1/* SPDX-License-Identifier: GPL-2.0 */
  2/*
  3 * A security identifier table (sidtab) is a lookup table
  4 * of security context structures indexed by SID value.
  5 *
  6 * Original author: Stephen Smalley, <sds@tycho.nsa.gov>
  7 * Author: Ondrej Mosnacek, <omosnacek@gmail.com>
  8 *
  9 * Copyright (C) 2018 Red Hat, Inc.
 10 */
 11#ifndef _SS_SIDTAB_H_
 12#define _SS_SIDTAB_H_
 13
 14#include <linux/spinlock_types.h>
 15#include <linux/log2.h>
 16
 17#include "context.h"
 18
 19struct sidtab_entry_leaf {
 20	struct context context;
 21};
 22
 23struct sidtab_node_inner;
 24struct sidtab_node_leaf;
 25
 26union sidtab_entry_inner {
 27	struct sidtab_node_inner *ptr_inner;
 28	struct sidtab_node_leaf  *ptr_leaf;
 29};
 30
 31/* align node size to page boundary */
 32#define SIDTAB_NODE_ALLOC_SHIFT PAGE_SHIFT
 33#define SIDTAB_NODE_ALLOC_SIZE  PAGE_SIZE
 34
 35#define size_to_shift(size) ((size) == 1 ? 1 : (const_ilog2((size) - 1) + 1))
 36
 37#define SIDTAB_INNER_SHIFT \
 38	(SIDTAB_NODE_ALLOC_SHIFT - size_to_shift(sizeof(union sidtab_entry_inner)))
 39#define SIDTAB_INNER_ENTRIES ((size_t)1 << SIDTAB_INNER_SHIFT)
 40#define SIDTAB_LEAF_ENTRIES \
 41	(SIDTAB_NODE_ALLOC_SIZE / sizeof(struct sidtab_entry_leaf))
 42
 43#define SIDTAB_MAX_BITS 32
 44#define SIDTAB_MAX U32_MAX
 45/* ensure enough tree levels for SIDTAB_MAX entries */
 46#define SIDTAB_MAX_LEVEL \
 47	DIV_ROUND_UP(SIDTAB_MAX_BITS - size_to_shift(SIDTAB_LEAF_ENTRIES), \
 48		     SIDTAB_INNER_SHIFT)
 49
 50struct sidtab_node_leaf {
 51	struct sidtab_entry_leaf entries[SIDTAB_LEAF_ENTRIES];
 52};
 53
 54struct sidtab_node_inner {
 55	union sidtab_entry_inner entries[SIDTAB_INNER_ENTRIES];
 56};
 57
 58struct sidtab_isid_entry {
 59	int set;
 60	struct context context;
 61};
 62
 63struct sidtab_convert_params {
 64	int (*func)(struct context *oldc, struct context *newc, void *args);
 65	void *args;
 66	struct sidtab *target;
 67};
 68
 69#define SIDTAB_RCACHE_SIZE 3
 70
 71struct sidtab {
 72	/*
 73	 * lock-free read access only for as many items as a prior read of
 74	 * 'count'
 75	 */
 76	union sidtab_entry_inner roots[SIDTAB_MAX_LEVEL + 1];
 77	/*
 78	 * access atomically via {READ|WRITE}_ONCE(); only increment under
 79	 * spinlock
 80	 */
 81	u32 count;
 82	/* access only under spinlock */
 83	struct sidtab_convert_params *convert;
 84	spinlock_t lock;
 85
 86	/* reverse lookup cache - access atomically via {READ|WRITE}_ONCE() */
 87	u32 rcache[SIDTAB_RCACHE_SIZE];
 88
 89	/* index == SID - 1 (no entry for SECSID_NULL) */
 90	struct sidtab_isid_entry isids[SECINITSID_NUM];
 91};
 92
 93int sidtab_init(struct sidtab *s);
 94int sidtab_set_initial(struct sidtab *s, u32 sid, struct context *context);
 95struct context *sidtab_search(struct sidtab *s, u32 sid);
 96struct context *sidtab_search_force(struct sidtab *s, u32 sid);
 97
 98int sidtab_convert(struct sidtab *s, struct sidtab_convert_params *params);
 99
100int sidtab_context_to_sid(struct sidtab *s, struct context *context, u32 *sid);
 
 
 
 
 
 
101
 
102void sidtab_destroy(struct sidtab *s);
 
 
103
104#endif	/* _SS_SIDTAB_H_ */
105
106

 1/* SPDX-License-Identifier: GPL-2.0 */
 2/*
 3 * A security identifier table (sidtab) is a hash table
 4 * of security context structures indexed by SID value.
 5 *
 6 * Author : Stephen Smalley, <sds@tycho.nsa.gov>
 
 
 
 7 */
 8#ifndef _SS_SIDTAB_H_
 9#define _SS_SIDTAB_H_
10
 
 
 
11#include "context.h"
12
13struct sidtab_node {
14	u32 sid;		/* security identifier */
15	struct context context;	/* security context structure */
16	struct sidtab_node *next;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
17};
18
19#define SIDTAB_HASH_BITS 7
20#define SIDTAB_HASH_BUCKETS (1 << SIDTAB_HASH_BITS)
21#define SIDTAB_HASH_MASK (SIDTAB_HASH_BUCKETS-1)
 
 
 
 
 
 
 
 
 
 
 
22
23#define SIDTAB_SIZE SIDTAB_HASH_BUCKETS
24
25struct sidtab {
26	struct sidtab_node **htable;
27	unsigned int nel;	/* number of elements */
28	unsigned int next_sid;	/* next SID to allocate */
29	unsigned char shutdown;
30#define SIDTAB_CACHE_LEN	3
31	struct sidtab_node *cache[SIDTAB_CACHE_LEN];
 
 
 
 
 
 
32	spinlock_t lock;
 
 
 
 
 
 
33};
34
35int sidtab_init(struct sidtab *s);
36int sidtab_insert(struct sidtab *s, u32 sid, struct context *context);
37struct context *sidtab_search(struct sidtab *s, u32 sid);
38struct context *sidtab_search_force(struct sidtab *s, u32 sid);
39
40int sidtab_map(struct sidtab *s,
41	       int (*apply) (u32 sid,
42			     struct context *context,
43			     void *args),
44	       void *args);
45
46int sidtab_context_to_sid(struct sidtab *s,
47			  struct context *context,
48			  u32 *sid);
49
50void sidtab_hash_eval(struct sidtab *h, char *tag);
51void sidtab_destroy(struct sidtab *s);
52void sidtab_set(struct sidtab *dst, struct sidtab *src);
53void sidtab_shutdown(struct sidtab *s);
54
55#endif	/* _SS_SIDTAB_H_ */
56
57