MIRRORS/linux-yocto
1
0
Fork 0
mirror of git://git.yoctoproject.org/linux-yocto.git synced 2025-07-06 13:55:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

selinux: stop passing selinux_state pointers and their offspring

Browse Source 
Linus observed that the pervasive passing of selinux_state pointers
introduced by me in commit aa8e712cee ("selinux: wrap global selinux
state") adds overhead and complexity without providing any
benefit. The original idea was to pave the way for SELinux namespaces
but those have not yet been implemented and there isn't currently
a concrete plan to do so. Remove the passing of the selinux_state
pointers, reverting to direct use of the single global selinux_state,
and likewise remove passing of child pointers like the selinux_avc.
The selinux_policy pointer remains as it is needed for atomic switching
of policies.

Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/oe-kbuild-all/202303101057.mZ3Gv5fK-lkp@intel.com/
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Stephen Smalley 2023-03-09 13:30:37 -05:00 committed by Paul Moore
parent f62ca0b6e3
commit e67b79850f
18 changed files with 651 additions and 995 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

197
security/selinux/avc.c
View File

@ -93,7 +93,7 @@ struct selinux_avc {
static struct selinux_avc selinux_avc; static struct selinux_avc selinux_avc;
void selinux_avc_init(struct selinux_avc **avc) void selinux_avc_init(void)
{ {
int i; int i;
@ -104,18 +104,16 @@ void selinux_avc_init(struct selinux_avc **avc)
} }
atomic_set(&selinux_avc.avc_cache.active_nodes, 0); atomic_set(&selinux_avc.avc_cache.active_nodes, 0);
atomic_set(&selinux_avc.avc_cache.lru_hint, 0); atomic_set(&selinux_avc.avc_cache.lru_hint, 0);
*avc = &selinux_avc;
} }
unsigned int avc_get_cache_threshold(struct selinux_avc *avc) unsigned int avc_get_cache_threshold(void)
{ {
return avc->avc_cache_threshold; return selinux_avc.avc_cache_threshold;
} }
void avc_set_cache_threshold(struct selinux_avc *avc, void avc_set_cache_threshold(unsigned int cache_threshold)
unsigned int cache_threshold)
{ {
avc->avc_cache_threshold = cache_threshold; selinux_avc.avc_cache_threshold = cache_threshold;
} }
static struct avc_callback_node *avc_callbacks __ro_after_init; static struct avc_callback_node *avc_callbacks __ro_after_init;
@ -150,7 +148,7 @@ void __init avc_init(void)
0, SLAB_PANIC, NULL); 0, SLAB_PANIC, NULL);
} }
int avc_get_hash_stats(struct selinux_avc *avc, char *page) int avc_get_hash_stats(char *page)
{ {
int i, chain_len, max_chain_len, slots_used; int i, chain_len, max_chain_len, slots_used;
struct avc_node *node; struct avc_node *node;
@ -161,7 +159,7 @@ int avc_get_hash_stats(struct selinux_avc *avc, char *page)
slots_used = 0; slots_used = 0;
max_chain_len = 0; max_chain_len = 0;
for (i = 0; i < AVC_CACHE_SLOTS; i++) { for (i = 0; i < AVC_CACHE_SLOTS; i++) {
head = &avc->avc_cache.slots[i]; head = &selinux_avc.avc_cache.slots[i];
if (!hlist_empty(head)) { if (!hlist_empty(head)) {
slots_used++; slots_used++;
chain_len = 0; chain_len = 0;
@ -176,7 +174,7 @@ int avc_get_hash_stats(struct selinux_avc *avc, char *page)
return scnprintf(page, PAGE_SIZE, "entries: %d\nbuckets used: %d/%d\n" return scnprintf(page, PAGE_SIZE, "entries: %d\nbuckets used: %d/%d\n"
"longest chain: %d\n", "longest chain: %d\n",
atomic_read(&avc->avc_cache.active_nodes), atomic_read(&selinux_avc.avc_cache.active_nodes),
slots_used, AVC_CACHE_SLOTS, max_chain_len); slots_used, AVC_CACHE_SLOTS, max_chain_len);
} }
@ -414,8 +412,7 @@ static inline u32 avc_xperms_audit_required(u32 requested,
return audited; return audited;
} }
static inline int avc_xperms_audit(struct selinux_state *state, static inline int avc_xperms_audit(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
u32 requested, struct av_decision *avd, u32 requested, struct av_decision *avd,
struct extended_perms_decision *xpd, struct extended_perms_decision *xpd,
u8 perm, int result, u8 perm, int result,
@ -427,7 +424,7 @@ static inline int avc_xperms_audit(struct selinux_state *state,
requested, avd, xpd, perm, result, &denied); requested, avd, xpd, perm, result, &denied);
if (likely(!audited)) if (likely(!audited))
return 0; return 0;
return slow_avc_audit(state, ssid, tsid, tclass, requested, return slow_avc_audit(ssid, tsid, tclass, requested,
audited, denied, result, ad); audited, denied, result, ad);
} }
@ -439,30 +436,29 @@ static void avc_node_free(struct rcu_head *rhead)
avc_cache_stats_incr(frees); avc_cache_stats_incr(frees);
} }
static void avc_node_delete(struct selinux_avc *avc, struct avc_node *node) static void avc_node_delete(struct avc_node *node)
{ {
hlist_del_rcu(&node->list); hlist_del_rcu(&node->list);
call_rcu(&node->rhead, avc_node_free); call_rcu(&node->rhead, avc_node_free);
atomic_dec(&avc->avc_cache.active_nodes); atomic_dec(&selinux_avc.avc_cache.active_nodes);
} }
static void avc_node_kill(struct selinux_avc *avc, struct avc_node *node) static void avc_node_kill(struct avc_node *node)
{ {
avc_xperms_free(node->ae.xp_node); avc_xperms_free(node->ae.xp_node);
kmem_cache_free(avc_node_cachep, node); kmem_cache_free(avc_node_cachep, node);
avc_cache_stats_incr(frees); avc_cache_stats_incr(frees);
atomic_dec(&avc->avc_cache.active_nodes); atomic_dec(&selinux_avc.avc_cache.active_nodes);
} }
static void avc_node_replace(struct selinux_avc *avc, static void avc_node_replace(struct avc_node *new, struct avc_node *old)
struct avc_node *new, struct avc_node *old)
{ {
hlist_replace_rcu(&old->list, &new->list); hlist_replace_rcu(&old->list, &new->list);
call_rcu(&old->rhead, avc_node_free); call_rcu(&old->rhead, avc_node_free);
atomic_dec(&avc->avc_cache.active_nodes); atomic_dec(&selinux_avc.avc_cache.active_nodes);
} }
static inline int avc_reclaim_node(struct selinux_avc *avc) static inline int avc_reclaim_node(void)
{ {
struct avc_node *node; struct avc_node *node;
int hvalue, try, ecx; int hvalue, try, ecx;
@ -471,17 +467,17 @@ static inline int avc_reclaim_node(struct selinux_avc *avc)
spinlock_t *lock; spinlock_t *lock;
for (try = 0, ecx = 0; try < AVC_CACHE_SLOTS; try++) { for (try = 0, ecx = 0; try < AVC_CACHE_SLOTS; try++) {
hvalue = atomic_inc_return(&avc->avc_cache.lru_hint) & hvalue = atomic_inc_return(&selinux_avc.avc_cache.lru_hint) &
(AVC_CACHE_SLOTS - 1); (AVC_CACHE_SLOTS - 1);
head = &avc->avc_cache.slots[hvalue]; head = &selinux_avc.avc_cache.slots[hvalue];
lock = &avc->avc_cache.slots_lock[hvalue]; lock = &selinux_avc.avc_cache.slots_lock[hvalue];
if (!spin_trylock_irqsave(lock, flags)) if (!spin_trylock_irqsave(lock, flags))
continue; continue;
rcu_read_lock(); rcu_read_lock();
hlist_for_each_entry(node, head, list) { hlist_for_each_entry(node, head, list) {
avc_node_delete(avc, node); avc_node_delete(node);
avc_cache_stats_incr(reclaims); avc_cache_stats_incr(reclaims);
ecx++; ecx++;
if (ecx >= AVC_CACHE_RECLAIM) { if (ecx >= AVC_CACHE_RECLAIM) {
@ -497,7 +493,7 @@ out:
return ecx; return ecx;
} }
static struct avc_node *avc_alloc_node(struct selinux_avc *avc) static struct avc_node *avc_alloc_node(void)
{ {
struct avc_node *node; struct avc_node *node;
@ -508,9 +504,9 @@ static struct avc_node *avc_alloc_node(struct selinux_avc *avc)
INIT_HLIST_NODE(&node->list); INIT_HLIST_NODE(&node->list);
avc_cache_stats_incr(allocations); avc_cache_stats_incr(allocations);
