/*
* Implementation of the userspace access vector cache (AVC).
*
* Author : Eamon Walsh <ewalsh@epoch.ncsc.mil>
*
* Derived from the kernel AVC implementation by
* Stephen Smalley <sds@epoch.ncsc.mil> and
* James Morris <jmorris@redhat.com>.
*/
#include <selinux/avc.h>
#include "selinux_internal.h"
#include <assert.h>
#include "avc_sidtab.h"
#include "avc_internal.h"
#define AVC_CACHE_SLOTS 512
#define AVC_CACHE_MAXNODES 410
struct avc_entry {
security_id_t ssid;
security_id_t tsid;
security_class_t tclass;
struct av_decision avd;
security_id_t create_sid;
int used; /* used recently */
};
struct avc_node {
struct avc_entry ae;
struct avc_node *next;
};
struct avc_cache {
struct avc_node *slots[AVC_CACHE_SLOTS];
uint32_t lru_hint; /* LRU hint for reclaim scan */
uint32_t active_nodes;
uint32_t latest_notif; /* latest revocation notification */
};
struct avc_callback_node {
int (*callback) (uint32_t event, security_id_t ssid,
security_id_t tsid,
security_class_t tclass, access_vector_t perms,
access_vector_t * out_retained);
uint32_t events;
security_id_t ssid;
security_id_t tsid;
security_class_t tclass;
access_vector_t perms;
struct avc_callback_node *next;
};
static void *avc_netlink_thread = NULL;
static void *avc_lock = NULL;
static void *avc_log_lock = NULL;
static struct avc_node *avc_node_freelist = NULL;
static struct avc_cache avc_cache;
static char *avc_audit_buf = NULL;
static struct avc_cache_stats cache_stats;
static struct avc_callback_node *avc_callbacks = NULL;
static struct sidtab avc_sidtab;
static inline int avc_hash(security_id_t ssid,
security_id_t tsid, security_class_t tclass)
{
return ((uintptr_t) ssid ^ ((uintptr_t) tsid << 2) ^ tclass)
& (AVC_CACHE_SLOTS - 1);
}
int avc_context_to_sid(const char * ctx, security_id_t * sid)
{
int rc;
/* avc_init needs to be called before this function */
assert(avc_running);
avc_get_lock(avc_lock);
rc = sidtab_context_to_sid(&avc_sidtab, ctx, sid);
avc_release_lock(avc_lock);
return rc;
}
int avc_sid_to_context(security_id_t sid, char ** ctx)
{
int rc;
*ctx = NULL;
avc_get_lock(avc_lock);
*ctx = strdup(sid->ctx); /* caller must free via freecon */
rc = *ctx ? 0 : -1;
avc_release_lock(avc_lock);
return rc;
}
int avc_get_initial_sid(const char * name, security_id_t * sid)
{
int rc;
char * con;
rc = security_get_initial_context(name, &con);
if (rc < 0)
return rc;
rc = avc_context_to_sid(con, sid);
freecon(con);
return rc;
}
int avc_open(struct selinux_opt *opts, unsigned nopts)
{
avc_setenforce = 0;
while (nopts--)
switch(opts[nopts].type) {
case AVC_OPT_SETENFORCE:
avc_setenforce = 1;
avc_enforcing = !!opts[nopts].value;
break;
}
return avc_init("avc", NULL, NULL, NULL, NULL);
}
int avc_init(const char *prefix,
const struct avc_memory_callback *mem_cb,
const struct avc_log_callback *log_cb,
const struct avc_thread_callback *thread_cb,
const struct avc_lock_callback *lock_cb)
{
struct avc_node *new;
int i, rc = 0;
if (avc_running)
return 0;
if (prefix)
strncpy(avc_prefix, prefix, AVC_PREFIX_SIZE - 1);
