1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Implementation of the kernel access vector cache (AVC).
4 *
5 * Authors: Stephen Smalley, <stephen.smalley.work@gmail.com>
6 * James Morris <jmorris@redhat.com>
7 *
8 * Update: KaiGai, Kohei <kaigai@ak.jp.nec.com>
9 * Replaced the avc_lock spinlock by RCU.
10 *
11 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
12 */
13#include <linux/types.h>
14#include <linux/stddef.h>
15#include <linux/kernel.h>
16#include <linux/slab.h>
17#include <linux/fs.h>
18#include <linux/dcache.h>
19#include <linux/init.h>
20#include <linux/skbuff.h>
21#include <linux/percpu.h>
22#include <linux/list.h>
23#include <net/sock.h>
24#include <linux/un.h>
25#include <net/af_unix.h>
26#include <linux/ip.h>
27#include <linux/audit.h>
28#include <linux/ipv6.h>
29#include <net/ipv6.h>
30#include "avc.h"
31#include "avc_ss.h"
32#include "classmap.h"
33
34#define CREATE_TRACE_POINTS
35#include <trace/events/avc.h>
36
37#define AVC_CACHE_SLOTS 512
38#define AVC_DEF_CACHE_THRESHOLD 512
39#define AVC_CACHE_RECLAIM 16
40
41#ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
42#define avc_cache_stats_incr(field) this_cpu_inc(avc_cache_stats.field)
43#else
44#define avc_cache_stats_incr(field) do {} while (0)
45#endif
46
47struct avc_entry {
48 u32 ssid;
49 u32 tsid;
50 u16 tclass;
51 struct av_decision avd;
52 struct avc_xperms_node *xp_node;
53};
54
55struct avc_node {
56 struct avc_entry ae;
57 struct hlist_node list; /* anchored in avc_cache->slots[i] */
58 struct rcu_head rhead;
59};
60
61struct avc_xperms_decision_node {
62 struct extended_perms_decision xpd;
63 struct list_head xpd_list; /* list of extended_perms_decision */
64};
65
66struct avc_xperms_node {
67 struct extended_perms xp;
68 struct list_head xpd_head; /* list head of extended_perms_decision */
69};
70
71struct avc_cache {
72 struct hlist_head slots[AVC_CACHE_SLOTS]; /* head for avc_node->list */
73 spinlock_t slots_lock[AVC_CACHE_SLOTS]; /* lock for writes */
74 atomic_t lru_hint; /* LRU hint for reclaim scan */
75 atomic_t active_nodes;
76 u32 latest_notif; /* latest revocation notification */
77};
78
79struct avc_callback_node {
80 int (*callback) (u32 event);
81 u32 events;
82 struct avc_callback_node *next;
83};
84
85#ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
86DEFINE_PER_CPU(struct avc_cache_stats, avc_cache_stats) = { 0 };
87#endif
88
89struct selinux_avc {
90 unsigned int avc_cache_threshold;
91 struct avc_cache avc_cache;
92};
93
94static struct selinux_avc selinux_avc;
95
96void selinux_avc_init(void)
97{
98 int i;
99
100 selinux_avc.avc_cache_threshold = AVC_DEF_CACHE_THRESHOLD;
101 for (i = 0; i < AVC_CACHE_SLOTS; i++) {
102 INIT_HLIST_HEAD(&selinux_avc.avc_cache.slots[i]);
103 spin_lock_init(&selinux_avc.avc_cache.slots_lock[i]);
104 }
105 atomic_set(v: &selinux_avc.avc_cache.active_nodes, i: 0);
106 atomic_set(v: &selinux_avc.avc_cache.lru_hint, i: 0);
107}
108
109unsigned int avc_get_cache_threshold(void)
110{
111 return selinux_avc.avc_cache_threshold;
112}
113
114void avc_set_cache_threshold(unsigned int cache_threshold)
115{
116 selinux_avc.avc_cache_threshold = cache_threshold;
117}
118
119static struct avc_callback_node *avc_callbacks __ro_after_init;
120static struct kmem_cache *avc_node_cachep __ro_after_init;
121static struct kmem_cache *avc_xperms_data_cachep __ro_after_init;
122static struct kmem_cache *avc_xperms_decision_cachep __ro_after_init;
123static struct kmem_cache *avc_xperms_cachep __ro_after_init;
124
125static inline u32 avc_hash(u32 ssid, u32 tsid, u16 tclass)
126{
127 return (ssid ^ (tsid<<2) ^ (tclass<<4)) & (AVC_CACHE_SLOTS - 1);
128}
129
130/**
131 * avc_init - Initialize the AVC.
132 *
133 * Initialize the access vector cache.
