selinux/ss/sidtab.h

0001 /* SPDX-License-Identifier: GPL-2.0 */
0002 /*
0003  * A security identifier table (sidtab) is a lookup table
0004  * of security context structures indexed by SID value.
0005  *
0006  * Original author: Stephen Smalley, <sds@tycho.nsa.gov>
0007  * Author: Ondrej Mosnacek, <omosnacek@gmail.com>
0008  *
0009  * Copyright (C) 2018 Red Hat, Inc.
0010  */
0011 #ifndef _SS_SIDTAB_H_
0012 #define _SS_SIDTAB_H_
0013
0014 #include <linux/spinlock_types.h>
0015 #include <linux/log2.h>
0016 #include <linux/hashtable.h>
0017
0018 #include "context.h"
0019
0020 struct sidtab_entry {
0021     u32 sid;
0022     u32 hash;
0023     struct context context;
0024 #if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
0025     struct sidtab_str_cache __rcu *cache;
0026 #endif
0027     struct hlist_node list;
0028 };
0029
0030 union sidtab_entry_inner {
0031     struct sidtab_node_inner *ptr_inner;
0032     struct sidtab_node_leaf  *ptr_leaf;
0033 };
0034
0035 /* align node size to page boundary */
0036 #define SIDTAB_NODE_ALLOC_SHIFT PAGE_SHIFT
0037 #define SIDTAB_NODE_ALLOC_SIZE  PAGE_SIZE
0038
0039 #define size_to_shift(size) ((size) == 1 ? 1 : (const_ilog2((size) - 1) + 1))
0040
0041 #define SIDTAB_INNER_SHIFT \
0042     (SIDTAB_NODE_ALLOC_SHIFT - size_to_shift(sizeof(union sidtab_entry_inner)))
0043 #define SIDTAB_INNER_ENTRIES ((size_t)1 << SIDTAB_INNER_SHIFT)
0044 #define SIDTAB_LEAF_ENTRIES \
0045     (SIDTAB_NODE_ALLOC_SIZE / sizeof(struct sidtab_entry))
0046
0047 #define SIDTAB_MAX_BITS 32
0048 #define SIDTAB_MAX U32_MAX
0049 /* ensure enough tree levels for SIDTAB_MAX entries */
0050 #define SIDTAB_MAX_LEVEL \
0051     DIV_ROUND_UP(SIDTAB_MAX_BITS - size_to_shift(SIDTAB_LEAF_ENTRIES), \
0052              SIDTAB_INNER_SHIFT)
0053
0054 struct sidtab_node_leaf {
0055     struct sidtab_entry entries[SIDTAB_LEAF_ENTRIES];
0056 };
0057
0058 struct sidtab_node_inner {
0059     union sidtab_entry_inner entries[SIDTAB_INNER_ENTRIES];
0060 };
0061
0062 struct sidtab_isid_entry {
0063     int set;
0064     struct sidtab_entry entry;
0065 };
0066
0067 struct sidtab_convert_params {
0068     int (*func)(struct context *oldc, struct context *newc, void *args);
0069     void *args;
0070     struct sidtab *target;
0071 };
0072
0073 #define SIDTAB_HASH_BITS CONFIG_SECURITY_SELINUX_SIDTAB_HASH_BITS
0074 #define SIDTAB_HASH_BUCKETS (1 << SIDTAB_HASH_BITS)
0075
0076 struct sidtab {
0077     /*
0078      * lock-free read access only for as many items as a prior read of
0079      * 'count'
0080      */
0081     union sidtab_entry_inner roots[SIDTAB_MAX_LEVEL + 1];
0082     /*
0083      * access atomically via {READ|WRITE}_ONCE(); only increment under
0084      * spinlock
0085      */
0086     u32 count;
0087     /* access only under spinlock */
0088     struct sidtab_convert_params *convert;
0089     bool frozen;
0090     spinlock_t lock;
0091
0092 #if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
0093     /* SID -> context string cache */
0094     u32 cache_free_slots;
0095     struct list_head cache_lru_list;
0096     spinlock_t cache_lock;
0097 #endif
0098
0099     /* index == SID - 1 (no entry for SECSID_NULL) */
0100     struct sidtab_isid_entry isids[SECINITSID_NUM];
0101
0102     /* Hash table for fast reverse context-to-sid lookups. */
0103     DECLARE_HASHTABLE(context_to_sid, SIDTAB_HASH_BITS);
0104 };
0105
0106 int sidtab_init(struct sidtab *s);
0107 int sidtab_set_initial(struct sidtab *s, u32 sid, struct context *context);
0108 struct sidtab_entry *sidtab_search_entry(struct sidtab *s, u32 sid);
0109 struct sidtab_entry *sidtab_search_entry_force(struct sidtab *s, u32 sid);
0110
0111 static inline struct context *sidtab_search(struct sidtab *s, u32 sid)
0112 {
0113     struct sidtab_entry *entry = sidtab_search_entry(s, sid);
0114
0115     return entry ? &entry->context : NULL;
0116 }
0117
0118 static inline struct context *sidtab_search_force(struct sidtab *s, u32 sid)
0119 {
0120     struct sidtab_entry *entry = sidtab_search_entry_force(s, sid);
0121
0122     return entry ? &entry->context : NULL;
0123 }
0124
0125 int sidtab_convert(struct sidtab *s, struct sidtab_convert_params *params);
0126
0127 void sidtab_cancel_convert(struct sidtab *s);
0128
0129 void sidtab_freeze_begin(struct sidtab *s, unsigned long *flags) __acquires(&s->lock);
0130 void sidtab_freeze_end(struct sidtab *s, unsigned long *flags) __releases(&s->lock);
0131
0132 int sidtab_context_to_sid(struct sidtab *s, struct context *context, u32 *sid);
0133
0134 void sidtab_destroy(struct sidtab *s);
0135
0136 int sidtab_hash_stats(struct sidtab *sidtab, char *page);
0137
0138 #if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
0139 void sidtab_sid2str_put(struct sidtab *s, struct sidtab_entry *entry,
0140             const char *str, u32 str_len);
0141 int sidtab_sid2str_get(struct sidtab *s, struct sidtab_entry *entry,
0142                char **out, u32 *out_len);
0143 #else
0144 static inline void sidtab_sid2str_put(struct sidtab *s,
0145                       struct sidtab_entry *entry,
0146                       const char *str, u32 str_len)
0147 {
0148 }
0149 static inline int sidtab_sid2str_get(struct sidtab *s,
0150                      struct sidtab_entry *entry,
0151                      char **out, u32 *out_len)
0152 {
0153     return -ENOENT;
0154 }
0155 #endif /* CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0 */
0156
0157 #endif  /* _SS_SIDTAB_H_ */
0158
0159