set_callbacks(mem_cb, log_cb, thread_cb, lock_cb);
avc_lock = avc_alloc_lock();
avc_log_lock = avc_alloc_lock();
memset(&cache_stats, 0, sizeof(cache_stats));
for (i = 0; i < AVC_CACHE_SLOTS; i++)
avc_cache.slots[i] = 0;
avc_cache.lru_hint = 0;
avc_cache.active_nodes = 0;
avc_cache.latest_notif = 0;
rc = sidtab_init(&avc_sidtab);
if (rc) {
avc_log(SELINUX_ERROR,
"%s: unable to initialize SID table\n",
avc_prefix);
goto out;
}
avc_audit_buf = (char *)avc_malloc(AVC_AUDIT_BUFSIZE);
if (!avc_audit_buf) {
avc_log(SELINUX_ERROR,
"%s: unable to allocate audit buffer\n",
avc_prefix);
rc = -1;
goto out;
}
for (i = 0; i < AVC_CACHE_MAXNODES; i++) {
new = avc_malloc(sizeof(*new));
if (!new) {
avc_log(SELINUX_WARNING,
"%s: warning: only got %d av entries\n",
avc_prefix, i);
break;
}
memset(new, 0, sizeof(*new));
new->next = avc_node_freelist;
avc_node_freelist = new;
}
if (!avc_setenforce) {
rc = security_getenforce();
if (rc < 0) {
avc_log(SELINUX_ERROR,
"%s: could not determine enforcing mode: %s\n",
avc_prefix,
strerror(errno));
goto out;
}
avc_enforcing = rc;
}
rc = avc_netlink_open(0);
if (rc < 0) {
avc_log(SELINUX_ERROR,
"%s: can't open netlink socket: %d (%s)\n",
avc_prefix, errno, strerror(errno));
goto out;
}
if (avc_using_threads) {
avc_netlink_thread = avc_create_thread(&avc_netlink_loop);
avc_netlink_trouble = 0;
}
avc_running = 1;
out:
return rc;
}
void avc_cache_stats(struct avc_cache_stats *p)
{
memcpy(p, &cache_stats, sizeof(cache_stats));
}
void avc_sid_stats(void)
{
/* avc_init needs to be called before this function */
assert(avc_running);
avc_get_lock(avc_log_lock);
avc_get_lock(avc_lock);
sidtab_sid_stats(&avc_sidtab, avc_audit_buf, AVC_AUDIT_BUFSIZE);
avc_release_lock(avc_lock);
avc_log(SELINUX_INFO, "%s", avc_audit_buf);
avc_release_lock(avc_log_lock);
}
void avc_av_stats(void)
{
int i, chain_len, max_chain_len, slots_used;
struct avc_node *node;
avc_get_lock(avc_lock);
slots_used = 0;
max_chain_len = 0;
for (i = 0; i < AVC_CACHE_SLOTS; i++) {
node = avc_cache.slots[i];
if (node) {
slots_used++;
chain_len = 0;
while (node) {
chain_len++;
node = node->next;
}
if (chain_len > max_chain_len)
max_chain_len = chain_len;
}
}
avc_release_lock(avc_lock);
avc_log(SELINUX_INFO, "%s: %d AV entries and %d/%d buckets used, "
"longest chain length %d\n", avc_prefix,
avc_cache.active_nodes,
slots_used, AVC_CACHE_SLOTS, max_chain_len);
}
hidden_def(avc_av_stats)
static inline struct avc_node *avc_reclaim_node(void)
{
struct avc_node *prev, *cur;
int try;
uint32_t hvalue;
hvalue = avc_cache.lru_hint;
for (try = 0; try < 2; try++) {
do {
prev = NULL;
cur = avc_cache.slots[hvalue];
while (cur) {
if (!cur->ae.used)
goto found;
cur->ae.used = 0;
prev = cur;
cur = cur->next;
}
hvalue = (hvalue + 1) & (AVC_CACHE_SLOTS - 1);
} while (hvalue != avc_cache.lru_hint);
}
errno = ENOMEM; /* this was a panic in the kernel... */
return NULL;
found:
avc_cache.lru_hint = hvalue;
if (prev == NULL)
avc_cache.slots[hvalue] = cur->next;