134 */
135void __init avc_init(void)
136{
137 avc_node_cachep = KMEM_CACHE(avc_node, SLAB_PANIC);
138 avc_xperms_cachep = KMEM_CACHE(avc_xperms_node, SLAB_PANIC);
139 avc_xperms_decision_cachep = KMEM_CACHE(avc_xperms_decision_node, SLAB_PANIC);
140 avc_xperms_data_cachep = KMEM_CACHE(extended_perms_data, SLAB_PANIC);
141}
142
143int avc_get_hash_stats(char *page)
144{
145 int i, chain_len, max_chain_len, slots_used;
146 struct avc_node *node;
147 struct hlist_head *head;
148
149 rcu_read_lock();
150
151 slots_used = 0;
152 max_chain_len = 0;
153 for (i = 0; i < AVC_CACHE_SLOTS; i++) {
154 head = &selinux_avc.avc_cache.slots[i];
155 if (!hlist_empty(h: head)) {
156 slots_used++;
157 chain_len = 0;
158 hlist_for_each_entry_rcu(node, head, list)
159 chain_len++;
160 if (chain_len > max_chain_len)
161 max_chain_len = chain_len;
162 }
163 }
164
165 rcu_read_unlock();
166
167 return scnprintf(buf: page, PAGE_SIZE, fmt: "entries: %d\nbuckets used: %d/%d\n"
168 "longest chain: %d\n",
169 atomic_read(v: &selinux_avc.avc_cache.active_nodes),
170 slots_used, AVC_CACHE_SLOTS, max_chain_len);
171}
172
173/*
174 * using a linked list for extended_perms_decision lookup because the list is
175 * always small. i.e. less than 5, typically 1
176 */
177static struct extended_perms_decision *
178avc_xperms_decision_lookup(u8 driver, u8 base_perm,
179 struct avc_xperms_node *xp_node)
180{
181 struct avc_xperms_decision_node *xpd_node;
182
183 list_for_each_entry(xpd_node, &xp_node->xpd_head, xpd_list) {
184 if (xpd_node->xpd.driver == driver &&
185 xpd_node->xpd.base_perm == base_perm)
186 return &xpd_node->xpd;
187 }
188 return NULL;
189}
190
191static inline unsigned int
192avc_xperms_has_perm(struct extended_perms_decision *xpd,
193 u8 perm, u8 which)
194{
195 unsigned int rc = 0;
196
197 if ((which == XPERMS_ALLOWED) &&
198 (xpd->used & XPERMS_ALLOWED))
199 rc = security_xperm_test(xpd->allowed->p, perm);
200 else if ((which == XPERMS_AUDITALLOW) &&
201 (xpd->used & XPERMS_AUDITALLOW))
202 rc = security_xperm_test(xpd->auditallow->p, perm);
203 else if ((which == XPERMS_DONTAUDIT) &&
204 (xpd->used & XPERMS_DONTAUDIT))
205 rc = security_xperm_test(xpd->dontaudit->p, perm);
206 return rc;
207}
208
209static void avc_xperms_allow_perm(struct avc_xperms_node *xp_node,
210 u8 driver, u8 base_perm, u8 perm)
211{
212 struct extended_perms_decision *xpd;
213 security_xperm_set(xp_node->xp.drivers.p, driver);
214 xp_node->xp.base_perms |= base_perm;
215 xpd = avc_xperms_decision_lookup(driver, base_perm, xp_node);
216 if (xpd && xpd->allowed)
217 security_xperm_set(xpd->allowed->p, perm);
218}
219
220static void avc_xperms_decision_free(struct avc_xperms_decision_node *xpd_node)
221{
222 struct extended_perms_decision *xpd;
223
224 xpd = &xpd_node->xpd;
225 if (xpd->allowed)
226 kmem_cache_free(s: avc_xperms_data_cachep, objp: xpd->allowed);
227 if (xpd->auditallow)
228 kmem_cache_free(s: avc_xperms_data_cachep, objp: xpd->auditallow);
229 if (xpd->dontaudit)
230 kmem_cache_free(s: avc_xperms_data_cachep, objp: xpd->dontaudit);
231 kmem_cache_free(s: avc_xperms_decision_cachep, objp: xpd_node);
232}
233
234static void avc_xperms_free(struct avc_xperms_node *xp_node)
235{
236 struct avc_xperms_decision_node *xpd_node, *tmp;
237
238 if (!xp_node)
239 return;
240
241 list_for_each_entry_safe(xpd_node, tmp, &xp_node->xpd_head, xpd_list) {
242 list_del(entry: &xpd_node->xpd_list);
243 avc_xperms_decision_free(xpd_node);
244 }
245 kmem_cache_free(s: avc_xperms_cachep, objp: xp_node);
246}
247
248static void avc_copy_xperms_decision(struct extended_perms_decision *dest,
249 struct extended_perms_decision *src)
250{
251 dest->base_perm = src->base_perm;
252 dest->driver = src->driver;
253 dest->used = src->used;
254 if (dest->used & XPERMS_ALLOWED)
255 memcpy(to: dest->allowed->p, from: src->allowed->p,
256 len: sizeof(src->allowed->p));
257 if (dest->used & XPERMS_AUDITALLOW)
258 memcpy(to: dest->auditallow->p, from: src->auditallow->p,
259 len: sizeof(src->auditallow->p));
260 if (dest->used & XPERMS_DONTAUDIT)
261 memcpy(to: dest->dontaudit->p, from: src->dontaudit->p,
262 len: sizeof(src->dontaudit->p));
263}
264
265/*
266 * similar to avc_copy_xperms_decision, but only copy decision
267 * information relevant to this perm
268 */
269static inline void avc_quick_copy_xperms_decision(u8 perm,
270 struct extended_perms_decision *dest,
271 struct extended_perms_decision *src)
272{
273 /*
274 * compute index of the u32 of the 256 bits (8 u32s) that contain this
275 * command permission
276 */
277 u8 i = perm >> 5;
278
279 dest->base_perm = src->base_perm;
