2 * Access vector cache interface for object managers.
4 * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
6 #ifndef _SELINUX_AVC_H_
7 #define _SELINUX_AVC_H_
9 #include <linux/stddef.h>
10 #include <linux/errno.h>
11 #include <linux/kernel.h>
12 #include <linux/kdev_t.h>
13 #include <linux/spinlock.h>
14 #include <linux/init.h>
15 #include <linux/in6.h>
16 #include <linux/path.h>
17 #include <asm/system.h>
19 #include "av_permissions.h"
22 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
23 extern int selinux_enforcing;
25 #define selinux_enforcing 1
29 * An entry in the AVC.
38 /* Auxiliary data to use in generating the audit record. */
39 struct avc_audit_data {
41 #define AVC_AUDIT_DATA_FS 1
42 #define AVC_AUDIT_DATA_NET 2
43 #define AVC_AUDIT_DATA_CAP 3
44 #define AVC_AUDIT_DATA_IPC 4
45 struct task_struct *tsk;
63 struct in6_addr daddr;
64 struct in6_addr saddr;
76 /* Initialize an AVC audit data structure. */
77 #define AVC_AUDIT_DATA_INIT(_d,_t) \
78 { memset((_d), 0, sizeof(struct avc_audit_data)); (_d)->type = AVC_AUDIT_DATA_##_t; }
83 struct avc_cache_stats {
87 unsigned int allocations;
88 unsigned int reclaims;
96 void __init avc_init(void);
98 void avc_audit(u32 ssid, u32 tsid,
99 u16 tclass, u32 requested,
100 struct av_decision *avd, int result, struct avc_audit_data *auditdata);
102 #define AVC_STRICT 1 /* Ignore permissive mode. */
103 int avc_has_perm_noaudit(u32 ssid, u32 tsid,
104 u16 tclass, u32 requested,
106 struct av_decision *avd);
108 int avc_has_perm(u32 ssid, u32 tsid,
109 u16 tclass, u32 requested,
110 struct avc_audit_data *auditdata);
112 u32 avc_policy_seqno(void);
114 #define AVC_CALLBACK_GRANT 1
115 #define AVC_CALLBACK_TRY_REVOKE 2
116 #define AVC_CALLBACK_REVOKE 4
117 #define AVC_CALLBACK_RESET 8
118 #define AVC_CALLBACK_AUDITALLOW_ENABLE 16
119 #define AVC_CALLBACK_AUDITALLOW_DISABLE 32
120 #define AVC_CALLBACK_AUDITDENY_ENABLE 64
121 #define AVC_CALLBACK_AUDITDENY_DISABLE 128
123 int avc_add_callback(int (*callback)(u32 event, u32 ssid, u32 tsid,
124 u16 tclass, u32 perms,
126 u32 events, u32 ssid, u32 tsid,
127 u16 tclass, u32 perms);
129 /* Exported to selinuxfs */
130 int avc_get_hash_stats(char *page);
131 extern unsigned int avc_cache_threshold;
133 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
134 DECLARE_PER_CPU(struct avc_cache_stats, avc_cache_stats);
137 #endif /* _SELINUX_AVC_H_ */