security/selinux/ss/sidtab.c

   1 /*
   2  * Implementation of the SID table type.
   3  *
   4  * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
   5  */
   6 #include <linux/kernel.h>
   7 #include <linux/slab.h>
   8 #include <linux/spinlock.h>
   9 #include <linux/errno.h>
  10 #include <linux/sched.h>
  11 #include "flask.h"
  12 #include "security.h"
  13 #include "sidtab.h"
  14
  15 #define SIDTAB_HASH(sid) \
  16 (sid & SIDTAB_HASH_MASK)
  17
  18 #define INIT_SIDTAB_LOCK(s) spin_lock_init(&s->lock)
  19 #define SIDTAB_LOCK(s) spin_lock_irq(&s->lock)
  20 #define SIDTAB_UNLOCK(s) spin_unlock_irq(&s->lock)
  21
  22 int sidtab_init(struct sidtab *s)
  23 {
  24         int i;
  25
  26         s->htable = kmalloc(sizeof(*(s->htable)) * SIDTAB_SIZE, GFP_ATOMIC);
  27         if (!s->htable)
  28                 return -ENOMEM;
  29         for (i = 0; i < SIDTAB_SIZE; i++)
  30                 s->htable[i] = NULL;
  31         s->nel = 0;
  32         s->next_sid = 1;
  33         s->shutdown = 0;
  34         INIT_SIDTAB_LOCK(s);
  35         return 0;
  36 }
  37
  38 int sidtab_insert(struct sidtab *s, u32 sid, struct context *context)
  39 {
  40         int hvalue, rc = 0;
  41         struct sidtab_node *prev, *cur, *newnode;
  42
  43         if (!s) {
  44                 rc = -ENOMEM;
  45                 goto out;
  46         }
  47
  48         hvalue = SIDTAB_HASH(sid);
  49         prev = NULL;
  50         cur = s->htable[hvalue];
  51         while (cur != NULL && sid > cur->sid) {
  52                 prev = cur;
  53                 cur = cur->next;
  54         }
  55
  56         if (cur && sid == cur->sid) {
  57                 rc = -EEXIST;
  58                 goto out;
  59         }
  60
  61         newnode = kmalloc(sizeof(*newnode), GFP_ATOMIC);
  62         if (newnode == NULL) {
  63                 rc = -ENOMEM;
  64                 goto out;
  65         }
  66         newnode->sid = sid;
  67         if (context_cpy(&newnode->context, context)) {
  68                 kfree(newnode);
  69                 rc = -ENOMEM;
  70                 goto out;
  71         }
  72
  73         if (prev) {
  74                 newnode->next = prev->next;
  75                 wmb();
  76                 prev->next = newnode;
  77         } else {
  78                 newnode->next = s->htable[hvalue];
  79                 wmb();
  80                 s->htable[hvalue] = newnode;
  81         }
  82
  83         s->nel++;
  84         if (sid >= s->next_sid)
  85                 s->next_sid = sid + 1;
  86 out:
  87         return rc;
  88 }
  89
  90 int sidtab_remove(struct sidtab *s, u32 sid)
  91 {
  92         int hvalue, rc = 0;
  93         struct sidtab_node *cur, *last;
  94
  95         if (!s) {
  96                 rc = -ENOENT;
  97                 goto out;
  98         }
  99
 100         hvalue = SIDTAB_HASH(sid);
 101         last = NULL;
 102         cur = s->htable[hvalue];
 103         while (cur != NULL && sid > cur->sid) {
 104                 last = cur;
 105                 cur = cur->next;
 106         }
 107
 108         if (cur == NULL || sid != cur->sid) {
 109                 rc = -ENOENT;
 110                 goto out;
 111         }
 112
 113         if (last == NULL)
 114                 s->htable[hvalue] = cur->next;
 115         else
 116                 last->next = cur->next;
 117
 118         context_destroy(&cur->context);
 119
 120         kfree(cur);
 121         s->nel--;
 122 out:
 123         return rc;
 124 }
 125
 126 struct context *sidtab_search(struct sidtab *s, u32 sid)
 127 {
 128         int hvalue;
 129         struct sidtab_node *cur;
 130
 131         if (!s)
 132                 return NULL;
 133
 134         hvalue = SIDTAB_HASH(sid);
 135         cur = s->htable[hvalue];
 136         while (cur != NULL && sid > cur->sid)
 137                 cur = cur->next;
 138
 139         if (cur == NULL || sid != cur->sid) {
 140                 /* Remap invalid SIDs to the unlabeled SID. */
 141                 sid = SECINITSID_UNLABELED;
 142                 hvalue = SIDTAB_HASH(sid);
 143                 cur = s->htable[hvalue];
 144                 while (cur != NULL && sid > cur->sid)
 145                         cur = cur->next;
 146                 if (!cur || sid != cur->sid)
 147                         return NULL;
 148         }
 149
 150         return &cur->context;
 151 }
 152
 153 int sidtab_map(struct sidtab *s,
 154                int (*apply) (u32 sid,
 155                              struct context *context,
 156                              void *args),
 157                void *args)
 158 {
 159         int i, rc = 0;
 160         struct sidtab_node *cur;
 161
 162         if (!s)
 163                 goto out;
 164
 165         for (i = 0; i < SIDTAB_SIZE; i++) {
 166                 cur = s->htable[i];
 167                 while (cur != NULL) {
 168                         rc = apply(cur->sid, &cur->context, args);
 169                         if (rc)
 170                                 goto out;
 171                         cur = cur->next;
 172                 }
 173         }
 174 out:
 175         return rc;
 176 }
 177
 178 void sidtab_map_remove_on_error(struct sidtab *s,
 179                                 int (*apply) (u32 sid,