if (atomic_inc_return(&avc->avc_cache.active_nodes) > if (atomic_inc_return(&selinux_avc.avc_cache.active_nodes) >
avc->avc_cache_threshold) selinux_avc.avc_cache_threshold)
avc_reclaim_node(avc); avc_reclaim_node();
out: out:
return node; return node;
@ -524,15 +520,14 @@ static void avc_node_populate(struct avc_node *node, u32 ssid, u32 tsid, u16 tcl
memcpy(&node->ae.avd, avd, sizeof(node->ae.avd)); memcpy(&node->ae.avd, avd, sizeof(node->ae.avd));
} }
static inline struct avc_node *avc_search_node(struct selinux_avc *avc, static inline struct avc_node *avc_search_node(u32 ssid, u32 tsid, u16 tclass)
u32 ssid, u32 tsid, u16 tclass)
{ {
struct avc_node *node, *ret = NULL; struct avc_node *node, *ret = NULL;
int hvalue; int hvalue;
struct hlist_head *head; struct hlist_head *head;
hvalue = avc_hash(ssid, tsid, tclass); hvalue = avc_hash(ssid, tsid, tclass);
head = &avc->avc_cache.slots[hvalue]; head = &selinux_avc.avc_cache.slots[hvalue];
hlist_for_each_entry_rcu(node, head, list) { hlist_for_each_entry_rcu(node, head, list) {
if (ssid == node->ae.ssid && if (ssid == node->ae.ssid &&
tclass == node->ae.tclass && tclass == node->ae.tclass &&
@ -547,7 +542,6 @@ static inline struct avc_node *avc_search_node(struct selinux_avc *avc,
/** /**
* avc_lookup - Look up an AVC entry. * avc_lookup - Look up an AVC entry.
* @avc: the access vector cache
* @ssid: source security identifier * @ssid: source security identifier
* @tsid: target security identifier * @tsid: target security identifier
* @tclass: target security class * @tclass: target security class
@ -558,13 +552,12 @@ static inline struct avc_node *avc_search_node(struct selinux_avc *avc,
* then this function returns the avc_node. * then this function returns the avc_node.
* Otherwise, this function returns NULL. * Otherwise, this function returns NULL.
*/ */
static struct avc_node *avc_lookup(struct selinux_avc *avc, static struct avc_node *avc_lookup(u32 ssid, u32 tsid, u16 tclass)
u32 ssid, u32 tsid, u16 tclass)
{ {
struct avc_node *node; struct avc_node *node;
avc_cache_stats_incr(lookups); avc_cache_stats_incr(lookups);
node = avc_search_node(avc, ssid, tsid, tclass); node = avc_search_node(ssid, tsid, tclass);
if (node) if (node)
return node; return node;
@ -573,8 +566,7 @@ static struct avc_node *avc_lookup(struct selinux_avc *avc,
return NULL; return NULL;
} }
static int avc_latest_notif_update(struct selinux_avc *avc, static int avc_latest_notif_update(int seqno, int is_insert)
int seqno, int is_insert)
{ {
int ret = 0; int ret = 0;
static DEFINE_SPINLOCK(notif_lock); static DEFINE_SPINLOCK(notif_lock);
@ -582,14 +574,14 @@ static int avc_latest_notif_update(struct selinux_avc *avc,
spin_lock_irqsave(&notif_lock, flag); spin_lock_irqsave(&notif_lock, flag);
if (is_insert) { if (is_insert) {
if (seqno < avc->avc_cache.latest_notif) { if (seqno < selinux_avc.avc_cache.latest_notif) {
pr_warn("SELinux: avc: seqno %d < latest_notif %d\n", pr_warn("SELinux: avc: seqno %d < latest_notif %d\n",
seqno, avc->avc_cache.latest_notif); seqno, selinux_avc.avc_cache.latest_notif);
ret = -EAGAIN; ret = -EAGAIN;
} }
} else { } else {
if (seqno > avc->avc_cache.latest_notif) if (seqno > selinux_avc.avc_cache.latest_notif)
avc->avc_cache.latest_notif = seqno; selinux_avc.avc_cache.latest_notif = seqno;
} }
spin_unlock_irqrestore(&notif_lock, flag); spin_unlock_irqrestore(&notif_lock, flag);
@ -598,7 +590,6 @@ static int avc_latest_notif_update(struct selinux_avc *avc,
/** /**
* avc_insert - Insert an AVC entry. * avc_insert - Insert an AVC entry.
* @avc: the access vector cache
* @ssid: source security identifier * @ssid: source security identifier
* @tsid: target security identifier * @tsid: target security identifier
* @tclass: target security class * @tclass: target security class
@ -615,8 +606,7 @@ static int avc_latest_notif_update(struct selinux_avc *avc,
* the access vectors into a cache entry, returns * the access vectors into a cache entry, returns
* avc_node inserted. Otherwise, this function returns NULL. * avc_node inserted. Otherwise, this function returns NULL.
*/ */
static struct avc_node *avc_insert(struct selinux_avc *avc, static struct avc_node *avc_insert(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
struct av_decision *avd, struct av_decision *avd,
struct avc_xperms_node *xp_node) struct avc_xperms_node *xp_node)
{ {
@ -626,28 +616,28 @@ static struct avc_node *avc_insert(struct selinux_avc *avc,
spinlock_t *lock; spinlock_t *lock;
struct hlist_head *head; struct hlist_head *head;
if (avc_latest_notif_update(avc, avd->seqno, 1)) if (avc_latest_notif_update(avd->seqno, 1))
return NULL; return NULL;
node = avc_alloc_node(avc); node = avc_alloc_node();
if (!node) if (!node)
return NULL; return NULL;
avc_node_populate(node, ssid, tsid, tclass, avd); avc_node_populate(node, ssid, tsid, tclass, avd);
if (avc_xperms_populate(node, xp_node)) { if (avc_xperms_populate(node, xp_node)) {
avc_node_kill(avc, node); avc_node_kill(node);
return NULL; return NULL;
} }
hvalue = avc_hash(ssid, tsid, tclass); hvalue = avc_hash(ssid, tsid, tclass);
head = &avc->avc_cache.slots[hvalue]; head = &selinux_avc.avc_cache.slots[hvalue];
lock = &avc->avc_cache.slots_lock[hvalue]; lock = &selinux_avc.avc_cache.slots_lock[hvalue];
spin_lock_irqsave(lock, flag); spin_lock_irqsave(lock, flag);
hlist_for_each_entry(pos, head, list) { hlist_for_each_entry(pos, head, list) {
if (pos->ae.ssid == ssid && if (pos->ae.ssid == ssid &&
pos->ae.tsid == tsid && pos->ae.tsid == tsid &&
pos->ae.tclass == tclass) { pos->ae.tclass == tclass) {
avc_node_replace(avc, node, pos); avc_node_replace(node, pos);
goto found; goto found;
} }
} }
@ -715,14 +705,14 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
u32 tcontext_len; u32 tcontext_len;
int rc; int rc;
rc = security_sid_to_context(sad->state, sad->ssid, &scontext, rc = security_sid_to_context(sad->ssid, &scontext,
&scontext_len); &scontext_len);
if (rc) if (rc)
audit_log_format(ab, " ssid=%d", sad->ssid); audit_log_format(ab, " ssid=%d", sad->ssid);
else else
audit_log_format(ab, " scontext=%s", scontext); audit_log_format(ab, " scontext=%s", scontext);
rc = security_sid_to_context(sad->state, sad->tsid, &tcontext, rc = security_sid_to_context(sad->tsid, &tcontext,
&tcontext_len); &tcontext_len);
if (rc) if (rc)
audit_log_format(ab, " tsid=%d", sad->tsid); audit_log_format(ab, " tsid=%d", sad->tsid);
@ -740,7 +730,7 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
kfree(scontext); kfree(scontext);
/* in case of invalid context report also the actual context string */ /* in case of invalid context report also the actual context string */
rc = security_sid_to_context_inval(sad->state, sad->ssid, &scontext, rc = security_sid_to_context_inval(sad->ssid, &scontext,
&scontext_len); &scontext_len);
if (!rc && scontext) { if (!rc && scontext) {
if (scontext_len && scontext[scontext_len - 1] == '\0') if (scontext_len && scontext[scontext_len - 1] == '\0')
@ -750,7 +740,7 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
kfree(scontext); kfree(scontext);
} }
rc = security_sid_to_context_inval(sad->state, sad->tsid, &scontext, rc = security_sid_to_context_inval(sad->tsid, &scontext,
&scontext_len); &scontext_len);
if (!rc && scontext) { if (!rc && scontext) {
if (scontext_len && scontext[scontext_len - 1] == '\0') if (scontext_len && scontext[scontext_len - 1] == '\0')
@ -766,8 +756,7 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