280 dest->used = src->used;
281 if (dest->used & XPERMS_ALLOWED)
282 dest->allowed->p[i] = src->allowed->p[i];
283 if (dest->used & XPERMS_AUDITALLOW)
284 dest->auditallow->p[i] = src->auditallow->p[i];
285 if (dest->used & XPERMS_DONTAUDIT)
286 dest->dontaudit->p[i] = src->dontaudit->p[i];
287}
288
289static struct avc_xperms_decision_node
290 *avc_xperms_decision_alloc(u8 which)
291{
292 struct avc_xperms_decision_node *xpd_node;
293 struct extended_perms_decision *xpd;
294
295 xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, GFP_NOWAIT);
296 if (!xpd_node)
297 return NULL;
298
299 xpd = &xpd_node->xpd;
300 if (which & XPERMS_ALLOWED) {
301 xpd->allowed = kmem_cache_zalloc(avc_xperms_data_cachep,
302 GFP_NOWAIT);
303 if (!xpd->allowed)
304 goto error;
305 }
306 if (which & XPERMS_AUDITALLOW) {
307 xpd->auditallow = kmem_cache_zalloc(avc_xperms_data_cachep,
308 GFP_NOWAIT);
309 if (!xpd->auditallow)
310 goto error;
311 }
312 if (which & XPERMS_DONTAUDIT) {
313 xpd->dontaudit = kmem_cache_zalloc(avc_xperms_data_cachep,
314 GFP_NOWAIT);
315 if (!xpd->dontaudit)
316 goto error;
317 }
318 return xpd_node;
319error:
320 avc_xperms_decision_free(xpd_node);
321 return NULL;
322}
323
324static int avc_add_xperms_decision(struct avc_node *node,
325 struct extended_perms_decision *src)
326{
327 struct avc_xperms_decision_node *dest_xpd;
328
329 dest_xpd = avc_xperms_decision_alloc(which: src->used);
330 if (!dest_xpd)
331 return -ENOMEM;
332 avc_copy_xperms_decision(dest: &dest_xpd->xpd, src);
333 list_add(new: &dest_xpd->xpd_list, head: &node->ae.xp_node->xpd_head);
334 node->ae.xp_node->xp.len++;
335 return 0;
336}
337
338static struct avc_xperms_node *avc_xperms_alloc(void)
339{
340 struct avc_xperms_node *xp_node;
341
342 xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT);
343 if (!xp_node)
344 return xp_node;
345 INIT_LIST_HEAD(list: &xp_node->xpd_head);
346 return xp_node;
347}
348
349static int avc_xperms_populate(struct avc_node *node,
350 struct avc_xperms_node *src)
351{
352 struct avc_xperms_node *dest;
353 struct avc_xperms_decision_node *dest_xpd;
354 struct avc_xperms_decision_node *src_xpd;
355
356 if (src->xp.len == 0)
357 return 0;
358 dest = avc_xperms_alloc();
359 if (!dest)
360 return -ENOMEM;
361
362 memcpy(to: dest->xp.drivers.p, from: src->xp.drivers.p, len: sizeof(dest->xp.drivers.p));
363 dest->xp.len = src->xp.len;
364 dest->xp.base_perms = src->xp.base_perms;
365
366 /* for each source xpd allocate a destination xpd and copy */
367 list_for_each_entry(src_xpd, &src->xpd_head, xpd_list) {
368 dest_xpd = avc_xperms_decision_alloc(which: src_xpd->xpd.used);
369 if (!dest_xpd)
370 goto error;
371 avc_copy_xperms_decision(dest: &dest_xpd->xpd, src: &src_xpd->xpd);
372 list_add(new: &dest_xpd->xpd_list, head: &dest->xpd_head);
373 }
374 node->ae.xp_node = dest;
375 return 0;
376error:
377 avc_xperms_free(xp_node: dest);
378 return -ENOMEM;
379
380}
381
382static inline u32 avc_xperms_audit_required(u32 requested,
383 struct av_decision *avd,
384 struct extended_perms_decision *xpd,
385 u8 perm,
386 int result,
387 u32 *deniedp)
388{
389 u32 denied, audited;
390
391 denied = requested & ~avd->allowed;
392 if (unlikely(denied)) {
393 audited = denied & avd->auditdeny;
394 if (audited && xpd) {
395 if (avc_xperms_has_perm(xpd, perm, XPERMS_DONTAUDIT))
396 audited = 0;
397 }
398 } else if (result) {
399 audited = denied = requested;
400 } else {
401 audited = requested & avd->auditallow;
402 if (audited && xpd) {
403 if (!avc_xperms_has_perm(xpd, perm, XPERMS_AUDITALLOW))
404 audited = 0;
405 }
406 }
407
408 *deniedp = denied;
409 return audited;
410}
411
412static inline int avc_xperms_audit(u32 ssid, u32 tsid, u16 tclass,
413 u32 requested, struct av_decision *avd,
414 struct extended_perms_decision *xpd,
415 u8 perm, int result,
416 struct common_audit_data *ad)
417{
418 u32 audited, denied;
419
420 audited = avc_xperms_audit_required(
421 requested, avd, xpd, perm, result, deniedp: &denied);
422 if (likely(!audited))
423 return 0;
424 return slow_avc_audit(ssid, tsid, tclass, requested,
425 audited, denied, result, a: ad);
426}
427
428static void avc_node_free(struct rcu_head *rhead)
429{
430 struct avc_node *node = container_of(rhead, struct avc_node, rhead);
431 avc_xperms_free(xp_node: node->ae.xp_node);
432 kmem_cache_free(s: avc_node_cachep, objp: node);
433 avc_cache_stats_incr(frees);
434}
435
436static void avc_node_delete(struct avc_node *node)
437{
438 hlist_del_rcu(n: &node->list);
439 call_rcu(head: &node->rhead, func: avc_node_free);
