avc.h revision 9ade0cf440a1e5800dc68eef2e77b8d9d83a6dff 
1/*
2 * Access vector cache interface for object managers.
3 *
4 * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
5 */
6#ifndef _SELINUX_AVC_H_
7#define _SELINUX_AVC_H_
8
9#include <linux/stddef.h>
10#include <linux/errno.h>
11#include <linux/kernel.h>
12#include <linux/kdev_t.h>
13#include <linux/spinlock.h>
14#include <linux/init.h>
15#include <linux/audit.h>
16#include <linux/lsm_audit.h>
17#include <linux/in6.h>
18#include <asm/system.h>
19#include "flask.h"
20#include "av_permissions.h"
21#include "security.h"
22
23#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
24extern int selinux_enforcing;
25#else
26#define selinux_enforcing 1
27#endif
28
29/*
30 * An entry in the AVC.
31 */
32struct avc_entry;
33
34struct task_struct;
35struct inode;
36struct sock;
37struct sk_buff;
38
39/*
40 * AVC statistics
41 */
42struct avc_cache_stats {
43	unsigned int lookups;
44	unsigned int hits;
45	unsigned int misses;
46	unsigned int allocations;
47	unsigned int reclaims;
48	unsigned int frees;
49};
50
51/*
52 * AVC operations
53 */
54
55void __init avc_init(void);
56
57int avc_audit(u32 ssid, u32 tsid,
58	       u16 tclass, u32 requested,
59	       struct av_decision *avd,
60	       int result,
61	      struct common_audit_data *a, unsigned flags);
62
63#define AVC_STRICT 1 /* Ignore permissive mode. */
64int avc_has_perm_noaudit(u32 ssid, u32 tsid,
65			 u16 tclass, u32 requested,
66			 unsigned flags,
67			 struct av_decision *avd);
68
69int avc_has_perm_flags(u32 ssid, u32 tsid,
70		       u16 tclass, u32 requested,
71		       struct common_audit_data *auditdata,
72		       unsigned);
73
74static inline int avc_has_perm(u32 ssid, u32 tsid,
75			       u16 tclass, u32 requested,
76			       struct common_audit_data *auditdata)
77{
78	return avc_has_perm_flags(ssid, tsid, tclass, requested, auditdata, 0);
79}
80
81u32 avc_policy_seqno(void);
82
83#define AVC_CALLBACK_GRANT		1
84#define AVC_CALLBACK_TRY_REVOKE		2
85#define AVC_CALLBACK_REVOKE		4
86#define AVC_CALLBACK_RESET		8
87#define AVC_CALLBACK_AUDITALLOW_ENABLE	16
88#define AVC_CALLBACK_AUDITALLOW_DISABLE	32
89#define AVC_CALLBACK_AUDITDENY_ENABLE	64
90#define AVC_CALLBACK_AUDITDENY_DISABLE	128
91
92int avc_add_callback(int (*callback)(u32 event, u32 ssid, u32 tsid,
93				     u16 tclass, u32 perms,
94				     u32 *out_retained),
95		     u32 events, u32 ssid, u32 tsid,
96		     u16 tclass, u32 perms);
97
98/* Exported to selinuxfs */
99int avc_get_hash_stats(char *page);
100extern unsigned int avc_cache_threshold;
101
102/* Attempt to free avc node cache */
103void avc_disable(void);
104
105#ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
106DECLARE_PER_CPU(struct avc_cache_stats, avc_cache_stats);
107#endif
108
109#endif /* _SELINUX_AVC_H_ */
110
111