2 * Access vector cache interface for object managers.
4 * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
6 #ifndef _SELINUX_AVC_H_
7 #define _SELINUX_AVC_H_
9 #include <linux/stddef.h>
10 #include <linux/errno.h>
11 #include <linux/kernel.h>
12 #include <linux/kdev_t.h>
13 #include <linux/spinlock.h>
14 #include <linux/init.h>
15 #include <linux/audit.h>
16 #include <linux/lsm_audit.h>
17 #include <linux/in6.h>
19 #include "av_permissions.h"
22 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
23 extern int selinux_enforcing
;
25 #define selinux_enforcing 1
29 * An entry in the AVC.
41 struct avc_cache_stats
{
44 unsigned int allocations
;
45 unsigned int reclaims
;
50 * We only need this data after we have decided to send an audit message.
52 struct selinux_late_audit_data
{
63 * We collect this at the beginning or during an selinux security operation
65 struct selinux_audit_data
{
67 * auditdeny is a bit tricky and unintuitive. See the
68 * comments in avc.c for it's meaning and usage.
71 struct selinux_late_audit_data
*slad
;
78 void __init
avc_init(void);
80 int avc_audit(u32 ssid
, u32 tsid
,
81 u16 tclass
, u32 requested
,
82 struct av_decision
*avd
,
84 struct common_audit_data
*a
, unsigned flags
);
86 #define AVC_STRICT 1 /* Ignore permissive mode. */
87 int avc_has_perm_noaudit(u32 ssid
, u32 tsid
,
88 u16 tclass
, u32 requested
,
90 struct av_decision
*avd
);
92 int avc_has_perm_flags(u32 ssid
, u32 tsid
,
93 u16 tclass
, u32 requested
,
94 struct common_audit_data
*auditdata
,
97 static inline int avc_has_perm(u32 ssid
, u32 tsid
,
98 u16 tclass
, u32 requested
,
99 struct common_audit_data
*auditdata
)
101 return avc_has_perm_flags(ssid
, tsid
, tclass
, requested
, auditdata
, 0);
104 u32
avc_policy_seqno(void);
106 #define AVC_CALLBACK_GRANT 1
107 #define AVC_CALLBACK_TRY_REVOKE 2
108 #define AVC_CALLBACK_REVOKE 4
109 #define AVC_CALLBACK_RESET 8
110 #define AVC_CALLBACK_AUDITALLOW_ENABLE 16
111 #define AVC_CALLBACK_AUDITALLOW_DISABLE 32
112 #define AVC_CALLBACK_AUDITDENY_ENABLE 64
113 #define AVC_CALLBACK_AUDITDENY_DISABLE 128
115 int avc_add_callback(int (*callback
)(u32 event
, u32 ssid
, u32 tsid
,
116 u16 tclass
, u32 perms
,
118 u32 events
, u32 ssid
, u32 tsid
,
119 u16 tclass
, u32 perms
);
121 /* Exported to selinuxfs */
122 int avc_get_hash_stats(char *page
);
123 extern unsigned int avc_cache_threshold
;
125 /* Attempt to free avc node cache */
126 void avc_disable(void);
128 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
129 DECLARE_PER_CPU(struct avc_cache_stats
, avc_cache_stats
);
132 #endif /* _SELINUX_AVC_H_ */