else
prev->next = cur->next;
return cur;
}
static inline void avc_clear_avc_entry(struct avc_entry *ae)
{
memset(ae, 0, sizeof(*ae));
}
static inline struct avc_node *avc_claim_node(security_id_t ssid,
security_id_t tsid,
security_class_t tclass)
{
struct avc_node *new;
int hvalue;
if (!avc_node_freelist)
avc_cleanup();
if (avc_node_freelist) {
new = avc_node_freelist;
avc_node_freelist = avc_node_freelist->next;
avc_cache.active_nodes++;
} else {
new = avc_reclaim_node();
if (!new)
goto out;
}
hvalue = avc_hash(ssid, tsid, tclass);
avc_clear_avc_entry(&new->ae);
new->ae.used = 1;
new->ae.ssid = ssid;
new->ae.tsid = tsid;
new->ae.tclass = tclass;
new->next = avc_cache.slots[hvalue];
avc_cache.slots[hvalue] = new;
out:
return new;
}
static inline struct avc_node *avc_search_node(security_id_t ssid,
security_id_t tsid,
security_class_t tclass,
int *probes)
{
struct avc_node *cur;
int hvalue;
int tprobes = 1;
hvalue = avc_hash(ssid, tsid, tclass);
cur = avc_cache.slots[hvalue];
while (cur != NULL &&
(ssid != cur->ae.ssid ||
tclass != cur->ae.tclass || tsid != cur->ae.tsid)) {
tprobes++;
cur = cur->next;
}
if (cur == NULL) {
/* cache miss */
goto out;
}
/* cache hit */
if (probes)
*probes = tprobes;
cur->ae.used = 1;
out:
return cur;
}
/**
* avc_lookup - Look up an AVC entry.
* @ssid: source security identifier
* @tsid: target security identifier
* @tclass: target security class
* @requested: requested permissions, interpreted based on @tclass
* @aeref: AVC entry reference
*
* Look up an AVC entry that is valid for the
* @requested permissions between the SID pair
* (@ssid, @tsid), interpreting the permissions
* based on @tclass. If a valid AVC entry exists,
* then this function updates @aeref to refer to the
* entry and returns %0. Otherwise, -1 is returned.
*/
static int avc_lookup(security_id_t ssid, security_id_t tsid,
security_class_t tclass,
access_vector_t requested, struct avc_entry_ref *aeref)
{
struct avc_node *node;
int probes, rc = 0;
avc_cache_stats_incr(cav_lookups);
node = avc_search_node(ssid, tsid, tclass, &probes);
if (node && ((node->ae.avd.decided & requested) == requested)) {
avc_cache_stats_incr(cav_hits);
avc_cache_stats_add(cav_probes, probes);
aeref->ae = &node->ae;
goto out;
}
avc_cache_stats_incr(cav_misses);
rc = -1;
out:
return rc;
}
/**
* avc_insert - Insert an AVC entry.
* @ssid: source security identifier
* @tsid: target security identifier
* @tclass: target security class
* @ae: AVC entry
* @aeref: AVC entry reference
*
* Insert an AVC entry for the SID pair
* (@ssid, @tsid) and class @tclass.
* The access vectors and the sequence number are
* normally provided by the security server in
* response to a security_compute_av() call. If the
* sequence number @ae->avd.seqno is not less than the latest
* revocation notification, then the function copies
* the access vectors into a cache entry, updates
* @aeref to refer to the entry, and returns %0.
* Otherwise, this function returns -%1 with @errno set to %EAGAIN.
