Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * An access vector table (avtab) is a hash table |
| 3 | * of access vectors and transition types indexed |
| 4 | * by a type pair and a class. An access vector |
| 5 | * table is used to represent the type enforcement |
| 6 | * tables. |
| 7 | * |
| 8 | * Author : Stephen Smalley, <sds@epoch.ncsc.mil> |
| 9 | */ |
| 10 | |
| 11 | /* Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com> |
| 12 | * |
| 13 | * Added conditional policy language extensions |
| 14 | * |
| 15 | * Copyright (C) 2003 Tresys Technology, LLC |
| 16 | * This program is free software; you can redistribute it and/or modify |
Eric Paris | 652bb9b | 2011-02-01 11:05:40 -0500 | [diff] [blame] | 17 | * it under the terms of the GNU General Public License as published by |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 18 | * the Free Software Foundation, version 2. |
Yuichi Nakamura | 3232c11 | 2007-08-24 11:55:11 +0900 | [diff] [blame] | 19 | * |
| 20 | * Updated: Yuichi Nakamura <ynakam@hitachisoft.jp> |
| 21 | * Tuned number of hash slots for avtab to reduce memory usage |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 22 | */ |
| 23 | #ifndef _SS_AVTAB_H_ |
| 24 | #define _SS_AVTAB_H_ |
| 25 | |
Jeff Vander Stoep | 581be71 | 2015-07-10 17:19:56 -0400 | [diff] [blame^] | 26 | #include "security.h" |
| 27 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 28 | struct avtab_key { |
Stephen Smalley | 782ebb9 | 2005-09-03 15:55:16 -0700 | [diff] [blame] | 29 | u16 source_type; /* source type */ |
| 30 | u16 target_type; /* target type */ |
| 31 | u16 target_class; /* target object class */ |
Eric Paris | 652bb9b | 2011-02-01 11:05:40 -0500 | [diff] [blame] | 32 | #define AVTAB_ALLOWED 0x0001 |
| 33 | #define AVTAB_AUDITALLOW 0x0002 |
| 34 | #define AVTAB_AUDITDENY 0x0004 |
| 35 | #define AVTAB_AV (AVTAB_ALLOWED | AVTAB_AUDITALLOW | AVTAB_AUDITDENY) |
| 36 | #define AVTAB_TRANSITION 0x0010 |
| 37 | #define AVTAB_MEMBER 0x0020 |
| 38 | #define AVTAB_CHANGE 0x0040 |
| 39 | #define AVTAB_TYPE (AVTAB_TRANSITION | AVTAB_MEMBER | AVTAB_CHANGE) |
Jeff Vander Stoep | 581be71 | 2015-07-10 17:19:56 -0400 | [diff] [blame^] | 40 | /* extended permissions */ |
| 41 | #define AVTAB_XPERMS_ALLOWED 0x0100 |
| 42 | #define AVTAB_XPERMS_AUDITALLOW 0x0200 |
| 43 | #define AVTAB_XPERMS_DONTAUDIT 0x0400 |
| 44 | #define AVTAB_XPERMS (AVTAB_XPERMS_ALLOWED | \ |
| 45 | AVTAB_XPERMS_AUDITALLOW | \ |
| 46 | AVTAB_XPERMS_DONTAUDIT) |
Eric Paris | 652bb9b | 2011-02-01 11:05:40 -0500 | [diff] [blame] | 47 | #define AVTAB_ENABLED_OLD 0x80000000 /* reserved for used in cond_avtab */ |
| 48 | #define AVTAB_ENABLED 0x8000 /* reserved for used in cond_avtab */ |
Stephen Smalley | 782ebb9 | 2005-09-03 15:55:16 -0700 | [diff] [blame] | 49 | u16 specified; /* what field is specified */ |
| 50 | }; |
| 51 | |
Jeff Vander Stoep | 581be71 | 2015-07-10 17:19:56 -0400 | [diff] [blame^] | 52 | /* |
| 53 | * For operations that require more than the 32 permissions provided by the avc |
| 54 | * extended permissions may be used to provide 256 bits of permissions. |
| 55 | */ |
| 56 | struct avtab_extended_perms { |
| 57 | /* These are not flags. All 256 values may be used */ |
| 58 | #define AVTAB_XPERMS_IOCTLFUNCTION 0x01 |
| 59 | #define AVTAB_XPERMS_IOCTLDRIVER 0x02 |
| 60 | /* extension of the avtab_key specified */ |
| 61 | u8 specified; /* ioctl, netfilter, ... */ |
