Loading...
1/* SPDX-License-Identifier: GPL-2.0 */
2/*
3 * A security identifier table (sidtab) is a lookup table
4 * of security context structures indexed by SID value.
5 *
6 * Original author: Stephen Smalley, <sds@tycho.nsa.gov>
7 * Author: Ondrej Mosnacek, <omosnacek@gmail.com>
8 *
9 * Copyright (C) 2018 Red Hat, Inc.
10 */
11#ifndef _SS_SIDTAB_H_
12#define _SS_SIDTAB_H_
13
14#include <linux/spinlock_types.h>
15#include <linux/log2.h>
16#include <linux/hashtable.h>
17
18#include "context.h"
19
20struct sidtab_entry {
21 u32 sid;
22 u32 hash;
23 struct context context;
24#if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
25 struct sidtab_str_cache __rcu *cache;
26#endif
27 struct hlist_node list;
28};
29
30union sidtab_entry_inner {
31 struct sidtab_node_inner *ptr_inner;
32 struct sidtab_node_leaf *ptr_leaf;
33};
34
35/* align node size to page boundary */
36#define SIDTAB_NODE_ALLOC_SHIFT PAGE_SHIFT
37#define SIDTAB_NODE_ALLOC_SIZE PAGE_SIZE
38
39#define size_to_shift(size) ((size) == 1 ? 1 : (const_ilog2((size) - 1) + 1))
40
41#define SIDTAB_INNER_SHIFT \
42 (SIDTAB_NODE_ALLOC_SHIFT - size_to_shift(sizeof(union sidtab_entry_inner)))
43#define SIDTAB_INNER_ENTRIES ((size_t)1 << SIDTAB_INNER_SHIFT)
44#define SIDTAB_LEAF_ENTRIES \
45 (SIDTAB_NODE_ALLOC_SIZE / sizeof(struct sidtab_entry))
46
47#define SIDTAB_MAX_BITS 32
48#define SIDTAB_MAX U32_MAX
49/* ensure enough tree levels for SIDTAB_MAX entries */
50#define SIDTAB_MAX_LEVEL \
51 DIV_ROUND_UP(SIDTAB_MAX_BITS - size_to_shift(SIDTAB_LEAF_ENTRIES), \
52 SIDTAB_INNER_SHIFT)
53
54struct sidtab_node_leaf {
55 struct sidtab_entry entries[SIDTAB_LEAF_ENTRIES];
56};
57
58struct sidtab_node_inner {
59 union sidtab_entry_inner entries[SIDTAB_INNER_ENTRIES];
60};
61
62struct sidtab_isid_entry {
63 int set;
64 struct sidtab_entry entry;
65};
66
67struct sidtab_convert_params {
68 struct convert_context_args *args;
69 struct sidtab *target;
70};
71
72#define SIDTAB_HASH_BITS CONFIG_SECURITY_SELINUX_SIDTAB_HASH_BITS
73#define SIDTAB_HASH_BUCKETS (1 << SIDTAB_HASH_BITS)
74
75struct sidtab {
76 /*
77 * lock-free read access only for as many items as a prior read of
78 * 'count'
79 */
80 union sidtab_entry_inner roots[SIDTAB_MAX_LEVEL + 1];
81 /*
82 * access atomically via {READ|WRITE}_ONCE(); only increment under
83 * spinlock
84 */
85 u32 count;
86 /* access only under spinlock */
87 struct sidtab_convert_params *convert;
88 bool frozen;
89 spinlock_t lock;
90
91#if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
92 /* SID -> context string cache */
93 u32 cache_free_slots;
94 struct list_head cache_lru_list;
95 spinlock_t cache_lock;
96#endif
97
98 /* index == SID - 1 (no entry for SECSID_NULL) */
99 struct sidtab_isid_entry isids[SECINITSID_NUM];
100
101 /* Hash table for fast reverse context-to-sid lookups. */
102 DECLARE_HASHTABLE(context_to_sid, SIDTAB_HASH_BITS);
103};
104
105int sidtab_init(struct sidtab *s);
106int sidtab_set_initial(struct sidtab *s, u32 sid, struct context *context);
107struct sidtab_entry *sidtab_search_entry(struct sidtab *s, u32 sid);
108struct sidtab_entry *sidtab_search_entry_force(struct sidtab *s, u32 sid);
109