*/
static int avc_insert(security_id_t ssid, security_id_t tsid,
security_class_t tclass,
struct avc_entry *ae, struct avc_entry_ref *aeref)
{
struct avc_node *node;
int rc = 0;
if (ae->avd.seqno < avc_cache.latest_notif) {
avc_log(SELINUX_WARNING,
"%s: seqno %d < latest_notif %d\n", avc_prefix,
ae->avd.seqno, avc_cache.latest_notif);
errno = EAGAIN;
rc = -1;
goto out;
}
node = avc_claim_node(ssid, tsid, tclass);
if (!node) {
rc = -1;
goto out;
}
memcpy(&node->ae.avd, &ae->avd, sizeof(ae->avd));
aeref->ae = &node->ae;
out:
return rc;
}
void avc_cleanup(void)
{
}
hidden_def(avc_cleanup)
int avc_reset(void)
{
struct avc_callback_node *c;
int i, ret, rc = 0, errsave = 0;
struct avc_node *node, *tmp;
errno = 0;
if (!avc_running)
return 0;
avc_get_lock(avc_lock);
for (i = 0; i < AVC_CACHE_SLOTS; i++) {
node = avc_cache.slots[i];
while (node) {
tmp = node;
node = node->next;
avc_clear_avc_entry(&tmp->ae);
tmp->next = avc_node_freelist;
avc_node_freelist = tmp;
avc_cache.active_nodes--;
}
avc_cache.slots[i] = 0;
}
avc_cache.lru_hint = 0;
avc_release_lock(avc_lock);
memset(&cache_stats, 0, sizeof(cache_stats));
for (c = avc_callbacks; c; c = c->next) {
if (c->events & AVC_CALLBACK_RESET) {
ret = c->callback(AVC_CALLBACK_RESET, 0, 0, 0, 0, 0);
if (ret && !rc) {
rc = ret;
errsave = errno;
}
}
}
errno = errsave;
return rc;
}
hidden_def(avc_reset)
void avc_destroy(void)
{
struct avc_callback_node *c;
struct avc_node *node, *tmp;
int i;
/* avc_init needs to be called before this function */
assert(avc_running);
avc_get_lock(avc_lock);
if (avc_using_threads)
avc_stop_thread(avc_netlink_thread);
avc_netlink_close();
for (i = 0; i < AVC_CACHE_SLOTS; i++) {
node = avc_cache.slots[i];
while (node) {
tmp = node;
node = node->next;
avc_free(tmp);
}
}
while (avc_node_freelist) {
tmp = avc_node_freelist;
avc_node_freelist = tmp->next;
avc_free(tmp);
}
avc_release_lock(avc_lock);
while (avc_callbacks) {
c = avc_callbacks;
avc_callbacks = c->next;
avc_free(c);
}
sidtab_destroy(&avc_sidtab);
avc_free_lock(avc_lock);
avc_free_lock(avc_log_lock);
avc_free(avc_audit_buf);
avc_running = 0;
}
/* ratelimit stuff put aside for now --EFW */
#if 0
/*
* Copied from net/core/utils.c:net_ratelimit and modified for
* use by the AVC audit facility.
*/
#define AVC_MSG_COST 5*HZ
#define AVC_MSG_BURST 10*5*HZ
/*
* This enforces a rate limit: not more than one kernel message
* every 5secs to make a denial-of-service attack impossible.
*/
static int avc_ratelimit(void)
{
static unsigned long toks = 10 * 5 * HZ;
static unsigned long last_msg;
static int missed, rc = 0;
unsigned long now = jiffies;
void *ratelimit_lock = avc_alloc_lock();
avc_get_lock(ratelimit_lock);
toks += now - last_msg;
last_msg = now;
if (toks > AVC_MSG_BURST)
toks = AVC_MSG_BURST;
if (toks >= AVC_MSG_COST) {
int lost = missed;
missed = 0;
toks -= AVC_MSG_COST;
avc_release_lock(ratelimit_lock);
if (lost) {
avc_log(SELINUX_WARNING,
"%s: %d messages suppressed.\n", avc_prefix,
lost);
}
rc = 1;
goto out;
}
missed++;
avc_release_lock(ratelimit_lock);
out:
avc_free_lock(ratelimit_lock);
return rc;
}
static inline int check_avc_ratelimit(void)
{
if (avc_enforcing)
return avc_ratelimit();
else {
/* If permissive, then never suppress messages. */
return 1;
}
}
#endif /* ratelimit stuff */
/**
* avc_dump_av - Display an access vector in human-readable form.
