1 | /* SPDX-License-Identifier: GPL-2.0 */ |
2 | /* |
3 | * A security identifier table (sidtab) is a lookup table |
4 | * of security context structures indexed by SID value. |
5 | * |
6 | * Original author: Stephen Smalley, <stephen.smalley.work@gmail.com> |
7 | * Author: Ondrej Mosnacek, <omosnacek@gmail.com> |
8 | * |
9 | * Copyright (C) 2018 Red Hat, Inc. |
10 | */ |
11 | #ifndef _SS_SIDTAB_H_ |
12 | #define _SS_SIDTAB_H_ |
13 | |
14 | #include <linux/spinlock_types.h> |
15 | #include <linux/log2.h> |
16 | #include <linux/hashtable.h> |
17 | |
18 | #include "context.h" |
19 | |
20 | struct sidtab_entry { |
21 | u32 sid; |
22 | u32 hash; |
23 | struct context context; |
24 | #if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0 |
25 | struct sidtab_str_cache __rcu *cache; |
26 | #endif |
27 | struct hlist_node list; |
28 | }; |
29 | |
30 | union sidtab_entry_inner { |
31 | struct sidtab_node_inner *ptr_inner; |
32 | struct sidtab_node_leaf *ptr_leaf; |
33 | }; |
34 | |
35 | /* align node size to page boundary */ |
36 | #define SIDTAB_NODE_ALLOC_SHIFT PAGE_SHIFT |
37 | #define SIDTAB_NODE_ALLOC_SIZE PAGE_SIZE |
38 | |
39 | #define size_to_shift(size) ((size) == 1 ? 1 : (const_ilog2((size) - 1) + 1)) |
40 | |
41 | #define SIDTAB_INNER_SHIFT \ |
42 | (SIDTAB_NODE_ALLOC_SHIFT - size_to_shift(sizeof(union sidtab_entry_inner))) |
43 | #define SIDTAB_INNER_ENTRIES ((size_t)1 << SIDTAB_INNER_SHIFT) |
44 | #define SIDTAB_LEAF_ENTRIES \ |
45 | (SIDTAB_NODE_ALLOC_SIZE / sizeof(struct sidtab_entry)) |
46 | |
47 | #define SIDTAB_MAX_BITS 32 |
48 | #define SIDTAB_MAX U32_MAX |
49 | /* ensure enough tree levels for SIDTAB_MAX entries */ |
50 | #define SIDTAB_MAX_LEVEL \ |
51 | DIV_ROUND_UP(SIDTAB_MAX_BITS - size_to_shift(SIDTAB_LEAF_ENTRIES), \ |
52 | SIDTAB_INNER_SHIFT) |
53 | |
54 | struct sidtab_node_leaf { |
55 | struct sidtab_entry entries[SIDTAB_LEAF_ENTRIES]; |
56 | }; |
57 | |
58 | struct sidtab_node_inner { |
59 | union sidtab_entry_inner entries[SIDTAB_INNER_ENTRIES]; |
60 | }; |
61 | |
62 | struct sidtab_isid_entry { |
63 | int set; |
64 | struct sidtab_entry entry; |
65 | }; |
66 | |
67 | struct sidtab_convert_params { |
68 | struct convert_context_args *args; |
69 | struct sidtab *target; |
70 | }; |
71 | |
72 | #define SIDTAB_HASH_BITS CONFIG_SECURITY_SELINUX_SIDTAB_HASH_BITS |
73 | #define SIDTAB_HASH_BUCKETS (1 << SIDTAB_HASH_BITS) |
74 | |
75 | struct sidtab { |
76 | /* |
77 | * lock-free read access only for as many items as a prior read of |
78 | * 'count' |
79 | */ |
80 | union sidtab_entry_inner roots[SIDTAB_MAX_LEVEL + 1]; |
81 | /* |
82 | * access atomically via {READ|WRITE}_ONCE(); only increment under |
83 | * spinlock |
84 | */ |
85 | u32 count; |
86 | /* access only under spinlock */ |
87 | struct sidtab_convert_params *convert; |
88 | bool frozen; |
89 | spinlock_t lock; |
90 | |
91 | #if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0 |
92 | /* SID -> context string cache */ |
93 | u32 cache_free_slots; |
94 | struct list_head cache_lru_list; |
95 | spinlock_t cache_lock; |
96 | #endif |
97 | |
98 | /* index == SID - 1 (no entry for SECSID_NULL) */ |
99 | struct sidtab_isid_entry isids[SECINITSID_NUM]; |
100 | |
101 | /* Hash table for fast reverse context-to-sid lookups. */ |
102 | DECLARE_HASHTABLE(context_to_sid, SIDTAB_HASH_BITS); |
103 | }; |
104 | |
105 | int sidtab_init(struct sidtab *s); |
106 | int sidtab_set_initial(struct sidtab *s, u32 sid, struct context *context); |
107 | struct sidtab_entry *sidtab_search_entry(struct sidtab *s, u32 sid); |
108 | struct sidtab_entry *sidtab_search_entry_force(struct sidtab *s, u32 sid); |
109 | |
110 | static inline struct context *sidtab_search(struct sidtab *s, u32 sid) |
111 | { |
112 | struct sidtab_entry *entry = sidtab_search_entry(s, sid); |
113 | |
114 | return entry ? &entry->context : NULL; |
115 | } |
116 | |
117 | static inline struct context *sidtab_search_force(struct sidtab *s, u32 sid) |
118 | { |
119 | struct sidtab_entry *entry = sidtab_search_entry_force(s, sid); |
120 | |
121 | return entry ? &entry->context : NULL; |
122 | } |
123 | |
124 | int sidtab_convert(struct sidtab *s, struct sidtab_convert_params *params); |
125 | |
126 | void sidtab_cancel_convert(struct sidtab *s); |
127 | |
128 | void sidtab_freeze_begin(struct sidtab *s, unsigned long *flags) __acquires(&s->lock); |
129 | void sidtab_freeze_end(struct sidtab *s, unsigned long *flags) __releases(&s->lock); |
130 | |
131 | int sidtab_context_to_sid(struct sidtab *s, struct context *context, u32 *sid); |
132 | |
133 | void sidtab_destroy(struct sidtab *s); |
134 | |
135 | int sidtab_hash_stats(struct sidtab *sidtab, char *page); |
136 | |
137 | #if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0 |
138 | void sidtab_sid2str_put(struct sidtab *s, struct sidtab_entry *entry, |
139 | const char *str, u32 str_len); |
140 | int sidtab_sid2str_get(struct sidtab *s, struct sidtab_entry *entry, |
141 | char **out, u32 *out_len); |
142 | #else |
143 | static inline void sidtab_sid2str_put(struct sidtab *s, |
144 | struct sidtab_entry *entry, |
145 | const char *str, u32 str_len) |
146 | { |
147 | } |
148 | static inline int sidtab_sid2str_get(struct sidtab *s, |
149 | struct sidtab_entry *entry, |
150 | char **out, u32 *out_len) |
151 | { |
152 | return -ENOENT; |
153 | } |
154 | #endif /* CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0 */ |
155 | |
156 | #endif /* _SS_SIDTAB_H_ */ |
157 | |
158 | |
159 | |