| 62 | /* |
| 63 | * if 256 bits is not adequate as is often the case with ioctls, then |
| 64 | * multiple extended perms may be used and the driver field |
| 65 | * specifies which permissions are included. |
| 66 | */ |
| 67 | u8 driver; |
| 68 | /* 256 bits of permissions */ |
| 69 | struct extended_perms_data perms; |
| 70 | }; |
| 71 | |
Stephen Smalley | 782ebb9 | 2005-09-03 15:55:16 -0700 | [diff] [blame] | 72 | struct avtab_datum { |
Jeff Vander Stoep | 581be71 | 2015-07-10 17:19:56 -0400 | [diff] [blame^] | 73 | union { |
| 74 | u32 data; /* access vector or type value */ |
| 75 | struct avtab_extended_perms *xperms; |
| 76 | } u; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 77 | }; |
| 78 | |
| 79 | struct avtab_node { |
| 80 | struct avtab_key key; |
| 81 | struct avtab_datum datum; |
| 82 | struct avtab_node *next; |
| 83 | }; |
| 84 | |
| 85 | struct avtab { |
| 86 | struct avtab_node **htable; |
| 87 | u32 nel; /* number of elements */ |
Yuichi Nakamura | 3232c11 | 2007-08-24 11:55:11 +0900 | [diff] [blame] | 88 | u32 nslot; /* number of hash slots */ |
| 89 | u16 mask; /* mask to compute hash func */ |
| 90 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 91 | }; |
| 92 | |
| 93 | int avtab_init(struct avtab *); |
Yuichi Nakamura | 3232c11 | 2007-08-24 11:55:11 +0900 | [diff] [blame] | 94 | int avtab_alloc(struct avtab *, u32); |
Stephen Smalley | 782ebb9 | 2005-09-03 15:55:16 -0700 | [diff] [blame] | 95 | struct avtab_datum *avtab_search(struct avtab *h, struct avtab_key *k); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 96 | void avtab_destroy(struct avtab *h); |
| 97 | void avtab_hash_eval(struct avtab *h, char *tag); |
| 98 | |
Stephen Smalley | 45e5421 | 2007-11-07 10:08:00 -0500 | [diff] [blame] | 99 | struct policydb; |
| 100 | int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol, |
Stephen Smalley | 782ebb9 | 2005-09-03 15:55:16 -0700 | [diff] [blame] | 101 | int (*insert)(struct avtab *a, struct avtab_key *k, |
| 102 | struct avtab_datum *d, void *p), |
| 103 | void *p); |
| 104 | |
Stephen Smalley | 45e5421 | 2007-11-07 10:08:00 -0500 | [diff] [blame] | 105 | int avtab_read(struct avtab *a, void *fp, struct policydb *pol); |
Eric Paris | cee74f4 | 2010-10-13 17:50:25 -0400 | [diff] [blame] | 106 | int avtab_write_item(struct policydb *p, struct avtab_node *cur, void *fp); |
| 107 | int avtab_write(struct policydb *p, struct avtab *a, void *fp); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 108 | |
| 109 | struct avtab_node *avtab_insert_nonunique(struct avtab *h, struct avtab_key *key, |
| 110 | struct avtab_datum *datum); |
| 111 | |
Stephen Smalley | 782ebb9 | 2005-09-03 15:55:16 -0700 | [diff] [blame] | 112 | struct avtab_node *avtab_search_node(struct avtab *h, struct avtab_key *key); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 113 | |
| 114 | struct avtab_node *avtab_search_node_next(struct avtab_node *node, int specified); |
| 115 | |
| 116 | void avtab_cache_init(void); |
| 117 | void avtab_cache_destroy(void); |
| 118 | |
Stephen Smalley | 6c9ff10 | 2010-03-15 10:42:11 -0400 | [diff] [blame] | 119 | #define MAX_AVTAB_HASH_BITS 11 |
Yuichi Nakamura | 3232c11 | 2007-08-24 11:55:11 +0900 | [diff] [blame] | 120 | #define MAX_AVTAB_HASH_BUCKETS (1 << MAX_AVTAB_HASH_BITS) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 121 | |
| 122 | #endif /* _SS_AVTAB_H_ */ |
| 123 | |