* @tclass: target security class
* @av: access vector
*/
static void avc_dump_av(security_class_t tclass, access_vector_t av)
{
const char *permstr;
access_vector_t bit = 1;
if (av == 0) {
log_append(avc_audit_buf, " null");
return;
}
log_append(avc_audit_buf, " {");
while (av) {
if (av & bit) {
permstr = security_av_perm_to_string(tclass, bit);
if (!permstr)
break;
log_append(avc_audit_buf, " %s", permstr);
av &= ~bit;
}
bit <<= 1;
}
if (av)
log_append(avc_audit_buf, " 0x%x", av);
log_append(avc_audit_buf, " }");
}
/**
* avc_dump_query - Display a SID pair and a class in human-readable form.
* @ssid: source security identifier
* @tsid: target security identifier
* @tclass: target security class
*/
static void avc_dump_query(security_id_t ssid, security_id_t tsid,
security_class_t tclass)
{
avc_get_lock(avc_lock);
log_append(avc_audit_buf, "scontext=%s tcontext=%s",
ssid->ctx, tsid->ctx);
avc_release_lock(avc_lock);
log_append(avc_audit_buf, " tclass=%s",
security_class_to_string(tclass));
}
void avc_audit(security_id_t ssid, security_id_t tsid,
security_class_t tclass, access_vector_t requested,
struct av_decision *avd, int result, void *a)
{
access_vector_t denied, audited;
denied = requested & ~avd->allowed;
if (denied)
audited = denied & avd->auditdeny;
else if (!requested || result)
audited = denied = requested;
else
audited = requested & avd->auditallow;
if (!audited)
return;
#if 0
if (!check_avc_ratelimit())
return;
#endif
/* prevent overlapping buffer writes */
avc_get_lock(avc_log_lock);
snprintf(avc_audit_buf, AVC_AUDIT_BUFSIZE,
"%s: %s ", avc_prefix, (denied || !requested) ? "denied" : "granted");
avc_dump_av(tclass, audited);
log_append(avc_audit_buf, " for ");
/* get any extra information printed by the callback */
avc_suppl_audit(a, tclass, avc_audit_buf + strlen(avc_audit_buf),
AVC_AUDIT_BUFSIZE - strlen(avc_audit_buf));
log_append(avc_audit_buf, " ");
avc_dump_query(ssid, tsid, tclass);
/* append permissive=0|1 like the kernel at the end */
if (denied || !requested)
log_append(avc_audit_buf, " permissive=%d", !result);
log_append(avc_audit_buf, "\n");
avc_log(SELINUX_AVC, "%s", avc_audit_buf);
avc_release_lock(avc_log_lock);
}
hidden_def(avc_audit)
static void avd_init(struct av_decision *avd)
{
avd->allowed = 0;
avd->auditallow = 0;
avd->auditdeny = 0xffffffff;
avd->seqno = avc_cache.latest_notif;
avd->flags = 0;
}
int avc_has_perm_noaudit(security_id_t ssid,
security_id_t tsid,
security_class_t tclass,
access_vector_t requested,
struct avc_entry_ref *aeref, struct av_decision *avd)
{
struct avc_entry *ae;
int rc = 0;
struct avc_entry entry;
access_vector_t denied;
struct avc_entry_ref ref;
if (avd)
avd_init(avd);
if (!avc_using_threads && !avc_app_main_loop) {
(void)avc_netlink_check_nb();
}
if (!aeref) {
avc_entry_ref_init(&ref);
aeref = &ref;
}
avc_get_lock(avc_lock);
avc_cache_stats_incr(entry_lookups);