* Note that it is non-blocking and can be called from under * Note that it is non-blocking and can be called from under
* rcu_read_lock(). * rcu_read_lock().
*/ */
noinline int slow_avc_audit(struct selinux_state *state, noinline int slow_avc_audit(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
u32 requested, u32 audited, u32 denied, int result, u32 requested, u32 audited, u32 denied, int result,
struct common_audit_data *a) struct common_audit_data *a)
{ {
@ -789,7 +778,6 @@ noinline int slow_avc_audit(struct selinux_state *state,
sad.audited = audited; sad.audited = audited;
sad.denied = denied; sad.denied = denied;
sad.result = result; sad.result = result;
sad.state = state;
a->selinux_audit_data = &sad; a->selinux_audit_data = &sad;
@ -827,7 +815,6 @@ out:
/** /**
* avc_update_node - Update an AVC entry * avc_update_node - Update an AVC entry
* @avc: the access vector cache
* @event : Updating event * @event : Updating event
* @perms : Permission mask bits * @perms : Permission mask bits
* @driver: xperm driver information * @driver: xperm driver information
@ -844,8 +831,7 @@ out:
* otherwise, this function updates the AVC entry. The original AVC-entry object * otherwise, this function updates the AVC entry. The original AVC-entry object
* will release later by RCU. * will release later by RCU.
*/ */
static int avc_update_node(struct selinux_avc *avc, static int avc_update_node(u32 event, u32 perms, u8 driver, u8 xperm, u32 ssid,
u32 event, u32 perms, u8 driver, u8 xperm, u32 ssid,
u32 tsid, u16 tclass, u32 seqno, u32 tsid, u16 tclass, u32 seqno,
struct extended_perms_decision *xpd, struct extended_perms_decision *xpd,
u32 flags) u32 flags)
@ -856,7 +842,7 @@ static int avc_update_node(struct selinux_avc *avc,
struct hlist_head *head; struct hlist_head *head;
spinlock_t *lock; spinlock_t *lock;
node = avc_alloc_node(avc); node = avc_alloc_node();
if (!node) { if (!node) {
rc = -ENOMEM; rc = -ENOMEM;
goto out; goto out;
@ -865,8 +851,8 @@ static int avc_update_node(struct selinux_avc *avc,
/* Lock the target slot */ /* Lock the target slot */
hvalue = avc_hash(ssid, tsid, tclass); hvalue = avc_hash(ssid, tsid, tclass);
head = &avc->avc_cache.slots[hvalue]; head = &selinux_avc.avc_cache.slots[hvalue];
lock = &avc->avc_cache.slots_lock[hvalue]; lock = &selinux_avc.avc_cache.slots_lock[hvalue];
spin_lock_irqsave(lock, flag); spin_lock_irqsave(lock, flag);
@ -882,7 +868,7 @@ static int avc_update_node(struct selinux_avc *avc,
if (!orig) { if (!orig) {
rc = -ENOENT; rc = -ENOENT;
avc_node_kill(avc, node); avc_node_kill(node);
goto out_unlock; goto out_unlock;
} }
@ -895,7 +881,7 @@ static int avc_update_node(struct selinux_avc *avc,
if (orig->ae.xp_node) { if (orig->ae.xp_node) {
rc = avc_xperms_populate(node, orig->ae.xp_node); rc = avc_xperms_populate(node, orig->ae.xp_node);
if (rc) { if (rc) {
avc_node_kill(avc, node); avc_node_kill(node);
goto out_unlock; goto out_unlock;
} }
} }
@ -926,7 +912,7 @@ static int avc_update_node(struct selinux_avc *avc,
avc_add_xperms_decision(node, xpd); avc_add_xperms_decision(node, xpd);
break; break;
} }
avc_node_replace(avc, node, orig); avc_node_replace(node, orig);
out_unlock: out_unlock:
spin_unlock_irqrestore(lock, flag); spin_unlock_irqrestore(lock, flag);
out: out:
@ -935,9 +921,8 @@ out:
/** /**
* avc_flush - Flush the cache * avc_flush - Flush the cache
* @avc: the access vector cache
*/ */
static void avc_flush(struct selinux_avc *avc) static void avc_flush(void)
{ {
struct hlist_head *head; struct hlist_head *head;
struct avc_node *node; struct avc_node *node;
@ -946,8 +931,8 @@ static void avc_flush(struct selinux_avc *avc)
int i; int i;
for (i = 0; i < AVC_CACHE_SLOTS; i++) { for (i = 0; i < AVC_CACHE_SLOTS; i++) {
head = &avc->avc_cache.slots[i]; head = &selinux_avc.avc_cache.slots[i];
lock = &avc->avc_cache.slots_lock[i]; lock = &selinux_avc.avc_cache.slots_lock[i];
spin_lock_irqsave(lock, flag); spin_lock_irqsave(lock, flag);
/* /*
@ -956,7 +941,7 @@ static void avc_flush(struct selinux_avc *avc)
*/ */
rcu_read_lock(); rcu_read_lock();
hlist_for_each_entry(node, head, list) hlist_for_each_entry(node, head, list)
avc_node_delete(avc, node); avc_node_delete(node);
rcu_read_unlock(); rcu_read_unlock();
spin_unlock_irqrestore(lock, flag); spin_unlock_irqrestore(lock, flag);
} }
@ -964,15 +949,14 @@ static void avc_flush(struct selinux_avc *avc)
/** /**
* avc_ss_reset - Flush the cache and revalidate migrated permissions. * avc_ss_reset - Flush the cache and revalidate migrated permissions.
* @avc: the access vector cache
* @seqno: policy sequence number * @seqno: policy sequence number
*/ */
int avc_ss_reset(struct selinux_avc *avc, u32 seqno) int avc_ss_reset(u32 seqno)
{ {
struct avc_callback_node *c; struct avc_callback_node *c;
int rc = 0, tmprc; int rc = 0, tmprc;
avc_flush(avc); avc_flush();
for (c = avc_callbacks; c; c = c->next) { for (c = avc_callbacks; c; c = c->next) {
if (c->events & AVC_CALLBACK_RESET) { if (c->events & AVC_CALLBACK_RESET) {
@ -984,13 +968,12 @@ int avc_ss_reset(struct selinux_avc *avc, u32 seqno)
} }
} }
avc_latest_notif_update(avc, seqno, 0); avc_latest_notif_update(seqno, 0);
return rc; return rc;
} }
/** /**
* avc_compute_av - Add an entry to the AVC based on the security policy * avc_compute_av - Add an entry to the AVC based on the security policy
* @state: SELinux state pointer
* @ssid: subject * @ssid: subject
* @tsid: object/target * @tsid: object/target
* @tclass: object class * @tclass: object class
@ -1001,18 +984,16 @@ int avc_ss_reset(struct selinux_avc *avc, u32 seqno)
* fails. Don't inline this, since it's the slow-path and just results in a * fails. Don't inline this, since it's the slow-path and just results in a
* bigger stack frame. * bigger stack frame.
*/ */
static noinline struct avc_node *avc_compute_av(struct selinux_state *state, static noinline struct avc_node *avc_compute_av(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
struct av_decision *avd, struct av_decision *avd,
struct avc_xperms_node *xp_node) struct avc_xperms_node *xp_node)
{ {
INIT_LIST_HEAD(&xp_node->xpd_head); INIT_LIST_HEAD(&xp_node->xpd_head);
security_compute_av(state, ssid, tsid, tclass, avd, &xp_node->xp); security_compute_av(ssid, tsid, tclass, avd, &xp_node->xp);
return avc_insert(state->avc, ssid, tsid, tclass, avd, xp_node); return avc_insert(ssid, tsid, tclass, avd, xp_node);
} }
static noinline int avc_denied(struct selinux_state *state, static noinline int avc_denied(u32 ssid, u32 tsid,
u32 ssid, u32 tsid,
u16 tclass, u32 requested, u16 tclass, u32 requested,
u8 driver, u8 xperm, unsigned int flags, u8 driver, u8 xperm, unsigned int flags,
struct av_decision *avd) struct av_decision *avd)
@ -1020,11 +1001,11 @@ static noinline int avc_denied(struct selinux_state *state,
if (flags & AVC_STRICT) if (flags & AVC_STRICT)
return -EACCES; return -EACCES;
if (enforcing_enabled(state) && if (enforcing_enabled() &&
!(avd->flags & AVD_FLAGS_PERMISSIVE)) !(avd->flags & AVD_FLAGS_PERMISSIVE))
return -EACCES; return -EACCES;
avc_update_node(state->avc, AVC_CALLBACK_GRANT, requested, driver, avc_update_node(AVC_CALLBACK_GRANT, requested, driver,
xperm, ssid, tsid, tclass, avd->seqno, NULL, flags); xperm, ssid, tsid, tclass, avd->seqno, NULL, flags);
return 0; return 0;
} }
@ -1036,8 +1017,7 @@ static noinline int avc_denied(struct selinux_state *state,