 180                                               struct context *context,
 181                                               void *args),
 182                                 void *args)
 183 {
 184         int i, ret;
 185         struct sidtab_node *last, *cur, *temp;
 186
 187         if (!s)
 188                 return;
 189
 190         for (i = 0; i < SIDTAB_SIZE; i++) {
 191                 last = NULL;
 192                 cur = s->htable[i];
 193                 while (cur != NULL) {
 194                         ret = apply(cur->sid, &cur->context, args);
 195                         if (ret) {
 196                                 if (last) {
 197                                         last->next = cur->next;
 198                                 } else {
 199                                         s->htable[i] = cur->next;
 200                                 }
 201
 202                                 temp = cur;
 203                                 cur = cur->next;
 204                                 context_destroy(&temp->context);
 205                                 kfree(temp);
 206                                 s->nel--;
 207                         } else {
 208                                 last = cur;
 209                                 cur = cur->next;
 210                         }
 211                 }
 212         }
 213
 214         return;
 215 }
 216
 217 static inline u32 sidtab_search_context(struct sidtab *s,
 218                                                   struct context *context)
 219 {
 220         int i;
 221         struct sidtab_node *cur;
 222
 223         for (i = 0; i < SIDTAB_SIZE; i++) {
 224                 cur = s->htable[i];
 225                 while (cur != NULL) {
 226                         if (context_cmp(&cur->context, context))
 227                                 return cur->sid;
 228                         cur = cur->next;
 229                 }
 230         }
 231         return 0;
 232 }
 233
 234 int sidtab_context_to_sid(struct sidtab *s,
 235                           struct context *context,
 236                           u32 *out_sid)
 237 {
 238         u32 sid;
 239         int ret = 0;
 240
 241         *out_sid = SECSID_NULL;
 242
 243         sid = sidtab_search_context(s, context);
 244         if (!sid) {
 245                 SIDTAB_LOCK(s);
 246                 /* Rescan now that we hold the lock. */
 247                 sid = sidtab_search_context(s, context);
 248                 if (sid)
 249                         goto unlock_out;
 250                 /* No SID exists for the context.  Allocate a new one. */
 251                 if (s->next_sid == UINT_MAX || s->shutdown) {
 252                         ret = -ENOMEM;
 253                         goto unlock_out;
 254                 }
 255                 sid = s->next_sid++;
 256                 ret = sidtab_insert(s, sid, context);
 257                 if (ret)
 258                         s->next_sid--;
 259 unlock_out:
 260                 SIDTAB_UNLOCK(s);
 261         }
 262
 263         if (ret)
 264                 return ret;
 265
 266         *out_sid = sid;
 267         return 0;
 268 }
 269
 270 void sidtab_hash_eval(struct sidtab *h, char *tag)
 271 {
 272         int i, chain_len, slots_used, max_chain_len;
 273         struct sidtab_node *cur;
 274
 275         slots_used = 0;
 276         max_chain_len = 0;
 277         for (i = 0; i < SIDTAB_SIZE; i++) {
 278                 cur = h->htable[i];
 279                 if (cur) {
 280                         slots_used++;
 281                         chain_len = 0;
 282                         while (cur) {
 283                                 chain_len++;
 284                                 cur = cur->next;
 285                         }
 286
 287                         if (chain_len > max_chain_len)
 288                                 max_chain_len = chain_len;
 289                 }
 290         }
 291
 292         printk(KERN_INFO "%s:  %d entries and %d/%d buckets used, longest "
 293                "chain length %d\n", tag, h->nel, slots_used, SIDTAB_SIZE,
 294                max_chain_len);
 295 }
 296
 297 void sidtab_destroy(struct sidtab *s)
 298 {
 299         int i;
 300         struct sidtab_node *cur, *temp;
 301
 302         if (!s)
 303                 return;
 304
 305         for (i = 0; i < SIDTAB_SIZE; i++) {
 306                 cur = s->htable[i];
 307                 while (cur != NULL) {
 308                         temp = cur;
 309                         cur = cur->next;
 310                         context_destroy(&temp->context);
 311                         kfree(temp);
 312                 }
 313                 s->htable[i] = NULL;
 314         }
 315         kfree(s->htable);
 316         s->htable = NULL;
 317         s->nel = 0;
 318         s->next_sid = 1;
 319 }
 320
 321 void sidtab_set(struct sidtab *dst, struct sidtab *src)
 322 {
 323         SIDTAB_LOCK(src);
 324         dst->htable = src->htable;
 325         dst->nel = src->nel;
 326         dst->next_sid = src->next_sid;
 327         dst->shutdown = 0;
 328         SIDTAB_UNLOCK(src);
 329 }
 330
 331 void sidtab_shutdown(struct sidtab *s)
 332 {
 333         SIDTAB_LOCK(s);
 334         s->shutdown = 1;
 335         SIDTAB_UNLOCK(s);
 336 }