ae = aeref->ae;
if (ae) {
if (ae->ssid == ssid &&
ae->tsid == tsid &&
ae->tclass == tclass &&
((ae->avd.decided & requested) == requested)) {
avc_cache_stats_incr(entry_hits);
ae->used = 1;
} else {
avc_cache_stats_incr(entry_discards);
ae = 0;
}
}
if (!ae) {
avc_cache_stats_incr(entry_misses);
rc = avc_lookup(ssid, tsid, tclass, requested, aeref);
if (rc) {
rc = security_compute_av(ssid->ctx, tsid->ctx,
tclass, requested,
&entry.avd);
if (rc && errno == EINVAL && !avc_enforcing) {
rc = errno = 0;
goto out;
}
if (rc)
goto out;
rc = avc_insert(ssid, tsid, tclass, &entry, aeref);
if (rc)
goto out;
}
ae = aeref->ae;
}
if (avd)
memcpy(avd, &ae->avd, sizeof(*avd));
denied = requested & ~(ae->avd.allowed);
if (!requested || denied) {
if (!avc_enforcing ||
(ae->avd.flags & SELINUX_AVD_FLAGS_PERMISSIVE))
ae->avd.allowed |= requested;
else {
errno = EACCES;
rc = -1;
}
}
out:
avc_release_lock(avc_lock);
return rc;
}
hidden_def(avc_has_perm_noaudit)
int avc_has_perm(security_id_t ssid, security_id_t tsid,
security_class_t tclass, access_vector_t requested,
struct avc_entry_ref *aeref, void *auditdata)
{
struct av_decision avd;
int errsave, rc;
rc = avc_has_perm_noaudit(ssid, tsid, tclass, requested, aeref, &avd);
errsave = errno;
avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata);
errno = errsave;
return rc;
}
int avc_compute_create(security_id_t ssid, security_id_t tsid,
security_class_t tclass, security_id_t *newsid)
{
int rc;
struct avc_entry_ref aeref;
struct avc_entry entry;
char * ctx;
*newsid = NULL;
avc_entry_ref_init(&aeref);
avc_get_lock(avc_lock);
/* check for a cached entry */
rc = avc_lookup(ssid, tsid, tclass, 0, &aeref);
if (rc) {
/* need to make a cache entry for this tuple */
rc = security_compute_av(ssid->ctx, tsid->ctx,
tclass, 0, &entry.avd);
if (rc)
goto out;
rc = avc_insert(ssid, tsid, tclass, &entry, &aeref);
if (rc)
goto out;
}
/* check for a saved compute_create value */
if (!aeref.ae->create_sid) {
/* need to query the kernel policy */
rc = security_compute_create(ssid->ctx, tsid->ctx, tclass,
&ctx);
if (rc)
goto out;
rc = sidtab_context_to_sid(&avc_sidtab, ctx, newsid);
freecon(ctx);
if (rc)
goto out;
aeref.ae->create_sid = *newsid;
} else {
/* found saved value */
*newsid = aeref.ae->create_sid;
}
rc = 0;
out:
avc_release_lock(avc_lock);
return rc;
}
int avc_add_callback(int (*callback) (uint32_t event, security_id_t ssid,
security_id_t tsid,
security_class_t tclass,
access_vector_t perms,
access_vector_t * out_retained),
uint32_t events, security_id_t ssid,
security_id_t tsid,
security_class_t tclass, access_vector_t perms)
{
struct avc_callback_node *c;
int rc = 0;
c = avc_malloc(sizeof(*c));
if (!c) {
rc = -1;
goto out;
}
c->callback = callback;
c->events = events;
c->ssid = ssid;
c->tsid = tsid;
c->tclass = tclass;
c->perms = perms;
c->next = avc_callbacks;
avc_callbacks = c;
out:
return rc;
}