* as-is the case with ioctls, then multiple may be chained together and the * as-is the case with ioctls, then multiple may be chained together and the
* driver field is used to specify which set contains the permission. * driver field is used to specify which set contains the permission.
*/ */
int avc_has_extended_perms(struct selinux_state *state, int avc_has_extended_perms(u32 ssid, u32 tsid, u16 tclass, u32 requested,
u32 ssid, u32 tsid, u16 tclass, u32 requested,
u8 driver, u8 xperm, struct common_audit_data *ad) u8 driver, u8 xperm, struct common_audit_data *ad)
{ {
struct avc_node *node; struct avc_node *node;
@ -1058,9 +1038,9 @@ int avc_has_extended_perms(struct selinux_state *state,
rcu_read_lock(); rcu_read_lock();
node = avc_lookup(state->avc, ssid, tsid, tclass); node = avc_lookup(ssid, tsid, tclass);
if (unlikely(!node)) { if (unlikely(!node)) {
avc_compute_av(state, ssid, tsid, tclass, &avd, xp_node); avc_compute_av(ssid, tsid, tclass, &avd, xp_node);
} else { } else {
memcpy(&avd, &node->ae.avd, sizeof(avd)); memcpy(&avd, &node->ae.avd, sizeof(avd));
xp_node = node->ae.xp_node; xp_node = node->ae.xp_node;
@ -1084,10 +1064,10 @@ int avc_has_extended_perms(struct selinux_state *state,
goto decision; goto decision;
} }
rcu_read_unlock(); rcu_read_unlock();
security_compute_xperms_decision(state, ssid, tsid, tclass, security_compute_xperms_decision(ssid, tsid, tclass,
driver, &local_xpd); driver, &local_xpd);
rcu_read_lock(); rcu_read_lock();
avc_update_node(state->avc, AVC_CALLBACK_ADD_XPERMS, requested, avc_update_node(AVC_CALLBACK_ADD_XPERMS, requested,
driver, xperm, ssid, tsid, tclass, avd.seqno, driver, xperm, ssid, tsid, tclass, avd.seqno,
&local_xpd, 0); &local_xpd, 0);
} else { } else {
@ -1101,12 +1081,12 @@ int avc_has_extended_perms(struct selinux_state *state,
decision: decision:
denied = requested & ~(avd.allowed); denied = requested & ~(avd.allowed);
if (unlikely(denied)) if (unlikely(denied))
rc = avc_denied(state, ssid, tsid, tclass, requested, rc = avc_denied(ssid, tsid, tclass, requested,
driver, xperm, AVC_EXTENDED_PERMS, &avd); driver, xperm, AVC_EXTENDED_PERMS, &avd);
rcu_read_unlock(); rcu_read_unlock();
rc2 = avc_xperms_audit(state, ssid, tsid, tclass, requested, rc2 = avc_xperms_audit(ssid, tsid, tclass, requested,
&avd, xpd, xperm, rc, ad); &avd, xpd, xperm, rc, ad);
if (rc2) if (rc2)
return rc2; return rc2;
@ -1115,7 +1095,6 @@ decision:
/** /**
* avc_perm_nonode - Add an entry to the AVC * avc_perm_nonode - Add an entry to the AVC
* @state: SELinux state pointer
* @ssid: subject * @ssid: subject
* @tsid: object/target * @tsid: object/target
* @tclass: object class * @tclass: object class
@ -1127,25 +1106,23 @@ decision:
* unlikely and needs extra stack space for the new node that we generate, so * unlikely and needs extra stack space for the new node that we generate, so
* don't inline it. * don't inline it.
*/ */
static noinline int avc_perm_nonode(struct selinux_state *state, static noinline int avc_perm_nonode(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
u32 requested, unsigned int flags, u32 requested, unsigned int flags,
struct av_decision *avd) struct av_decision *avd)
{ {
u32 denied; u32 denied;
struct avc_xperms_node xp_node; struct avc_xperms_node xp_node;
avc_compute_av(state, ssid, tsid, tclass, avd, &xp_node); avc_compute_av(ssid, tsid, tclass, avd, &xp_node);
denied = requested & ~(avd->allowed); denied = requested & ~(avd->allowed);
if (unlikely(denied)) if (unlikely(denied))
return avc_denied(state, ssid, tsid, tclass, requested, 0, 0, return avc_denied(ssid, tsid, tclass, requested, 0, 0,
flags, avd); flags, avd);
return 0; return 0;
} }
/** /**
* avc_has_perm_noaudit - Check permissions but perform no auditing. * avc_has_perm_noaudit - Check permissions but perform no auditing.
* @state: SELinux state
* @ssid: source security identifier * @ssid: source security identifier
* @tsid: target security identifier * @tsid: target security identifier
* @tclass: target security class * @tclass: target security class
@ -1164,8 +1141,7 @@ static noinline int avc_perm_nonode(struct selinux_state *state,
* auditing, e.g. in cases where a lock must be held for the check but * auditing, e.g. in cases where a lock must be held for the check but
* should be released for the auditing. * should be released for the auditing.
*/ */
inline int avc_has_perm_noaudit(struct selinux_state *state, inline int avc_has_perm_noaudit(u32 ssid, u32 tsid,
u32 ssid, u32 tsid,
u16 tclass, u32 requested, u16 tclass, u32 requested,
unsigned int flags, unsigned int flags,
struct av_decision *avd) struct av_decision *avd)
@ -1177,10 +1153,10 @@ inline int avc_has_perm_noaudit(struct selinux_state *state,
return -EACCES; return -EACCES;
rcu_read_lock(); rcu_read_lock();
node = avc_lookup(state->avc, ssid, tsid, tclass); node = avc_lookup(ssid, tsid, tclass);
if (unlikely(!node)) { if (unlikely(!node)) {
rcu_read_unlock(); rcu_read_unlock();
return avc_perm_nonode(state, ssid, tsid, tclass, requested, return avc_perm_nonode(ssid, tsid, tclass, requested,
flags, avd); flags, avd);
} }
denied = requested & ~node->ae.avd.allowed; denied = requested & ~node->ae.avd.allowed;
@ -1188,14 +1164,13 @@ inline int avc_has_perm_noaudit(struct selinux_state *state,
rcu_read_unlock(); rcu_read_unlock();
if (unlikely(denied)) if (unlikely(denied))
return avc_denied(state, ssid, tsid, tclass, requested, 0, 0, return avc_denied(ssid, tsid, tclass, requested, 0, 0,
flags, avd); flags, avd);
return 0; return 0;
} }
/** /**
* avc_has_perm - Check permissions and perform any appropriate auditing. * avc_has_perm - Check permissions and perform any appropriate auditing.
* @state: SELinux state
* @ssid: source security identifier * @ssid: source security identifier
* @tsid: target security identifier * @tsid: target security identifier
* @tclass: target security class * @tclass: target security class
@ -1210,25 +1185,25 @@ inline int avc_has_perm_noaudit(struct selinux_state *state,
* permissions are granted, -%EACCES if any permissions are denied, or * permissions are granted, -%EACCES if any permissions are denied, or
* another -errno upon other errors. * another -errno upon other errors.
*/ */
int avc_has_perm(struct selinux_state *state, u32 ssid, u32 tsid, u16 tclass, int avc_has_perm(u32 ssid, u32 tsid, u16 tclass,
u32 requested, struct common_audit_data *auditdata) u32 requested, struct common_audit_data *auditdata)
{ {
struct av_decision avd; struct av_decision avd;
int rc, rc2; int rc, rc2;
rc = avc_has_perm_noaudit(state, ssid, tsid, tclass, requested, 0, rc = avc_has_perm_noaudit(ssid, tsid, tclass, requested, 0,
&avd); &avd);
rc2 = avc_audit(state, ssid, tsid, tclass, requested, &avd, rc, rc2 = avc_audit(ssid, tsid, tclass, requested, &avd, rc,
auditdata); auditdata);
if (rc2) if (rc2)
return rc2; return rc2;
return rc; return rc;
} }
u32 avc_policy_seqno(struct selinux_state *state) u32 avc_policy_seqno(void)
{ {
return state->avc->avc_cache.latest_notif; return selinux_avc.avc_cache.latest_notif;
} }
void avc_disable(void) void avc_disable(void)
@ -1245,7 +1220,7 @@ void avc_disable(void)
* the cache and get that memory back. * the cache and get that memory back.
*/ */
if (avc_node_cachep) { if (avc_node_cachep) {
avc_flush(selinux_state.avc); avc_flush();
/* kmem_cache_destroy(avc_node_cachep); */ /* kmem_cache_destroy(avc_node_cachep); */
} }
} }

