |
Thomas Liu | 2bf4969 | 2009-07-14 12:14:09 -0400 | [diff] [blame] | 16 | #include <linux/lsm_audit.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 17 | #include <linux/in6.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 18 | #include "flask.h" |
| 19 | #include "av_permissions.h" |
| 20 | #include "security.h" |
| 21 | |
| 22 | #ifdef CONFIG_SECURITY_SELINUX_DEVELOP |
| 23 | extern int selinux_enforcing; |
| 24 | #else |
| 25 | #define selinux_enforcing 1 |
| 26 | #endif |
| 27 | |
| 28 | /* |
| 29 | * An entry in the AVC. |
| 30 | */ |
| 31 | struct avc_entry; |
| 32 | |
| 33 | struct task_struct; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 34 | struct inode; |
| 35 | struct sock; |
| 36 | struct sk_buff; |
| 37 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 38 | /* |
| 39 | * AVC statistics |
| 40 | */ |
Eric Paris | f526971 | 2008-05-14 11:27:45 -0400 | [diff] [blame] | 41 | struct avc_cache_stats { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 42 | unsigned int lookups; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 43 | unsigned int misses; |
| 44 | unsigned int allocations; |
| 45 | unsigned int reclaims; |
| 46 | unsigned int frees; |
| 47 | }; |
| 48 | |
| 49 | /* |
| 50 | * AVC operations |
| 51 | */ |
| 52 | |
| 53 | void __init avc_init(void); |
| 54 | |
Eric Paris | 9ade0cf | 2011-04-25 16:26:29 -0400 | [diff] [blame] | 55 | int avc_audit(u32 ssid, u32 tsid, |
Eric Paris | f526971 | 2008-05-14 11:27:45 -0400 | [diff] [blame] | 56 | u16 tclass, u32 requested, |
Thomas Liu | 2bf4969 | 2009-07-14 12:14:09 -0400 | [diff] [blame] | 57 | struct av_decision *avd, |
| 58 | int result, |
Eric Paris | 9ade0cf | 2011-04-25 16:26:29 -0400 | [diff] [blame] | 59 | struct common_audit_data *a, unsigned flags); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 60 | |
Stephen Smalley | 2c3c05d | 2007-06-07 15:34:10 -0400 | [diff] [blame] | 61 | #define AVC_STRICT 1 /* Ignore permissive mode. */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 62 | int avc_has_perm_noaudit(u32 ssid, u32 tsid, |
Stephen Smalley | 2c3c05d | 2007-06-07 15:34:10 -0400 | [diff] [blame] | 63 | u16 tclass, u32 requested, |
| 64 | unsigned flags, |
| 65 | struct av_decision *avd); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 66 | |
Eric Paris | 9ade0cf | 2011-04-25 16:26:29 -0400 | [diff] [blame] | 67 | int avc_has_perm_flags(u32 ssid, u32 tsid, |
| 68 | u16 tclass, u32 requested, |
| 69 | struct common_audit_data *auditdata, |
| 70 | unsigned); |
| 71 | |
| 72 | static inline int avc_has_perm(u32 ssid, u32 tsid, |
| 73 | u16 tclass, u32 requested, |
| 74 | struct common_audit_data *auditdata) |
| 75 | { |
| 76 | return avc_has_perm_flags(ssid, tsid, tclass, requested, auditdata, 0); |
| 77 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 78 | |
Yuichi Nakamura | 788e7dd | 2007-09-14 09:27:07 +0900 | [diff] [blame] | 79 | u32 avc_policy_seqno(void); |
| 80 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 81 | #define AVC_CALLBACK_GRANT 1 |
| 82 | #define AVC_CALLBACK_TRY_REVOKE 2 |
| 83 | #define AVC_CALLBACK_REVOKE 4 |
| 84 | #define AVC_CALLBACK_RESET 8 |
| 85 | #define AVC_CALLBACK_AUDITALLOW_ENABLE 16 |
| 86 | #define AVC_CALLBACK_AUDITALLOW_DISABLE 32 |
| 87 | #define AVC_CALLBACK_AUDITDENY_ENABLE 64 |
| 88 | #define AVC_CALLBACK_AUDITDENY_DISABLE 128 |
| 89 | |
| 90 | int avc_add_callback(int (*callback)(u32 event, u32 ssid, u32 tsid, |
Eric Paris | f526971 | 2008-05-14 11:27:45 -0400 | [diff] [blame] | 91 | u16 tclass, u32 perms, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 92 | u32 *out_retained), |
| 93 | u32 events, u32 ssid, u32 tsid, |
| 94 | u16 tclass, u32 perms); |
| 95 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 96 | /* Exported to selinuxfs */ |
| 97 | int avc_get_hash_stats(char *page); |
| 98 | extern unsigned int avc_cache_threshold; |
| 99 | |
Thomas Liu | 89c8657 | 2009-06-24 17:58:05 -0400 | [diff] [blame] | 100 | /* Attempt to free avc node cache */ |
| 101 | void avc_disable(void); |
| 102 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 103 | #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS |
| 104 | DECLARE_PER_CPU(struct avc_cache_stats, avc_cache_stats); |
| 105 | #endif |
| 106 | |
| 107 | #endif /* _SELINUX_AVC_H_ */ |
| 108 | |