2 * Access vector cache interface for object managers.
4 * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
6 #ifndef _SELINUX_AVC_H_
7 #define _SELINUX_AVC_H_
9 #include <linux/stddef.h>
10 #include <linux/errno.h>
11 #include <linux/kernel.h>
12 #include <linux/kdev_t.h>
13 #include <linux/spinlock.h>
14 #include <linux/init.h>
15 #include <linux/in6.h>
16 #include <asm/system.h>
18 #include "av_permissions.h"
21 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
22 extern int selinux_enforcing;
24 #define selinux_enforcing 1
28 * An entry in the AVC.
33 * A reference to an AVC entry.
35 struct avc_entry_ref {
39 /* Initialize an AVC entry reference before first use. */
40 static inline void avc_entry_ref_init(struct avc_entry_ref *h)
52 /* Auxiliary data to use in generating the audit record. */
53 struct avc_audit_data {
55 #define AVC_AUDIT_DATA_FS 1
56 #define AVC_AUDIT_DATA_NET 2
57 #define AVC_AUDIT_DATA_CAP 3
58 #define AVC_AUDIT_DATA_IPC 4
59 struct task_struct *tsk;
63 struct dentry *dentry;
78 struct in6_addr daddr;
79 struct in6_addr saddr;
91 /* Initialize an AVC audit data structure. */
92 #define AVC_AUDIT_DATA_INIT(_d,_t) \
93 { memset((_d), 0, sizeof(struct avc_audit_data)); (_d)->type = AVC_AUDIT_DATA_##_t; }
98 #define AVC_ENTRY_LOOKUPS 0
99 #define AVC_ENTRY_HITS 1
100 #define AVC_ENTRY_MISSES 2
101 #define AVC_ENTRY_DISCARDS 3
102 #define AVC_CAV_LOOKUPS 4
103 #define AVC_CAV_HITS 5
104 #define AVC_CAV_PROBES 6
105 #define AVC_CAV_MISSES 7
109 * AVC display support
112 void avc_dump_av(struct audit_buffer *ab, u16 tclass, u32 av);
113 void avc_dump_query(struct audit_buffer *ab, u32 ssid, u32 tsid, u16 tclass);
114 void avc_dump_cache(struct audit_buffer *ab, char *tag);
120 void __init avc_init(void);
122 int avc_lookup(u32 ssid, u32 tsid, u16 tclass,
123 u32 requested, struct avc_entry_ref *aeref);
125 int avc_insert(u32 ssid, u32 tsid, u16 tclass,
126 struct avc_entry *ae, struct avc_entry_ref *out_aeref);
128 void avc_audit(u32 ssid, u32 tsid,
129 u16 tclass, u32 requested,
130 struct av_decision *avd, int result, struct avc_audit_data *auditdata);
132 int avc_has_perm_noaudit(u32 ssid, u32 tsid,
133 u16 tclass, u32 requested,
134 struct avc_entry_ref *aeref, struct av_decision *avd);
136 int avc_has_perm(u32 ssid, u32 tsid,
137 u16 tclass, u32 requested,
138 struct avc_entry_ref *aeref, struct avc_audit_data *auditdata);
140 #define AVC_CALLBACK_GRANT 1
141 #define AVC_CALLBACK_TRY_REVOKE 2
142 #define AVC_CALLBACK_REVOKE 4
143 #define AVC_CALLBACK_RESET 8
144 #define AVC_CALLBACK_AUDITALLOW_ENABLE 16
145 #define AVC_CALLBACK_AUDITALLOW_DISABLE 32
146 #define AVC_CALLBACK_AUDITDENY_ENABLE 64
147 #define AVC_CALLBACK_AUDITDENY_DISABLE 128
149 int avc_add_callback(int (*callback)(u32 event, u32 ssid, u32 tsid,
150 u16 tclass, u32 perms,
152 u32 events, u32 ssid, u32 tsid,
153 u16 tclass, u32 perms);
155 #endif /* _SELINUX_AVC_H_ */