547
security/selinux/hooks.c
View File

File diff suppressed because it is too large Load Diff

2
security/selinux/ibpkey.c
View File

@ -141,7 +141,7 @@ static int sel_ib_pkey_sid_slow(u64 subnet_prefix, u16 pkey_num, u32 *sid)
return 0; return 0;
} }
ret = security_ib_pkey_sid(&selinux_state, subnet_prefix, pkey_num, ret = security_ib_pkey_sid(subnet_prefix, pkey_num,
sid); sid);
if (ret) if (ret)
goto out; goto out;

37
security/selinux/ima.c
View File

@ -15,12 +15,10 @@
/* /*
* selinux_ima_collect_state - Read selinux configuration settings * selinux_ima_collect_state - Read selinux configuration settings
* *
* @state: selinux_state
*
* On success returns the configuration settings string. * On success returns the configuration settings string.
* On error, returns NULL. * On error, returns NULL.
*/ */
static char *selinux_ima_collect_state(struct selinux_state *state) static char *selinux_ima_collect_state(void)
{ {
const char *on = "=1;", *off = "=0;"; const char *on = "=1;", *off = "=0;";
char *buf; char *buf;
@ -39,26 +37,27 @@ static char *selinux_ima_collect_state(struct selinux_state *state)
rc = strscpy(buf, "initialized", buf_len); rc = strscpy(buf, "initialized", buf_len);
WARN_ON(rc < 0); WARN_ON(rc < 0);
rc = strlcat(buf, selinux_initialized(state) ? on : off, buf_len); rc = strlcat(buf, selinux_initialized() ? on : off, buf_len);
WARN_ON(rc >= buf_len); WARN_ON(rc >= buf_len);
rc = strlcat(buf, "enforcing", buf_len); rc = strlcat(buf, "enforcing", buf_len);
WARN_ON(rc >= buf_len); WARN_ON(rc >= buf_len);
rc = strlcat(buf, enforcing_enabled(state) ? on : off, buf_len); rc = strlcat(buf, enforcing_enabled() ? on : off, buf_len);
WARN_ON(rc >= buf_len); WARN_ON(rc >= buf_len);
rc = strlcat(buf, "checkreqprot", buf_len); rc = strlcat(buf, "checkreqprot", buf_len);
WARN_ON(rc >= buf_len); WARN_ON(rc >= buf_len);
rc = strlcat(buf, checkreqprot_get(state) ? on : off, buf_len); rc = strlcat(buf, checkreqprot_get() ? on : off, buf_len);
WARN_ON(rc >= buf_len); WARN_ON(rc >= buf_len);
for (i = 0; i < __POLICYDB_CAP_MAX; i++) { for (i = 0; i < __POLICYDB_CAP_MAX; i++) {
rc = strlcat(buf, selinux_policycap_names[i], buf_len); rc = strlcat(buf, selinux_policycap_names[i], buf_len);
WARN_ON(rc >= buf_len); WARN_ON(rc >= buf_len);
rc = strlcat(buf, state->policycap[i] ? on : off, buf_len); rc = strlcat(buf, selinux_state.policycap[i] ? on : off,
buf_len);
WARN_ON(rc >= buf_len); WARN_ON(rc >= buf_len);
} }
@ -67,19 +66,17 @@ static char *selinux_ima_collect_state(struct selinux_state *state)
/* /*
* selinux_ima_measure_state_locked - Measure SELinux state and hash of policy * selinux_ima_measure_state_locked - Measure SELinux state and hash of policy
*
* @state: selinux state struct
*/ */
void selinux_ima_measure_state_locked(struct selinux_state *state) void selinux_ima_measure_state_locked(void)
{ {
char *state_str = NULL; char *state_str = NULL;
void *policy = NULL; void *policy = NULL;
size_t policy_len; size_t policy_len;
int rc = 0; int rc = 0;
lockdep_assert_held(&state->policy_mutex); lockdep_assert_held(&selinux_state.policy_mutex);
state_str = selinux_ima_collect_state(state); state_str = selinux_ima_collect_state();
if (!state_str) { if (!state_str) {
pr_err("SELinux: %s: failed to read state.\n", __func__); pr_err("SELinux: %s: failed to read state.\n", __func__);
return; return;
@ -94,10 +91,10 @@ void selinux_ima_measure_state_locked(struct selinux_state *state)
/* /*
* Measure SELinux policy only after initialization is completed. * Measure SELinux policy only after initialization is completed.
*/ */
if (!selinux_initialized(state)) if (!selinux_initialized())
return; return;
rc = security_read_state_kernel(state, &policy, &policy_len); rc = security_read_state_kernel(&policy, &policy_len);
if (rc) { if (rc) {
pr_err("SELinux: %s: failed to read policy %d.\n", __func__, rc); pr_err("SELinux: %s: failed to read policy %d.\n", __func__, rc);
return; return;
@ -112,14 +109,12 @@ void selinux_ima_measure_state_locked(struct selinux_state *state)
/* /*
* selinux_ima_measure_state - Measure SELinux state and hash of policy * selinux_ima_measure_state - Measure SELinux state and hash of policy
*
* @state: selinux state struct
*/ */
void selinux_ima_measure_state(struct selinux_state *state) void selinux_ima_measure_state(void)
{ {
lockdep_assert_not_held(&state->policy_mutex); lockdep_assert_not_held(&selinux_state.policy_mutex);
mutex_lock(&state->policy_mutex); mutex_lock(&selinux_state.policy_mutex);
selinux_ima_measure_state_locked(state); selinux_ima_measure_state_locked();
mutex_unlock(&state->policy_mutex); mutex_unlock(&selinux_state.policy_mutex);
} }

29
security/selinux/include/avc.h
View File

@ -52,7 +52,6 @@ struct selinux_audit_data {
u32 audited; u32 audited;
u32 denied; u32 denied;
int result; int result;
struct selinux_state *state;
} __randomize_layout; } __randomize_layout;
/* /*
@ -97,14 +96,12 @@ static inline u32 avc_audit_required(u32 requested,
return audited; return audited;
} }
int slow_avc_audit(struct selinux_state *state, int slow_avc_audit(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
u32 requested, u32 audited, u32 denied, int result, u32 requested, u32 audited, u32 denied, int result,
struct common_audit_data *a); struct common_audit_data *a);
/** /**
* avc_audit - Audit the granting or denial of permissions. * avc_audit - Audit the granting or denial of permissions.
* @state: SELinux state
* @ssid: source security identifier * @ssid: source security identifier
* @tsid: target security identifier * @tsid: target security identifier
* @tclass: target security class * @tclass: target security class
@ -122,8 +119,7 @@ int slow_avc_audit(struct selinux_state *state,
* be performed under a lock, to allow the lock to be released * be performed under a lock, to allow the lock to be released
* before calling the auditing code. * before calling the auditing code.
*/ */
static inline int avc_audit(struct selinux_state *state, static inline int avc_audit(u32 ssid, u32 tsid,
u32 ssid, u32 tsid,
u16 tclass, u32 requested, u16 tclass, u32 requested,
struct av_decision *avd, struct av_decision *avd,
int result, int result,
@ -133,30 +129,27 @@ static inline int avc_audit(struct selinux_state *state,
audited = avc_audit_required(requested, avd, result, 0, &denied); audited = avc_audit_required(requested, avd, result, 0, &denied);
if (likely(!audited)) if (likely(!audited))
return 0; return 0;
return slow_avc_audit(state, ssid, tsid, tclass, return slow_avc_audit(ssid, tsid, tclass,
requested, audited, denied, result, requested, audited, denied, result,
a); a);
} }
#define AVC_STRICT 1 /* Ignore permissive mode. */ #define AVC_STRICT 1 /* Ignore permissive mode. */
#define AVC_EXTENDED_PERMS 2 /* update extended permissions */ #define AVC_EXTENDED_PERMS 2 /* update extended permissions */
int avc_has_perm_noaudit(struct selinux_state *state, int avc_has_perm_noaudit(u32 ssid, u32 tsid,
u32 ssid, u32 tsid,
u16 tclass, u32 requested, u16 tclass, u32 requested,
unsigned flags, unsigned flags,
struct av_decision *avd); struct av_decision *avd);
int avc_has_perm(struct selinux_state *state, int avc_has_perm(u32 ssid, u32 tsid,
u32 ssid, u32 tsid,
u16 tclass, u32 requested, u16 tclass, u32 requested,
struct common_audit_data *auditdata); struct common_audit_data *auditdata);
int avc_has_extended_perms(struct selinux_state *state, int avc_has_extended_perms(u32 ssid, u32 tsid, u16 tclass, u32 requested,
u32 ssid, u32 tsid, u16 tclass, u32 requested,
u8 driver, u8 perm, struct common_audit_data *ad); u8 driver, u8 perm, struct common_audit_data *ad);
u32 avc_policy_seqno(struct selinux_state *state); u32 avc_policy_seqno(void);
#define AVC_CALLBACK_GRANT 1 #define AVC_CALLBACK_GRANT 1
#define AVC_CALLBACK_TRY_REVOKE 2 #define AVC_CALLBACK_TRY_REVOKE 2
@ -171,11 +164,9 @@ u32 avc_policy_seqno(struct selinux_state *state);
int avc_add_callback(int (*callback)(u32 event), u32 events); int avc_add_callback(int (*callback)(u32 event), u32 events);
/* Exported to selinuxfs */ /* Exported to selinuxfs */
struct selinux_avc; int avc_get_hash_stats(char *page);
int avc_get_hash_stats(struct selinux_avc *avc, char *page); unsigned int avc_get_cache_threshold(void);
unsigned int avc_get_cache_threshold(struct selinux_avc *avc); void avc_set_cache_threshold(unsigned int cache_threshold);
void avc_set_cache_threshold(struct selinux_avc *avc,
unsigned int cache_threshold);
/* Attempt to free avc node cache */ /* Attempt to free avc node cache */
void avc_disable(void); void avc_disable(void);