440 atomic_dec(v: &selinux_avc.avc_cache.active_nodes);
441}
442
443static void avc_node_kill(struct avc_node *node)
444{
445 avc_xperms_free(xp_node: node->ae.xp_node);
446 kmem_cache_free(s: avc_node_cachep, objp: node);
447 avc_cache_stats_incr(frees);
448 atomic_dec(v: &selinux_avc.avc_cache.active_nodes);
449}
450
451static void avc_node_replace(struct avc_node *new, struct avc_node *old)
452{
453 hlist_replace_rcu(old: &old->list, new: &new->list);
454 call_rcu(head: &old->rhead, func: avc_node_free);
455 atomic_dec(v: &selinux_avc.avc_cache.active_nodes);
456}
457
458static inline int avc_reclaim_node(void)
459{
460 struct avc_node *node;
461 int hvalue, try, ecx;
462 unsigned long flags;
463 struct hlist_head *head;
464 spinlock_t *lock;
465
466 for (try = 0, ecx = 0; try < AVC_CACHE_SLOTS; try++) {
467 hvalue = atomic_inc_return(v: &selinux_avc.avc_cache.lru_hint) &
468 (AVC_CACHE_SLOTS - 1);
469 head = &selinux_avc.avc_cache.slots[hvalue];
470 lock = &selinux_avc.avc_cache.slots_lock[hvalue];
471
472 if (!spin_trylock_irqsave(lock, flags))
473 continue;
474
475 rcu_read_lock();
476 hlist_for_each_entry(node, head, list) {
477 avc_node_delete(node);
478 avc_cache_stats_incr(reclaims);
479 ecx++;
480 if (ecx >= AVC_CACHE_RECLAIM) {
481 rcu_read_unlock();
482 spin_unlock_irqrestore(lock, flags);
483 goto out;
484 }
485 }
486 rcu_read_unlock();
487 spin_unlock_irqrestore(lock, flags);
488 }
489out:
490 return ecx;
491}
492
493static struct avc_node *avc_alloc_node(void)
494{
495 struct avc_node *node;
496
497 node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT);
498 if (!node)
499 goto out;
500
501 INIT_HLIST_NODE(h: &node->list);
502 avc_cache_stats_incr(allocations);
503
504 if (atomic_inc_return(v: &selinux_avc.avc_cache.active_nodes) >
505 selinux_avc.avc_cache_threshold)
506 avc_reclaim_node();
507
508out:
509 return node;
510}
511
512static void avc_node_populate(struct avc_node *node, u32 ssid, u32 tsid, u16 tclass, struct av_decision *avd)
513{
514 node->ae.ssid = ssid;
515 node->ae.tsid = tsid;
516 node->ae.tclass = tclass;
517 memcpy(to: &node->ae.avd, from: avd, len: sizeof(node->ae.avd));
518}
519
520static inline struct avc_node *avc_search_node(u32 ssid, u32 tsid, u16 tclass)
521{
522 struct avc_node *node, *ret = NULL;
523 u32 hvalue;
524 struct hlist_head *head;
525
526 hvalue = avc_hash(ssid, tsid, tclass);
527 head = &selinux_avc.avc_cache.slots[hvalue];
528 hlist_for_each_entry_rcu(node, head, list) {
529 if (ssid == node->ae.ssid &&
530 tclass == node->ae.tclass &&
531 tsid == node->ae.tsid) {
532 ret = node;
533 break;
534 }
535 }
536
537 return ret;
538}
539
540/**
541 * avc_lookup - Look up an AVC entry.
542 * @ssid: source security identifier
543 * @tsid: target security identifier
544 * @tclass: target security class
545 *
546 * Look up an AVC entry that is valid for the
547 * (@ssid, @tsid), interpreting the permissions
548 * based on @tclass. If a valid AVC entry exists,
549 * then this function returns the avc_node.
550 * Otherwise, this function returns NULL.
551 */
552static struct avc_node *avc_lookup(u32 ssid, u32 tsid, u16 tclass)
553{
554 struct avc_node *node;
555
556 avc_cache_stats_incr(lookups);
557 node = avc_search_node(ssid, tsid, tclass);
558
559 if (node)
560 return node;
561
562 avc_cache_stats_incr(misses);
563 return NULL;
564}
565
566static int avc_latest_notif_update(u32 seqno, int is_insert)
567{
568 int ret = 0;
569 static DEFINE_SPINLOCK(notif_lock);
570 unsigned long flag;
571
572 spin_lock_irqsave(&notif_lock, flag);
573 if (is_insert) {
574 if (seqno < selinux_avc.avc_cache.latest_notif) {
575 pr_warn("SELinux: avc: seqno %d < latest_notif %d\n",
576 seqno, selinux_avc.avc_cache.latest_notif);
577 ret = -EAGAIN;
578 }
579 } else {
580 if (seqno > selinux_avc.avc_cache.latest_notif)
581 selinux_avc.avc_cache.latest_notif = seqno;
582 }
583 spin_unlock_irqrestore(lock: &notif_lock, flags: flag);
584
585 return ret;
586}
587
588/**
589 * avc_insert - Insert an AVC entry.
590 * @ssid: source security identifier
591 * @tsid: target security identifier
592 * @tclass: target security class
593 * @avd: resulting av decision
594 * @xp_node: resulting extended permissions
595 *
596 * Insert an AVC entry for the SID pair
597 * (@ssid, @tsid) and class @tclass.
598 * The access vectors and the sequence number are
599 * normally provided by the security server in
600 * response to a security_compute_av() call. If the
601 * sequence number @avd->seqno is not less than the latest
602 * revocation notification, then the function copies
603 * the access vectors into a cache entry.