static inline int avc_sidcmp(security_id_t x, security_id_t y)
{
return (x == y || x == SECSID_WILD || y == SECSID_WILD);
}
static inline void avc_update_node(uint32_t event, struct avc_node *node,
access_vector_t perms)
{
switch (event) {
case AVC_CALLBACK_GRANT:
node->ae.avd.allowed |= perms;
break;
case AVC_CALLBACK_TRY_REVOKE:
case AVC_CALLBACK_REVOKE:
node->ae.avd.allowed &= ~perms;
break;
case AVC_CALLBACK_AUDITALLOW_ENABLE:
node->ae.avd.auditallow |= perms;
break;
case AVC_CALLBACK_AUDITALLOW_DISABLE:
node->ae.avd.auditallow &= ~perms;
break;
case AVC_CALLBACK_AUDITDENY_ENABLE:
node->ae.avd.auditdeny |= perms;
break;
case AVC_CALLBACK_AUDITDENY_DISABLE:
node->ae.avd.auditdeny &= ~perms;
break;
}
}
static int avc_update_cache(uint32_t event, security_id_t ssid,
security_id_t tsid, security_class_t tclass,
access_vector_t perms)
{
struct avc_node *node;
int i;
avc_get_lock(avc_lock);
if (ssid == SECSID_WILD || tsid == SECSID_WILD) {
/* apply to all matching nodes */
for (i = 0; i < AVC_CACHE_SLOTS; i++) {
for (node = avc_cache.slots[i]; node; node = node->next) {
if (avc_sidcmp(ssid, node->ae.ssid) &&
avc_sidcmp(tsid, node->ae.tsid) &&
tclass == node->ae.tclass) {
avc_update_node(event, node, perms);
}
}
}
} else {
/* apply to one node */
node = avc_search_node(ssid, tsid, tclass, 0);
if (node) {
avc_update_node(event, node, perms);
}
}
avc_release_lock(avc_lock);
return 0;
}
/* avc_control - update cache and call callbacks
*
* This should not be called directly; use the individual event
* functions instead.
*/
static int avc_control(uint32_t event, security_id_t ssid,
security_id_t tsid, security_class_t tclass,
access_vector_t perms,
uint32_t seqno, access_vector_t * out_retained)
{
struct avc_callback_node *c;
access_vector_t tretained = 0, cretained = 0;
int ret, rc = 0, errsave = 0;
errno = 0;
/*
* try_revoke only removes permissions from the cache
* state if they are not retained by the object manager.
* Hence, try_revoke must wait until after the callbacks have
* been invoked to update the cache state.
*/
if (event != AVC_CALLBACK_TRY_REVOKE)
avc_update_cache(event, ssid, tsid, tclass, perms);
for (c = avc_callbacks; c; c = c->next) {
if ((c->events & event) &&
avc_sidcmp(c->ssid, ssid) &&
avc_sidcmp(c->tsid, tsid) &&
c->tclass == tclass && (c->perms & perms)) {
cretained = 0;
ret = c->callback(event, ssid, tsid, tclass,
(c->perms & perms), &cretained);
if (ret && !rc) {
rc = ret;
errsave = errno;
}
if (!ret)
tretained |= cretained;
}
}
if (event == AVC_CALLBACK_TRY_REVOKE) {
/* revoke any unretained permissions */
perms &= ~tretained;
avc_update_cache(event, ssid, tsid, tclass, perms);
*out_retained = tretained;
}
avc_get_lock(avc_lock);
if (seqno > avc_cache.latest_notif)
avc_cache.latest_notif = seqno;
avc_release_lock(avc_lock);
errno = errsave;
return rc;
}
/**
* avc_ss_grant - Grant previously denied permissions.