3
security/selinux/include/avc_ss.h
View File

@ -9,8 +9,7 @@
#include <linux/types.h> #include <linux/types.h>
struct selinux_avc; int avc_ss_reset(u32 seqno);
int avc_ss_reset(struct selinux_avc *avc, u32 seqno);
/* Class/perm mapping support */ /* Class/perm mapping support */
struct security_class_mapping { struct security_class_mapping {

4
security/selinux/include/conditional.h
View File

@ -16,8 +16,8 @@
int security_get_bools(struct selinux_policy *policy, int security_get_bools(struct selinux_policy *policy,
u32 *len, char ***names, int **values); u32 *len, char ***names, int **values);
int security_set_bools(struct selinux_state *state, u32 len, int *values); int security_set_bools(u32 len, int *values);
int security_get_bool_value(struct selinux_state *state, u32 index); int security_get_bool_value(u32 index);
#endif #endif

10
security/selinux/include/ima.h
View File

@ -14,15 +14,13 @@
#include "security.h" #include "security.h"
#ifdef CONFIG_IMA #ifdef CONFIG_IMA
extern void selinux_ima_measure_state(struct selinux_state *selinux_state); extern void selinux_ima_measure_state(void);
extern void selinux_ima_measure_state_locked( extern void selinux_ima_measure_state_locked(void);
struct selinux_state *selinux_state);
#else #else
static inline void selinux_ima_measure_state(struct selinux_state *selinux_state) static inline void selinux_ima_measure_state(void)
{ {
} }
static inline void selinux_ima_measure_state_locked( static inline void selinux_ima_measure_state_locked(void)
struct selinux_state *selinux_state)
{ {
} }
#endif #endif