604 */
605static void avc_insert(u32 ssid, u32 tsid, u16 tclass,
606 struct av_decision *avd, struct avc_xperms_node *xp_node)
607{
608 struct avc_node *pos, *node = NULL;
609 u32 hvalue;
610 unsigned long flag;
611 spinlock_t *lock;
612 struct hlist_head *head;
613
614 if (avc_latest_notif_update(seqno: avd->seqno, is_insert: 1))
615 return;
616
617 node = avc_alloc_node();
618 if (!node)
619 return;
620
621 avc_node_populate(node, ssid, tsid, tclass, avd);
622 if (avc_xperms_populate(node, src: xp_node)) {
623 avc_node_kill(node);
624 return;
625 }
626
627 hvalue = avc_hash(ssid, tsid, tclass);
628 head = &selinux_avc.avc_cache.slots[hvalue];
629 lock = &selinux_avc.avc_cache.slots_lock[hvalue];
630 spin_lock_irqsave(lock, flag);
631 hlist_for_each_entry(pos, head, list) {
632 if (pos->ae.ssid == ssid &&
633 pos->ae.tsid == tsid &&
634 pos->ae.tclass == tclass) {
635 avc_node_replace(new: node, old: pos);
636 goto found;
637 }
638 }
639 hlist_add_head_rcu(n: &node->list, h: head);
640found:
641 spin_unlock_irqrestore(lock, flags: flag);
642}
643
644/**
645 * avc_audit_pre_callback - SELinux specific information
646 * will be called by generic audit code
647 * @ab: the audit buffer
648 * @a: audit_data
649 */
650static void avc_audit_pre_callback(struct audit_buffer *ab, void *a)
651{
652 struct common_audit_data *ad = a;
653 struct selinux_audit_data *sad = ad->selinux_audit_data;
654 u32 av = sad->audited, perm;
655 const char *const *perms;
656 u32 i;
657
658 audit_log_format(ab, fmt: "avc: %s ", sad->denied ? "denied" : "granted");
659
660 if (av == 0) {
661 audit_log_format(ab, fmt: " null");
662 return;
663 }
664
665 perms = secclass_map[sad->tclass-1].perms;
666
667 audit_log_format(ab, fmt: " {");
668 i = 0;
669 perm = 1;
670 while (i < (sizeof(av) * 8)) {
671 if ((perm & av) && perms[i]) {
672 audit_log_format(ab, fmt: " %s", perms[i]);
673 av &= ~perm;
674 }
675 i++;
676 perm <<= 1;
677 }
678
679 if (av)
680 audit_log_format(ab, fmt: " 0x%x", av);
681
682 audit_log_format(ab, fmt: " } for ");
683}
684
685/**
686 * avc_audit_post_callback - SELinux specific information
687 * will be called by generic audit code
688 * @ab: the audit buffer
689 * @a: audit_data
690 */
691static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
692{
693 struct common_audit_data *ad = a;
694 struct selinux_audit_data *sad = ad->selinux_audit_data;
695 char *scontext = NULL;
696 char *tcontext = NULL;
697 const char *tclass = NULL;
698 u32 scontext_len;
699 u32 tcontext_len;
700 int rc;
701
702 rc = security_sid_to_context(sid: sad->ssid, scontext: &scontext,
703 scontext_len: &scontext_len);
704 if (rc)
705 audit_log_format(ab, fmt: " ssid=%d", sad->ssid);
706 else
707 audit_log_format(ab, fmt: " scontext=%s", scontext);
708
709 rc = security_sid_to_context(sid: sad->tsid, scontext: &tcontext,
710 scontext_len: &tcontext_len);
711 if (rc)
712 audit_log_format(ab, fmt: " tsid=%d", sad->tsid);
713 else
714 audit_log_format(ab, fmt: " tcontext=%s", tcontext);
715
716 tclass = secclass_map[sad->tclass-1].name;
717 audit_log_format(ab, fmt: " tclass=%s", tclass);
718
719 if (sad->denied)
720 audit_log_format(ab, fmt: " permissive=%u", sad->result ? 0 : 1);
721
722 trace_selinux_audited(sad, scontext, tcontext, tclass);
723 kfree(objp: tcontext);
724 kfree(objp: scontext);
725
726 /* in case of invalid context report also the actual context string */
727 rc = security_sid_to_context_inval(sid: sad->ssid, scontext: &scontext,
728 scontext_len: &scontext_len);
729 if (!rc && scontext) {
730 if (scontext_len && scontext[scontext_len - 1] == '\0')
731 scontext_len--;
732 audit_log_format(ab, fmt: " srawcon=");
733 audit_log_n_untrustedstring(ab, string: scontext, n: scontext_len);
734 kfree(objp: scontext);
735 }
736
737 rc = security_sid_to_context_inval(sid: sad->tsid, scontext: &scontext,
738 scontext_len: &scontext_len);
739 if (!rc && scontext) {
740 if (scontext_len && scontext[scontext_len - 1] == '\0')
741 scontext_len--;
742 audit_log_format(ab, fmt: " trawcon=");
743 audit_log_n_untrustedstring(ab, string: scontext, n: scontext_len);
744 kfree(objp: scontext);
745 }
746}
747
748/*
749 * This is the slow part of avc audit with big stack footprint.
750 * Note that it is non-blocking and can be called from under
751 * rcu_read_lock().
