1 /* SELinux access controls for nscd.
2 Copyright (C) 2004 Free Software Foundation, Inc.
3 This file is part of the GNU C Library.
4 Contributed by Matthew Rickard <mjricka@epoch.ncsc.mil>, 2004.
6 The GNU C Library is free software; you can redistribute it and/or
7 modify it under the terms of the GNU Lesser General Public
8 License as published by the Free Software Foundation; either
9 version 2.1 of the License, or (at your option) any later version.
11 The GNU C Library is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
16 You should have received a copy of the GNU Lesser General Public
17 License along with the GNU C Library; if not, write to the Free
18 Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
29 #include <selinux/av_permissions.h>
30 #include <selinux/avc.h>
31 #include <selinux/flask.h>
32 #include <selinux/selinux.h>
39 /* Global variable to tell if the kernel has SELinux support. */
42 /* Define mappings of access vector permissions to request types. */
43 static const int perms
[LASTREQ
] =
45 [GETPWBYNAME
] = NSCD__GETPWD
,
46 [GETPWBYUID
] = NSCD__GETPWD
,
47 [GETGRBYNAME
] = NSCD__GETGRP
,
48 [GETGRBYGID
] = NSCD__GETGRP
,
49 [GETHOSTBYNAME
] = NSCD__GETHOST
,
50 [GETHOSTBYNAMEv6
] = NSCD__GETHOST
,
51 [GETHOSTBYADDR
] = NSCD__GETHOST
,
52 [GETHOSTBYADDRv6
] = NSCD__GETHOST
,
53 [GETSTAT
] = NSCD__GETSTAT
,
54 [SHUTDOWN
] = NSCD__ADMIN
,
55 [INVALIDATE
] = NSCD__ADMIN
,
56 [GETFDPW
] = NSCD__SHMEMPWD
,
57 [GETFDGR
] = NSCD__SHMEMGRP
,
58 [GETFDHST
] = NSCD__SHMEMHOST
,
59 [GETAI
] = NSCD__GETHOST
,
60 [INITGROUPS
] = NSCD__GETGRP
63 /* Store an entry ref to speed AVC decisions. */
64 static struct avc_entry_ref aeref
;
66 /* Thread to listen for SELinux status changes via netlink. */
67 static pthread_t avc_notify_thread
;
69 /* Prototypes for AVC callback functions. */
70 static void *avc_create_thread (void (*run
) (void));
71 static void avc_stop_thread (void *thread
);
72 static void *avc_alloc_lock (void);
73 static void avc_get_lock (void *lock
);
74 static void avc_release_lock (void *lock
);
75 static void avc_free_lock (void *lock
);
77 /* AVC callback structures for use in avc_init. */
78 static const struct avc_log_callback log_cb
=
83 static const struct avc_thread_callback thread_cb
=
85 .func_create_thread
= avc_create_thread
,
86 .func_stop_thread
= avc_stop_thread
88 static const struct avc_lock_callback lock_cb
=
90 .func_alloc_lock
= avc_alloc_lock
,
91 .func_get_lock
= avc_get_lock
,
92 .func_release_lock
= avc_release_lock
,
93 .func_free_lock
= avc_free_lock
97 /* Determine if we are running on an SELinux kernel. Set selinux_enabled
100 nscd_selinux_enabled (int *selinux_enabled
)
102 *selinux_enabled
= is_selinux_enabled ();
103 if (*selinux_enabled
< 0)
105 dbg_log (_("Failed to determine if kernel supports SELinux"));
111 /* Create thread for AVC netlink notification. */
113 avc_create_thread (void (*run
) (void))
118 pthread_create (&avc_notify_thread
, NULL
, (void *(*) (void *)) run
, NULL
);
120 error (EXIT_FAILURE
, rc
, _("Failed to start AVC thread"));
122 return &avc_notify_thread
;
126 /* Stop AVC netlink thread. */
128 avc_stop_thread (void *thread
)
130 pthread_cancel (*(pthread_t
*) thread
);
134 /* Allocate a new AVC lock. */
136 avc_alloc_lock (void)
138 pthread_mutex_t
*avc_mutex
;
140 avc_mutex
= malloc (sizeof (pthread_mutex_t
));
141 if (avc_mutex
== NULL
)
142 error (EXIT_FAILURE
, errno
, _("Failed to create AVC lock"));
143 pthread_mutex_init (avc_mutex
, NULL
);
149 /* Acquire an AVC lock. */
151 avc_get_lock (void *lock
)
153 pthread_mutex_lock (lock
);
157 /* Release an AVC lock. */
159 avc_release_lock (void *lock
)
161 pthread_mutex_unlock (lock
);
165 /* Free an AVC lock. */
167 avc_free_lock (void *lock
)
169 pthread_mutex_destroy (lock
);
174 /* Initialize the user space access vector cache (AVC) for NSCD along with
175 log/thread/lock callbacks. */
179 avc_entry_ref_init (&aeref
);
181 if (avc_init ("avc", NULL
, &log_cb
, &thread_cb
, &lock_cb
) < 0)
182 error (EXIT_FAILURE
, errno
, _("Failed to start AVC"));
184 dbg_log (_("Access Vector Cache (AVC) started"));
188 /* Check the permission from the caller (via getpeercon) to nscd.
189 Returns 0 if access is allowed, 1 if denied, and -1 on error. */
191 nscd_request_avc_has_perm (int fd
, request_type req
)
193 /* Initialize to NULL so we know what to free in case of failure. */
194 security_context_t scon
= NULL
;
195 security_context_t tcon
= NULL
;
196 security_id_t ssid
= NULL
;
197 security_id_t tsid
= NULL
;
200 if (getpeercon (fd
, &scon
) < 0)
202 dbg_log (_("Error getting context of socket peer"));
205 if (getcon (&tcon
) < 0)
207 dbg_log (_("Error getting context of nscd"));
210 if (avc_context_to_sid (scon
, &ssid
) < 0
211 || avc_context_to_sid (tcon
, &tsid
) < 0)
213 dbg_log (_("Error getting sid from context"));
217 rc
= avc_has_perm (ssid
, tsid
, SECCLASS_NSCD
, perms
[req
], &aeref
, NULL
) < 0;
233 /* Wrapper to get AVC statistics. */
235 nscd_avc_cache_stats (struct avc_cache_stats
*cstats
)
237 avc_cache_stats (cstats
);
241 /* Print the AVC statistics to stdout. */
243 nscd_avc_print_stats (struct avc_cache_stats
*cstats
)
245 printf (_("\nSELinux AVC Statistics:\n\n"
246 "%15u entry lookups\n"
248 "%15u entry misses\n"
249 "%15u entry discards\n"
253 "%15u CAV misses\n"),
254 cstats
->entry_lookups
, cstats
->entry_hits
, cstats
->entry_misses
,
255 cstats
->entry_discards
, cstats
->cav_lookups
, cstats
->cav_hits
,
256 cstats
->cav_probes
, cstats
->cav_misses
);
260 /* Clean up the AVC before exiting. */
262 nscd_avc_destroy (void)
267 #endif /* HAVE_SELINUX */