171
security/selinux/include/security.h
View File

@ -86,7 +86,6 @@ extern int selinux_enabled_boot;
/* limitation of boundary depth */ /* limitation of boundary depth */
#define POLICYDB_BOUNDS_MAXDEPTH 4 #define POLICYDB_BOUNDS_MAXDEPTH 4
struct selinux_avc;
struct selinux_policy; struct selinux_policy;
struct selinux_state { struct selinux_state {
@ -103,72 +102,71 @@ struct selinux_state {
struct page *status_page; struct page *status_page;
struct mutex status_lock; struct mutex status_lock;
struct selinux_avc *avc;
struct selinux_policy __rcu *policy; struct selinux_policy __rcu *policy;
struct mutex policy_mutex; struct mutex policy_mutex;
} __randomize_layout; } __randomize_layout;
void selinux_avc_init(struct selinux_avc **avc); void selinux_avc_init(void);
extern struct selinux_state selinux_state; extern struct selinux_state selinux_state;
static inline bool selinux_initialized(const struct selinux_state *state) static inline bool selinux_initialized(void)
{ {
/* do a synchronized load to avoid race conditions */ /* do a synchronized load to avoid race conditions */
return smp_load_acquire(&state->initialized); return smp_load_acquire(&selinux_state.initialized);
} }
static inline void selinux_mark_initialized(struct selinux_state *state) static inline void selinux_mark_initialized(void)
{ {
/* do a synchronized write to avoid race conditions */ /* do a synchronized write to avoid race conditions */
smp_store_release(&state->initialized, true); smp_store_release(&selinux_state.initialized, true);
} }
#ifdef CONFIG_SECURITY_SELINUX_DEVELOP #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
static inline bool enforcing_enabled(struct selinux_state *state) static inline bool enforcing_enabled(void)
{ {
return READ_ONCE(state->enforcing); return READ_ONCE(selinux_state.enforcing);
} }
static inline void enforcing_set(struct selinux_state *state, bool value) static inline void enforcing_set(bool value)
{ {
WRITE_ONCE(state->enforcing, value); WRITE_ONCE(selinux_state.enforcing, value);
} }
#else #else
static inline bool enforcing_enabled(struct selinux_state *state) static inline bool enforcing_enabled(void)
{ {
return true; return true;
} }
static inline void enforcing_set(struct selinux_state *state, bool value) static inline void enforcing_set(bool value)
{ {
} }
#endif #endif
static inline bool checkreqprot_get(const struct selinux_state *state) static inline bool checkreqprot_get(void)
{ {
return READ_ONCE(state->checkreqprot); return READ_ONCE(selinux_state.checkreqprot);
} }
static inline void checkreqprot_set(struct selinux_state *state, bool value) static inline void checkreqprot_set(bool value)
{ {
if (value) if (value)
pr_err("SELinux: https://github.com/SELinuxProject/selinux-kernel/wiki/DEPRECATE-checkreqprot\n"); pr_err("SELinux: https://github.com/SELinuxProject/selinux-kernel/wiki/DEPRECATE-checkreqprot\n");
WRITE_ONCE(state->checkreqprot, value); WRITE_ONCE(selinux_state.checkreqprot, value);
} }
#ifdef CONFIG_SECURITY_SELINUX_DISABLE #ifdef CONFIG_SECURITY_SELINUX_DISABLE
static inline bool selinux_disabled(struct selinux_state *state) static inline bool selinux_disabled(void)
{ {
return READ_ONCE(state->disabled); return READ_ONCE(selinux_state.disabled);
} }
static inline void selinux_mark_disabled(struct selinux_state *state) static inline void selinux_mark_disabled(void)
{ {
WRITE_ONCE(state->disabled, true); WRITE_ONCE(selinux_state.disabled, true);
} }
#else #else
static inline bool selinux_disabled(struct selinux_state *state) static inline bool selinux_disabled(void)
{ {
return false; return false;
} }
@ -237,20 +235,14 @@ struct selinux_load_state {
struct selinux_policy_convert_data *convert_data; struct selinux_policy_convert_data *convert_data;
}; };
int security_mls_enabled(struct selinux_state *state); int security_mls_enabled(void);
int security_load_policy(struct selinux_state *state, int security_load_policy(void *data, size_t len,
void *data, size_t len,
struct selinux_load_state *load_state); struct selinux_load_state *load_state);
void selinux_policy_commit(struct selinux_state *state, void selinux_policy_commit(struct selinux_load_state *load_state);
struct selinux_load_state *load_state); void selinux_policy_cancel(struct selinux_load_state *load_state);
void selinux_policy_cancel(struct selinux_state *state, int security_read_policy(void **data, size_t *len);
struct selinux_load_state *load_state); int security_read_state_kernel(void **data, size_t *len);
int security_read_policy(struct selinux_state *state, int security_policycap_supported(unsigned int req_cap);
void **data, size_t *len);
int security_read_state_kernel(struct selinux_state *state,
void **data, size_t *len);
int security_policycap_supported(struct selinux_state *state,
unsigned int req_cap);
#define SEL_VEC_MAX 32 #define SEL_VEC_MAX 32
struct av_decision { struct av_decision {
@ -287,94 +279,68 @@ struct extended_perms {
/* definitions of av_decision.flags */ /* definitions of av_decision.flags */
#define AVD_FLAGS_PERMISSIVE 0x0001 #define AVD_FLAGS_PERMISSIVE 0x0001
void security_compute_av(struct selinux_state *state, void security_compute_av(u32 ssid, u32 tsid,
u32 ssid, u32 tsid,
u16 tclass, struct av_decision *avd, u16 tclass, struct av_decision *avd,
struct extended_perms *xperms); struct extended_perms *xperms);
void security_compute_xperms_decision(struct selinux_state *state, void security_compute_xperms_decision(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
u8 driver, u8 driver,
struct extended_perms_decision *xpermd); struct extended_perms_decision *xpermd);
void security_compute_av_user(struct selinux_state *state, void security_compute_av_user(u32 ssid, u32 tsid,
u32 ssid, u32 tsid,
u16 tclass, struct av_decision *avd); u16 tclass, struct av_decision *avd);
int security_transition_sid(struct selinux_state *state, int security_transition_sid(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
const struct qstr *qstr, u32 *out_sid); const struct qstr *qstr, u32 *out_sid);
int security_transition_sid_user(struct selinux_state *state, int security_transition_sid_user(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
const char *objname, u32 *out_sid); const char *objname, u32 *out_sid);
int security_member_sid(struct selinux_state *state, u32 ssid, u32 tsid, int security_member_sid(u32 ssid, u32 tsid, u16 tclass, u32 *out_sid);
u16 tclass, u32 *out_sid);
int security_change_sid(struct selinux_state *state, u32 ssid, u32 tsid, int security_change_sid(u32 ssid, u32 tsid, u16 tclass, u32 *out_sid);
u16 tclass, u32 *out_sid);
int security_sid_to_context(struct selinux_state *state, u32 sid, int security_sid_to_context(u32 sid, char **scontext, u32 *scontext_len);
char **scontext, u32 *scontext_len);
int security_sid_to_context_force(struct selinux_state *state, int security_sid_to_context_force(u32 sid, char **scontext, u32 *scontext_len);
u32 sid, char **scontext, u32 *scontext_len);
int security_sid_to_context_inval(struct selinux_state *state, int security_sid_to_context_inval(u32 sid, char **scontext, u32 *scontext_len);
u32 sid, char **scontext, u32 *scontext_len);
int security_context_to_sid(struct selinux_state *state, int security_context_to_sid(const char *scontext, u32 scontext_len,
const char *scontext, u32 scontext_len,
u32 *out_sid, gfp_t gfp); u32 *out_sid, gfp_t gfp);
int security_context_str_to_sid(struct selinux_state *state, int security_context_str_to_sid(const char *scontext, u32 *out_sid, gfp_t gfp);
const char *scontext, u32 *out_sid, gfp_t gfp);
int security_context_to_sid_default(struct selinux_state *state, int security_context_to_sid_default(const char *scontext, u32 scontext_len,
const char *scontext, u32 scontext_len,
u32 *out_sid, u32 def_sid, gfp_t gfp_flags); u32 *out_sid, u32 def_sid, gfp_t gfp_flags);
int security_context_to_sid_force(struct selinux_state *state, int security_context_to_sid_force(const char *scontext, u32 scontext_len,
const char *scontext, u32 scontext_len,
u32 *sid); u32 *sid);
int security_get_user_sids(struct selinux_state *state, int security_get_user_sids(u32 callsid, char *username, u32 **sids, u32 *nel);
u32 callsid, char *username,
u32 **sids, u32 *nel);
int security_port_sid(struct selinux_state *state, int security_port_sid(u8 protocol, u16 port, u32 *out_sid);
u8 protocol, u16 port, u32 *out_sid);
int security_ib_pkey_sid(struct selinux_state *state, int security_ib_pkey_sid(u64 subnet_prefix, u16 pkey_num, u32 *out_sid);
u64 subnet_prefix, u16 pkey_num, u32 *out_sid);
int security_ib_endport_sid(struct selinux_state *state, int security_ib_endport_sid(const char *dev_name, u8 port_num, u32 *out_sid);
const char *dev_name, u8 port_num, u32 *out_sid);
int security_netif_sid(struct selinux_state *state, int security_netif_sid(char *name, u32 *if_sid);
char *name, u32 *if_sid);
int security_node_sid(struct selinux_state *state, int security_node_sid(u16 domain, void *addr, u32 addrlen,
u16 domain, void *addr, u32 addrlen,
u32 *out_sid); u32 *out_sid);
int security_validate_transition(struct selinux_state *state, int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,
u32 oldsid, u32 newsid, u32 tasksid,
u16 tclass); u16 tclass);
int security_validate_transition_user(struct selinux_state *state, int security_validate_transition_user(u32 oldsid, u32 newsid, u32 tasksid,
u32 oldsid, u32 newsid, u32 tasksid,
u16 tclass); u16 tclass);
int security_bounded_transition(struct selinux_state *state, int security_bounded_transition(u32 oldsid, u32 newsid);
u32 oldsid, u32 newsid);
int security_sid_mls_copy(struct selinux_state *state, int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid);
u32 sid, u32 mls_sid, u32 *new_sid);
int security_net_peersid_resolve(struct selinux_state *state, int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type,
u32 nlbl_sid, u32 nlbl_type,
u32 xfrm_sid, u32 xfrm_sid,
u32 *peer_sid); u32 *peer_sid);
@ -382,8 +348,8 @@ int security_get_classes(struct selinux_policy *policy,
char ***classes, int *nclasses); char ***classes, int *nclasses);
int security_get_permissions(struct selinux_policy *policy, int security_get_permissions(struct selinux_policy *policy,
char *class, char ***perms, int *nperms); char *class, char ***perms, int *nperms);
int security_get_reject_unknown(struct selinux_state *state); int security_get_reject_unknown(void);
int security_get_allow_unknown(struct selinux_state *state); int security_get_allow_unknown(void);
#define SECURITY_FS_USE_XATTR 1 /* use xattr */ #define SECURITY_FS_USE_XATTR 1 /* use xattr */
#define SECURITY_FS_USE_TRANS 2 /* use transition SIDs, e.g. devpts/tmpfs */ #define SECURITY_FS_USE_TRANS 2 /* use transition SIDs, e.g. devpts/tmpfs */
@ -394,10 +360,9 @@ int security_get_allow_unknown(struct selinux_state *state);
#define SECURITY_FS_USE_NATIVE 7 /* use native label support */ #define SECURITY_FS_USE_NATIVE 7 /* use native label support */
#define SECURITY_FS_USE_MAX 7 /* Highest SECURITY_FS_USE_XXX */ #define SECURITY_FS_USE_MAX 7 /* Highest SECURITY_FS_USE_XXX */
int security_fs_use(struct selinux_state *state, struct super_block *sb); int security_fs_use(struct super_block *sb);
int security_genfs_sid(struct selinux_state *state, int security_genfs_sid(const char *fstype, const char *path, u16 sclass,
const char *fstype, const char *path, u16 sclass,
u32 *sid); u32 *sid);
int selinux_policy_genfs_sid(struct selinux_policy *policy, int selinux_policy_genfs_sid(struct selinux_policy *policy,
@ -405,23 +370,19 @@ int selinux_policy_genfs_sid(struct selinux_policy *policy,
u32 *sid); u32 *sid);
#ifdef CONFIG_NETLABEL #ifdef CONFIG_NETLABEL
int security_netlbl_secattr_to_sid(struct selinux_state *state, int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
struct netlbl_lsm_secattr *secattr,
u32 *sid); u32 *sid);
int security_netlbl_sid_to_secattr(struct selinux_state *state, int security_netlbl_sid_to_secattr(u32 sid,
u32 sid,
struct netlbl_lsm_secattr *secattr); struct netlbl_lsm_secattr *secattr);
#else #else
static inline int security_netlbl_secattr_to_sid(struct selinux_state *state, static inline int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
struct netlbl_lsm_secattr *secattr,
u32 *sid) u32 *sid)
{ {
return -EIDRM; return -EIDRM;
} }
static inline int security_netlbl_sid_to_secattr(struct selinux_state *state, static inline int security_netlbl_sid_to_secattr(u32 sid,
u32 sid,
struct netlbl_lsm_secattr *secattr) struct netlbl_lsm_secattr *secattr)
{ {
return -ENOENT; return -ENOENT;
@ -433,7 +394,7 @@ const char *security_get_initial_sid_context(u32 sid);
/* /*
* status notifier using mmap interface * status notifier using mmap interface
*/ */
extern struct page *selinux_kernel_status_page(struct selinux_state *state); extern struct page *selinux_kernel_status_page(void);
#define SELINUX_KERNEL_STATUS_VERSION 1 #define SELINUX_KERNEL_STATUS_VERSION 1
struct selinux_kernel_status { struct selinux_kernel_status {
@ -447,12 +408,10 @@ struct selinux_kernel_status {
*/ */
} __packed; } __packed;
extern void selinux_status_update_setenforce(struct selinux_state *state, extern void selinux_status_update_setenforce(int enforcing);
int enforcing); extern void selinux_status_update_policyload(int seqno);
extern void selinux_status_update_policyload(struct selinux_state *state,
int seqno);
extern void selinux_complete_init(void); extern void selinux_complete_init(void);
extern int selinux_disable(struct selinux_state *state); extern int selinux_disable(void);
extern void exit_sel_fs(void); extern void exit_sel_fs(void);
extern struct path selinux_null; extern struct path selinux_null;
extern void selnl_notify_setenforce(int val); extern void selnl_notify_setenforce(int val);
@ -462,6 +421,6 @@ extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
extern void avtab_cache_init(void); extern void avtab_cache_init(void);
extern void ebitmap_cache_init(void); extern void ebitmap_cache_init(void);
extern void hashtab_cache_init(void); extern void hashtab_cache_init(void);
extern int security_sidtab_hash_stats(struct selinux_state *state, char *page); extern int security_sidtab_hash_stats(char *page);
#endif /* _SELINUX_SECURITY_H_ */ #endif /* _SELINUX_SECURITY_H_ */