752 */
753noinline int slow_avc_audit(u32 ssid, u32 tsid, u16 tclass,
754 u32 requested, u32 audited, u32 denied, int result,
755 struct common_audit_data *a)
756{
757 struct common_audit_data stack_data;
758 struct selinux_audit_data sad;
759
760 if (WARN_ON(!tclass || tclass >= ARRAY_SIZE(secclass_map)))
761 return -EINVAL;
762
763 if (!a) {
764 a = &stack_data;
765 a->type = LSM_AUDIT_DATA_NONE;
766 }
767
768 sad.tclass = tclass;
769 sad.requested = requested;
770 sad.ssid = ssid;
771 sad.tsid = tsid;
772 sad.audited = audited;
773 sad.denied = denied;
774 sad.result = result;
775
776 a->selinux_audit_data = &sad;
777
778 common_lsm_audit(a, pre_audit: avc_audit_pre_callback, post_audit: avc_audit_post_callback);
779 return 0;
780}
781
782/**
783 * avc_add_callback - Register a callback for security events.
784 * @callback: callback function
785 * @events: security events
786 *
787 * Register a callback function for events in the set @events.
788 * Returns %0 on success or -%ENOMEM if insufficient memory
789 * exists to add the callback.
790 */
791int __init avc_add_callback(int (*callback)(u32 event), u32 events)
792{
793 struct avc_callback_node *c;
794 int rc = 0;
795
796 c = kmalloc(sizeof(*c), GFP_KERNEL);
797 if (!c) {
798 rc = -ENOMEM;
799 goto out;
800 }
801
802 c->callback = callback;
803 c->events = events;
804 c->next = avc_callbacks;
805 avc_callbacks = c;
806out:
807 return rc;
808}
809
810/**
811 * avc_update_node - Update an AVC entry
812 * @event : Updating event
813 * @perms : Permission mask bits
814 * @driver: xperm driver information
815 * @base_perm: the base permission associated with the extended permission
816 * @xperm: xperm permissions
817 * @ssid: AVC entry source sid
818 * @tsid: AVC entry target sid
819 * @tclass : AVC entry target object class
820 * @seqno : sequence number when decision was made
821 * @xpd: extended_perms_decision to be added to the node
822 * @flags: the AVC_* flags, e.g. AVC_EXTENDED_PERMS, or 0.
823 *
824 * if a valid AVC entry doesn't exist,this function returns -ENOENT.
825 * if kmalloc() called internal returns NULL, this function returns -ENOMEM.
826 * otherwise, this function updates the AVC entry. The original AVC-entry object
827 * will release later by RCU.
828 */
829static int avc_update_node(u32 event, u32 perms, u8 driver, u8 base_perm,
830 u8 xperm, u32 ssid, u32 tsid, u16 tclass, u32 seqno,
831 struct extended_perms_decision *xpd, u32 flags)
832{
833 u32 hvalue;
834 int rc = 0;
835 unsigned long flag;
836 struct avc_node *pos, *node, *orig = NULL;
837 struct hlist_head *head;
838 spinlock_t *lock;
839
840 node = avc_alloc_node();
841 if (!node) {
842 rc = -ENOMEM;
843 goto out;
844 }
845
846 /* Lock the target slot */
847 hvalue = avc_hash(ssid, tsid, tclass);
848
849 head = &selinux_avc.avc_cache.slots[hvalue];
850 lock = &selinux_avc.avc_cache.slots_lock[hvalue];
851
852 spin_lock_irqsave(lock, flag);
853
854 hlist_for_each_entry(pos, head, list) {
855 if (ssid == pos->ae.ssid &&
856 tsid == pos->ae.tsid &&
857 tclass == pos->ae.tclass &&
858 seqno == pos->ae.avd.seqno){
859 orig = pos;
860 break;
861 }
862 }
863
864 if (!orig) {
865 rc = -ENOENT;
866 avc_node_kill(node);
867 goto out_unlock;
868 }
869
870 /*
871 * Copy and replace original node.
872 */
873
874 avc_node_populate(node, ssid, tsid, tclass, avd: &orig->ae.avd);
875
876 if (orig->ae.xp_node) {
877 rc = avc_xperms_populate(node, src: orig->ae.xp_node);
878 if (rc) {
879 avc_node_kill(node);
880 goto out_unlock;
881 }
882 }
883
884 switch (event) {
885 case AVC_CALLBACK_GRANT:
886 node->ae.avd.allowed |= perms;
887 if (node->ae.xp_node && (flags & AVC_EXTENDED_PERMS))
888 avc_xperms_allow_perm(xp_node: node->ae.xp_node, driver, base_perm, perm: xperm);
889 break;
890 case AVC_CALLBACK_TRY_REVOKE:
891 case AVC_CALLBACK_REVOKE:
892 node->ae.avd.allowed &= ~perms;
893 break;
894 case AVC_CALLBACK_AUDITALLOW_ENABLE:
895 node->ae.avd.auditallow |= perms;
896 break;
897 case AVC_CALLBACK_AUDITALLOW_DISABLE:
898 node->ae.avd.auditallow &= ~perms;
899 break;
900 case AVC_CALLBACK_AUDITDENY_ENABLE:
901 node->ae.avd.auditdeny |= perms;
902 break;
903 case AVC_CALLBACK_AUDITDENY_DISABLE:
904 node->ae.avd.auditdeny &= ~perms;
905 break;
906 case AVC_CALLBACK_ADD_XPERMS:
907 rc = avc_add_xperms_decision(node, src: xpd);
908 if (rc) {
909 avc_node_kill(node);
910 goto out_unlock;
911 }
912 break;
913 }
914 avc_node_replace(new: node, old: orig);
915out_unlock:
916 spin_unlock_irqrestore(lock, flags: flag);
917out:
918 return rc;
919}
920
921/**
922 * avc_flush - Flush the cache
923 */
924static void avc_flush(void)
925{
926 struct hlist_head *head;
927 struct avc_node *node;
928 spinlock_t *lock;
929 unsigned long flag;
930 int i;
931
932 for (i = 0; i < AVC_CACHE_SLOTS; i++) {
933 head = &selinux_avc.avc_cache.slots[i];
934 lock = &selinux_avc.avc_cache.slots_lock[i];
935
936 spin_lock_irqsave(lock, flag);
937 /*
938 * With preemptible RCU, the outer spinlock does not
939 * prevent RCU grace periods from ending.
