2 * Access vector cache interface for object managers.
4 * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
6 #ifndef _SELINUX_AVC_H_
7 #define _SELINUX_AVC_H_
9 #include <linux/stddef.h>
10 #include <linux/errno.h>
11 #include <linux/kernel.h>
12 #include <linux/kdev_t.h>
13 #include <linux/spinlock.h>
14 #include <linux/init.h>
15 #include <linux/in6.h>
16 #include <asm/system.h>
18 #include "av_permissions.h"
21 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
22 extern int selinux_enforcing;
24 #define selinux_enforcing 1
28 * An entry in the AVC.
33 * A reference to an AVC entry.
35 struct avc_entry_ref {
39 /* Initialize an AVC entry reference before first use. */
40 static inline void avc_entry_ref_init(struct avc_entry_ref *h)
52 /* Auxiliary data to use in generating the audit record. */
53 struct avc_audit_data {
55 #define AVC_AUDIT_DATA_FS 1
56 #define AVC_AUDIT_DATA_NET 2
57 #define AVC_AUDIT_DATA_CAP 3
58 #define AVC_AUDIT_DATA_IPC 4
59 struct task_struct *tsk;
63 struct dentry *dentry;
78 struct in6_addr daddr;
79 struct in6_addr saddr;
91 /* Initialize an AVC audit data structure. */
92 #define AVC_AUDIT_DATA_INIT(_d,_t) \
93 { memset((_d), 0, sizeof(struct avc_audit_data)); (_d)->type = AVC_AUDIT_DATA_##_t; }
98 #define AVC_ENTRY_LOOKUPS 0
99 #define AVC_ENTRY_HITS 1
100 #define AVC_ENTRY_MISSES 2
101 #define AVC_ENTRY_DISCARDS 3
102 #define AVC_CAV_LOOKUPS 4
103 #define AVC_CAV_HITS 5
104 #define AVC_CAV_PROBES 6
105 #define AVC_CAV_MISSES 7
107 extern unsigned avc_cache_stats[AVC_NSTATS];
109 #ifdef AVC_CACHE_STATS
110 static inline void avc_cache_stats_incr(int type)
112 avc_cache_stats[type]++;
115 static inline void avc_cache_stats_add(int type, unsigned val)
117 avc_cache_stats[type] += val;
120 static inline void avc_cache_stats_incr(int type)
123 static inline void avc_cache_stats_add(int type, unsigned val)
128 * AVC display support
131 void avc_dump_av(struct audit_buffer *ab, u16 tclass, u32 av);
132 void avc_dump_query(struct audit_buffer *ab, u32 ssid, u32 tsid, u16 tclass);
133 void avc_dump_cache(struct audit_buffer *ab, char *tag);
139 void __init avc_init(void);
141 int avc_lookup(u32 ssid, u32 tsid, u16 tclass,
142 u32 requested, struct avc_entry_ref *aeref);
144 int avc_insert(u32 ssid, u32 tsid, u16 tclass,
145 struct avc_entry *ae, struct avc_entry_ref *out_aeref);
147 void avc_audit(u32 ssid, u32 tsid,
148 u16 tclass, u32 requested,
149 struct av_decision *avd, int result, struct avc_audit_data *auditdata);
151 int avc_has_perm_noaudit(u32 ssid, u32 tsid,
152 u16 tclass, u32 requested,
153 struct avc_entry_ref *aeref, struct av_decision *avd);
155 int avc_has_perm(u32 ssid, u32 tsid,
156 u16 tclass, u32 requested,
157 struct avc_entry_ref *aeref, struct avc_audit_data *auditdata);
159 #define AVC_CALLBACK_GRANT 1
160 #define AVC_CALLBACK_TRY_REVOKE 2
161 #define AVC_CALLBACK_REVOKE 4
162 #define AVC_CALLBACK_RESET 8
163 #define AVC_CALLBACK_AUDITALLOW_ENABLE 16
164 #define AVC_CALLBACK_AUDITALLOW_DISABLE 32
165 #define AVC_CALLBACK_AUDITDENY_ENABLE 64
166 #define AVC_CALLBACK_AUDITDENY_DISABLE 128
168 int avc_add_callback(int (*callback)(u32 event, u32 ssid, u32 tsid,
169 u16 tclass, u32 perms,
171 u32 events, u32 ssid, u32 tsid,
172 u16 tclass, u32 perms);
174 #endif /* _SELINUX_AVC_H_ */