110static inline struct context *sidtab_search(struct sidtab *s, u32 sid)
111{
112 struct sidtab_entry *entry = sidtab_search_entry(s, sid);
113
114 return entry ? &entry->context : NULL;
115}
116
117static inline struct context *sidtab_search_force(struct sidtab *s, u32 sid)
118{
119 struct sidtab_entry *entry = sidtab_search_entry_force(s, sid);
120
121 return entry ? &entry->context : NULL;
122}
123
124int sidtab_convert(struct sidtab *s, struct sidtab_convert_params *params);
125
126void sidtab_cancel_convert(struct sidtab *s);
127
128void sidtab_freeze_begin(struct sidtab *s, unsigned long *flags) __acquires(&s->lock);
129void sidtab_freeze_end(struct sidtab *s, unsigned long *flags) __releases(&s->lock);
130
131int sidtab_context_to_sid(struct sidtab *s, struct context *context, u32 *sid);
132
133void sidtab_destroy(struct sidtab *s);
134
135int sidtab_hash_stats(struct sidtab *sidtab, char *page);
136
137#if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
138void sidtab_sid2str_put(struct sidtab *s, struct sidtab_entry *entry,
139 const char *str, u32 str_len);
140int sidtab_sid2str_get(struct sidtab *s, struct sidtab_entry *entry,
141 char **out, u32 *out_len);
142#else
143static inline void sidtab_sid2str_put(struct sidtab *s,
144 struct sidtab_entry *entry,
145 const char *str, u32 str_len)
146{
147}
148static inline int sidtab_sid2str_get(struct sidtab *s,
149 struct sidtab_entry *entry,
150 char **out, u32 *out_len)
151{
152 return -ENOENT;
153}
154#endif /* CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0 */
155
156#endif /* _SS_SIDTAB_H_ */
157
158
1/* SPDX-License-Identifier: GPL-2.0 */
2/*
3 * A security identifier table (sidtab) is a hash table
4 * of security context structures indexed by SID value.
5 *
6 * Author : Stephen Smalley, <sds@tycho.nsa.gov>
7 */
8#ifndef _SS_SIDTAB_H_
9#define _SS_SIDTAB_H_
10
11#include "context.h"
12
13struct sidtab_node {
14 u32 sid; /* security identifier */
15 struct context context; /* security context structure */
16 struct sidtab_node *next;
17};
18
19#define SIDTAB_HASH_BITS 7
20#define SIDTAB_HASH_BUCKETS (1 << SIDTAB_HASH_BITS)
21#define SIDTAB_HASH_MASK (SIDTAB_HASH_BUCKETS-1)
22
23#define SIDTAB_SIZE SIDTAB_HASH_BUCKETS
24
25struct sidtab {
26 struct sidtab_node **htable;
27 unsigned int nel; /* number of elements */
28 unsigned int next_sid; /* next SID to allocate */
29 unsigned char shutdown;
30#define SIDTAB_CACHE_LEN 3
31 struct sidtab_node *cache[SIDTAB_CACHE_LEN];
32 spinlock_t lock;
33};
34
35int sidtab_init(struct sidtab *s);
36int sidtab_insert(struct sidtab *s, u32 sid, struct context *context);
37struct context *sidtab_search(struct sidtab *s, u32 sid);
38struct context *sidtab_search_force(struct sidtab *s, u32 sid);
39
40int sidtab_map(struct sidtab *s,
41 int (*apply) (u32 sid,
42 struct context *context,
43 void *args),
44 void *args);
45
46int sidtab_context_to_sid(struct sidtab *s,
47 struct context *context,
48 u32 *sid);
49
50void sidtab_hash_eval(struct sidtab *h, char *tag);
51void sidtab_destroy(struct sidtab *s);
52void sidtab_set(struct sidtab *dst, struct sidtab *src);
53void sidtab_shutdown(struct sidtab *s);
54
55#endif /* _SS_SIDTAB_H_ */
56
57