940 */
941 rcu_read_lock();
942 hlist_for_each_entry(node, head, list)
943 avc_node_delete(node);
944 rcu_read_unlock();
945 spin_unlock_irqrestore(lock, flags: flag);
946 }
947}
948
949/**
950 * avc_ss_reset - Flush the cache and revalidate migrated permissions.
951 * @seqno: policy sequence number
952 */
953int avc_ss_reset(u32 seqno)
954{
955 struct avc_callback_node *c;
956 int rc = 0, tmprc;
957
958 avc_flush();
959
960 for (c = avc_callbacks; c; c = c->next) {
961 if (c->events & AVC_CALLBACK_RESET) {
962 tmprc = c->callback(AVC_CALLBACK_RESET);
963 /* save the first error encountered for the return
964 value and continue processing the callbacks */
965 if (!rc)
966 rc = tmprc;
967 }
968 }
969
970 avc_latest_notif_update(seqno, is_insert: 0);
971 return rc;
972}
973
974/**
975 * avc_compute_av - Add an entry to the AVC based on the security policy
976 * @ssid: subject
977 * @tsid: object/target
978 * @tclass: object class
979 * @avd: access vector decision
980 * @xp_node: AVC extended permissions node
981 *
982 * Slow-path helper function for avc_has_perm_noaudit, when the avc_node lookup
983 * fails. Don't inline this, since it's the slow-path and just results in a
984 * bigger stack frame.
985 */
986static noinline void avc_compute_av(u32 ssid, u32 tsid, u16 tclass,
987 struct av_decision *avd,
988 struct avc_xperms_node *xp_node)
989{
990 INIT_LIST_HEAD(list: &xp_node->xpd_head);
991 security_compute_av(ssid, tsid, tclass, avd, xperms: &xp_node->xp);
992 avc_insert(ssid, tsid, tclass, avd, xp_node);
993}
994
995static noinline int avc_denied(u32 ssid, u32 tsid, u16 tclass, u32 requested,
996 u8 driver, u8 base_perm, u8 xperm,
997 unsigned int flags, struct av_decision *avd)
998{
999 if (flags & AVC_STRICT)
1000 return -EACCES;
1001
1002 if (enforcing_enabled() &&
1003 !(avd->flags & AVD_FLAGS_PERMISSIVE))
1004 return -EACCES;
1005
1006 avc_update_node(AVC_CALLBACK_GRANT, perms: requested, driver, base_perm,
1007 xperm, ssid, tsid, tclass, seqno: avd->seqno, NULL, flags);
1008 return 0;
1009}
1010
1011/*
1012 * The avc extended permissions logic adds an additional 256 bits of
1013 * permissions to an avc node when extended permissions for that node are
1014 * specified in the avtab. If the additional 256 permissions is not adequate,
1015 * as-is the case with ioctls, then multiple may be chained together and the
1016 * driver field is used to specify which set contains the permission.
1017 */
1018int avc_has_extended_perms(u32 ssid, u32 tsid, u16 tclass, u32 requested,
1019 u8 driver, u8 base_perm, u8 xperm,
1020 struct common_audit_data *ad)
1021{
1022 struct avc_node *node;
1023 struct av_decision avd;
1024 u32 denied;
1025 struct extended_perms_decision local_xpd;
1026 struct extended_perms_decision *xpd = NULL;
1027 struct extended_perms_data allowed;
1028 struct extended_perms_data auditallow;
1029 struct extended_perms_data dontaudit;
1030 struct avc_xperms_node local_xp_node;
1031 struct avc_xperms_node *xp_node;
1032 int rc = 0, rc2;
1033
1034 xp_node = &local_xp_node;
1035 if (WARN_ON(!requested))
1036 return -EACCES;
1037
1038 rcu_read_lock();
1039
1040 node = avc_lookup(ssid, tsid, tclass);
1041 if (unlikely(!node)) {
1042 avc_compute_av(ssid, tsid, tclass, avd: &avd, xp_node);
1043 } else {
1044 memcpy(to: &avd, from: &node->ae.avd, len: sizeof(avd));
1045 xp_node = node->ae.xp_node;
1046 }
1047 /* if extended permissions are not defined, only consider av_decision */
1048 if (!xp_node || !xp_node->xp.len)
1049 goto decision;
1050
1051 local_xpd.allowed = &allowed;
1052 local_xpd.auditallow = &auditallow;
1053 local_xpd.dontaudit = &dontaudit;
1054
1055 xpd = avc_xperms_decision_lookup(driver, base_perm, xp_node);
1056 if (unlikely(!xpd)) {
1057 /*
1058 * Compute the extended_perms_decision only if the driver
1059 * is flagged and the base permission is known.