* @ssid: source security identifier or %SECSID_WILD
* @tsid: target security identifier or %SECSID_WILD
* @tclass: target security class
* @perms: permissions to grant
* @seqno: policy sequence number
*/
int avc_ss_grant(security_id_t ssid, security_id_t tsid,
security_class_t tclass, access_vector_t perms,
uint32_t seqno)
{
return avc_control(AVC_CALLBACK_GRANT,
ssid, tsid, tclass, perms, seqno, 0);
}
/**
* avc_ss_try_revoke - Try to revoke previously granted permissions.
* @ssid: source security identifier or %SECSID_WILD
* @tsid: target security identifier or %SECSID_WILD
* @tclass: target security class
* @perms: permissions to grant
* @seqno: policy sequence number
* @out_retained: subset of @perms that are retained
*
* Try to revoke previously granted permissions, but
* only if they are not retained as migrated permissions.
* Return the subset of permissions that are retained via @out_retained.
*/
int avc_ss_try_revoke(security_id_t ssid, security_id_t tsid,
security_class_t tclass,
access_vector_t perms, uint32_t seqno,
access_vector_t * out_retained)
{
return avc_control(AVC_CALLBACK_TRY_REVOKE,
ssid, tsid, tclass, perms, seqno, out_retained);
}
/**
* avc_ss_revoke - Revoke previously granted permissions.
* @ssid: source security identifier or %SECSID_WILD
* @tsid: target security identifier or %SECSID_WILD
* @tclass: target security class
* @perms: permissions to grant
* @seqno: policy sequence number
*
* Revoke previously granted permissions, even if
* they are retained as migrated permissions.
*/
int avc_ss_revoke(security_id_t ssid, security_id_t tsid,
security_class_t tclass, access_vector_t perms,
uint32_t seqno)
{
return avc_control(AVC_CALLBACK_REVOKE,
ssid, tsid, tclass, perms, seqno, 0);
}
/**
* avc_ss_reset - Flush the cache and revalidate migrated permissions.
* @seqno: policy sequence number
*/
int avc_ss_reset(uint32_t seqno)
{
int rc;
rc = avc_reset();
avc_get_lock(avc_lock);
if (seqno > avc_cache.latest_notif)
avc_cache.latest_notif = seqno;
avc_release_lock(avc_lock);
return rc;
}
/**
* avc_ss_set_auditallow - Enable or disable auditing of granted permissions.
* @ssid: source security identifier or %SECSID_WILD
* @tsid: target security identifier or %SECSID_WILD
* @tclass: target security class
* @perms: permissions to grant
* @seqno: policy sequence number
* @enable: enable flag.
*/
int avc_ss_set_auditallow(security_id_t ssid, security_id_t tsid,
security_class_t tclass, access_vector_t perms,
uint32_t seqno, uint32_t enable)
{
if (enable)
return avc_control(AVC_CALLBACK_AUDITALLOW_ENABLE,
ssid, tsid, tclass, perms, seqno, 0);
else
return avc_control(AVC_CALLBACK_AUDITALLOW_DISABLE,
ssid, tsid, tclass, perms, seqno, 0);
}
/**
* avc_ss_set_auditdeny - Enable or disable auditing of denied permissions.
* @ssid: source security identifier or %SECSID_WILD
* @tsid: target security identifier or %SECSID_WILD
* @tclass: target security class
* @perms: permissions to grant
* @seqno: policy sequence number
* @enable: enable flag.
*/
int avc_ss_set_auditdeny(security_id_t ssid, security_id_t tsid,
security_class_t tclass, access_vector_t perms,
uint32_t seqno, uint32_t enable)
{
if (enable)
return avc_control(AVC_CALLBACK_AUDITDENY_ENABLE,
ssid, tsid, tclass, perms, seqno, 0);
else
return avc_control(AVC_CALLBACK_AUDITDENY_DISABLE,
ssid, tsid, tclass, perms, seqno, 0);
}