1060 */
1061 if (!security_xperm_test(xp_node->xp.drivers.p, driver) ||
1062 !(xp_node->xp.base_perms & base_perm)) {
1063 avd.allowed &= ~requested;
1064 goto decision;
1065 }
1066 rcu_read_unlock();
1067 security_compute_xperms_decision(ssid, tsid, tclass, driver,
1068 base_perm, xpermd: &local_xpd);
1069 rcu_read_lock();
1070 avc_update_node(AVC_CALLBACK_ADD_XPERMS, perms: requested, driver,
1071 base_perm, xperm, ssid, tsid, tclass, seqno: avd.seqno,
1072 xpd: &local_xpd, flags: 0);
1073 } else {
1074 avc_quick_copy_xperms_decision(perm: xperm, dest: &local_xpd, src: xpd);
1075 }
1076 xpd = &local_xpd;
1077
1078 if (!avc_xperms_has_perm(xpd, perm: xperm, XPERMS_ALLOWED))
1079 avd.allowed &= ~requested;
1080
1081decision:
1082 denied = requested & ~(avd.allowed);
1083 if (unlikely(denied))
1084 rc = avc_denied(ssid, tsid, tclass, requested, driver,
1085 base_perm, xperm, AVC_EXTENDED_PERMS, avd: &avd);
1086
1087 rcu_read_unlock();
1088
1089 rc2 = avc_xperms_audit(ssid, tsid, tclass, requested,
1090 avd: &avd, xpd, perm: xperm, result: rc, ad);
1091 if (rc2)
1092 return rc2;
1093 return rc;
1094}
1095
1096/**
1097 * avc_perm_nonode - Add an entry to the AVC
1098 * @ssid: subject
1099 * @tsid: object/target
1100 * @tclass: object class
1101 * @requested: requested permissions
1102 * @flags: AVC flags
1103 * @avd: access vector decision
1104 *
1105 * This is the "we have no node" part of avc_has_perm_noaudit(), which is
1106 * unlikely and needs extra stack space for the new node that we generate, so
1107 * don't inline it.
1108 */
1109static noinline int avc_perm_nonode(u32 ssid, u32 tsid, u16 tclass,
1110 u32 requested, unsigned int flags,
1111 struct av_decision *avd)
1112{
1113 u32 denied;
1114 struct avc_xperms_node xp_node;
1115
1116 avc_compute_av(ssid, tsid, tclass, avd, xp_node: &xp_node);
1117 denied = requested & ~(avd->allowed);
1118 if (unlikely(denied))
1119 return avc_denied(ssid, tsid, tclass, requested, driver: 0, base_perm: 0, xperm: 0,
1120 flags, avd);
1121 return 0;
1122}
1123
1124/**
1125 * avc_has_perm_noaudit - Check permissions but perform no auditing.
1126 * @ssid: source security identifier
1127 * @tsid: target security identifier
1128 * @tclass: target security class
1129 * @requested: requested permissions, interpreted based on @tclass
1130 * @flags: AVC_STRICT or 0
1131 * @avd: access vector decisions
1132 *
1133 * Check the AVC to determine whether the @requested permissions are granted
1134 * for the SID pair (@ssid, @tsid), interpreting the permissions
1135 * based on @tclass, and call the security server on a cache miss to obtain
1136 * a new decision and add it to the cache. Return a copy of the decisions
1137 * in @avd. Return %0 if all @requested permissions are granted,
1138 * -%EACCES if any permissions are denied, or another -errno upon
1139 * other errors. This function is typically called by avc_has_perm(),
1140 * but may also be called directly to separate permission checking from
1141 * auditing, e.g. in cases where a lock must be held for the check but
1142 * should be released for the auditing.
1143 */
1144inline int avc_has_perm_noaudit(u32 ssid, u32 tsid,
1145 u16 tclass, u32 requested,
1146 unsigned int flags,
1147 struct av_decision *avd)
1148{
1149 u32 denied;
1150 struct avc_node *node;
1151
1152 if (WARN_ON(!requested))
1153 return -EACCES;
1154
1155 rcu_read_lock();
1156 node = avc_lookup(ssid, tsid, tclass);
1157 if (unlikely(!node)) {
1158 rcu_read_unlock();
1159 return avc_perm_nonode(ssid, tsid, tclass, requested,
1160 flags, avd);
1161 }
1162 denied = requested & ~node->ae.avd.allowed;
1163 memcpy(to: avd, from: &node->ae.avd, len: sizeof(*avd));
1164 rcu_read_unlock();
1165
1166 if (unlikely(denied))
1167 return avc_denied(ssid, tsid, tclass, requested, driver: 0, base_perm: 0, xperm: 0,
1168 flags, avd);
1169 return 0;
1170}
1171
1172/**
1173 * avc_has_perm - Check permissions and perform any appropriate auditing.
1174 * @ssid: source security identifier
1175 * @tsid: target security identifier
1176 * @tclass: target security class
1177 * @requested: requested permissions, interpreted based on @tclass
1178 * @auditdata: auxiliary audit data
1179 *
1180 * Check the AVC to determine whether the @requested permissions are granted
1181 * for the SID pair (@ssid, @tsid), interpreting the permissions
1182 * based on @tclass, and call the security server on a cache miss to obtain
1183 * a new decision and add it to the cache. Audit the granting or denial of
1184 * permissions in accordance with the policy. Return %0 if all @requested
1185 * permissions are granted, -%EACCES if any permissions are denied, or
1186 * another -errno upon other errors.
1187 */
1188int avc_has_perm(u32 ssid, u32 tsid, u16 tclass,
1189 u32 requested, struct common_audit_data *auditdata)
1190{
1191 struct av_decision avd;
1192 int rc, rc2;
1193
1194 rc = avc_has_perm_noaudit(ssid, tsid, tclass, requested, flags: 0,
1195 avd: &avd);
1196
1197 rc2 = avc_audit(ssid, tsid, tclass, requested, avd: &avd, result: rc,
1198 a: auditdata);
1199 if (rc2)
1200 return rc2;
1201 return rc;
1202}
1203
1204u32 avc_policy_seqno(void)
1205{
1206 return selinux_avc.avc_cache.latest_notif;
1207}
1208