2
security/selinux/netif.c
View File

@ -153,7 +153,7 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
goto out; goto out;
} }
ret = security_netif_sid(&selinux_state, dev->name, sid); ret = security_netif_sid(dev->name, sid);
if (ret != 0) if (ret != 0)
goto out; goto out;
new = kzalloc(sizeof(*new), GFP_ATOMIC); new = kzalloc(sizeof(*new), GFP_ATOMIC);

17
security/selinux/netlabel.c
View File

@ -46,7 +46,7 @@ static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb,
{ {
int rc; int rc;
rc = security_netlbl_secattr_to_sid(&selinux_state, secattr, sid); rc = security_netlbl_secattr_to_sid(secattr, sid);
if (rc == 0 && if (rc == 0 &&
(secattr->flags & NETLBL_SECATTR_CACHEABLE) && (secattr->flags & NETLBL_SECATTR_CACHEABLE) &&
(secattr->flags & NETLBL_SECATTR_CACHE)) (secattr->flags & NETLBL_SECATTR_CACHE))
@ -77,8 +77,7 @@ static struct netlbl_lsm_secattr *selinux_netlbl_sock_genattr(struct sock *sk)
secattr = netlbl_secattr_alloc(GFP_ATOMIC); secattr = netlbl_secattr_alloc(GFP_ATOMIC);
if (secattr == NULL) if (secattr == NULL)
return NULL; return NULL;
rc = security_netlbl_sid_to_secattr(&selinux_state, sksec->sid, rc = security_netlbl_sid_to_secattr(sksec->sid, secattr);
secattr);
if (rc != 0) { if (rc != 0) {
netlbl_secattr_free(secattr); netlbl_secattr_free(secattr);
return NULL; return NULL;
@ -245,8 +244,7 @@ int selinux_netlbl_skbuff_setsid(struct sk_buff *skb,
if (secattr == NULL) { if (secattr == NULL) {
secattr = &secattr_storage; secattr = &secattr_storage;
netlbl_secattr_init(secattr); netlbl_secattr_init(secattr);
rc = security_netlbl_sid_to_secattr(&selinux_state, sid, rc = security_netlbl_sid_to_secattr(sid, secattr);
secattr);
if (rc != 0) if (rc != 0)
goto skbuff_setsid_return; goto skbuff_setsid_return;
} }
@ -283,8 +281,7 @@ int selinux_netlbl_sctp_assoc_request(struct sctp_association *asoc,
return 0; return 0;
netlbl_secattr_init(&secattr); netlbl_secattr_init(&secattr);
rc = security_netlbl_sid_to_secattr(&selinux_state, rc = security_netlbl_sid_to_secattr(asoc->secid, &secattr);
asoc->secid, &secattr);
if (rc != 0) if (rc != 0)
goto assoc_request_return; goto assoc_request_return;
@ -332,8 +329,7 @@ int selinux_netlbl_inet_conn_request(struct request_sock *req, u16 family)
return 0; return 0;
netlbl_secattr_init(&secattr); netlbl_secattr_init(&secattr);
rc = security_netlbl_sid_to_secattr(&selinux_state, req->secid, rc = security_netlbl_sid_to_secattr(req->secid, &secattr);
&secattr);
if (rc != 0) if (rc != 0)
goto inet_conn_request_return; goto inet_conn_request_return;
rc = netlbl_req_setattr(req, &secattr); rc = netlbl_req_setattr(req, &secattr);
@ -463,8 +459,7 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
perm = RAWIP_SOCKET__RECVFROM; perm = RAWIP_SOCKET__RECVFROM;
} }
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sksec->sid, nlbl_sid, sksec->sclass, perm, ad);
sksec->sid, nlbl_sid, sksec->sclass, perm, ad);
if (rc == 0) if (rc == 0)
return 0; return 0;

4
security/selinux/netnode.c
View File

@ -204,13 +204,13 @@ static int sel_netnode_sid_slow(void *addr, u16 family, u32 *sid)
new = kzalloc(sizeof(*new), GFP_ATOMIC); new = kzalloc(sizeof(*new), GFP_ATOMIC);
switch (family) { switch (family) {
case PF_INET: case PF_INET:
ret = security_node_sid(&selinux_state, PF_INET, ret = security_node_sid(PF_INET,
addr, sizeof(struct in_addr), sid); addr, sizeof(struct in_addr), sid);
if (new) if (new)
new->nsec.addr.ipv4 = *(__be32 *)addr; new->nsec.addr.ipv4 = *(__be32 *)addr;
break; break;
case PF_INET6: case PF_INET6:
ret = security_node_sid(&selinux_state, PF_INET6, ret = security_node_sid(PF_INET6,
addr, sizeof(struct in6_addr), sid); addr, sizeof(struct in6_addr), sid);
if (new) if (new)
new->nsec.addr.ipv6 = *(struct in6_addr *)addr; new->nsec.addr.ipv6 = *(struct in6_addr *)addr;

2
security/selinux/netport.c
View File

@ -148,7 +148,7 @@ static int sel_netport_sid_slow(u8 protocol, u16 pnum, u32 *sid)
return 0; return 0;
} }
ret = security_port_sid(&selinux_state, protocol, pnum, sid); ret = security_port_sid(protocol, pnum, sid);
if (ret != 0) if (ret != 0)
goto out; goto out;
new = kzalloc(sizeof(*new), GFP_ATOMIC); new = kzalloc(sizeof(*new), GFP_ATOMIC);

208
security/selinux/selinuxfs.c
View File

@ -77,7 +77,6 @@ struct selinux_fs_info {
bool policy_opened; bool policy_opened;
struct dentry *policycap_dir; struct dentry *policycap_dir;
unsigned long last_ino; unsigned long last_ino;
struct selinux_state *state;
struct super_block *sb; struct super_block *sb;
}; };
@ -90,7 +89,6 @@ static int selinux_fs_info_create(struct super_block *sb)
return -ENOMEM; return -ENOMEM;
fsi->last_ino = SEL_INO_NEXT - 1; fsi->last_ino = SEL_INO_NEXT - 1;
fsi->state = &selinux_state;
fsi->sb = sb; fsi->sb = sb;
sb->s_fs_info = fsi; sb->s_fs_info = fsi;
return 0; return 0;
@ -125,12 +123,11 @@ static void selinux_fs_info_free(struct super_block *sb)
static ssize_t sel_read_enforce(struct file *filp, char __user *buf, static ssize_t sel_read_enforce(struct file *filp, char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
char tmpbuf[TMPBUFLEN]; char tmpbuf[TMPBUFLEN];
ssize_t length; ssize_t length;
length = scnprintf(tmpbuf, TMPBUFLEN, "%d", length = scnprintf(tmpbuf, TMPBUFLEN, "%d",
enforcing_enabled(fsi->state)); enforcing_enabled());
return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
} }
@ -139,8 +136,6 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *page = NULL; char *page = NULL;
ssize_t length; ssize_t length;
int old_value, new_value; int old_value, new_value;
@ -162,10 +157,9 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
new_value = !!new_value; new_value = !!new_value;
old_value = enforcing_enabled(state); old_value = enforcing_enabled();
if (new_value != old_value) { if (new_value != old_value) {
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__SETENFORCE, SECCLASS_SECURITY, SECURITY__SETENFORCE,
NULL); NULL);
if (length) if (length)
@ -176,15 +170,15 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
new_value, old_value, new_value, old_value,
from_kuid(&init_user_ns, audit_get_loginuid(current)), from_kuid(&init_user_ns, audit_get_loginuid(current)),
audit_get_sessionid(current)); audit_get_sessionid(current));
enforcing_set(state, new_value); enforcing_set(new_value);
if (new_value) if (new_value)
avc_ss_reset(state->avc, 0); avc_ss_reset(0);
selnl_notify_setenforce(new_value); selnl_notify_setenforce(new_value);
selinux_status_update_setenforce(state, new_value); selinux_status_update_setenforce(new_value);
if (!new_value) if (!new_value)
call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL); call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
selinux_ima_measure_state(state); selinux_ima_measure_state();
} }
length = count; length = count;
out: out:
@ -204,14 +198,12 @@ static const struct file_operations sel_enforce_ops = {
static ssize_t sel_read_handle_unknown(struct file *filp, char __user *buf, static ssize_t sel_read_handle_unknown(struct file *filp, char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char tmpbuf[TMPBUFLEN]; char tmpbuf[TMPBUFLEN];
ssize_t length; ssize_t length;
ino_t ino = file_inode(filp)->i_ino; ino_t ino = file_inode(filp)->i_ino;
int handle_unknown = (ino == SEL_REJECT_UNKNOWN) ? int handle_unknown = (ino == SEL_REJECT_UNKNOWN) ?
security_get_reject_unknown(state) : security_get_reject_unknown() :
!security_get_allow_unknown(state); !security_get_allow_unknown();
length = scnprintf(tmpbuf, TMPBUFLEN, "%d", handle_unknown); length = scnprintf(tmpbuf, TMPBUFLEN, "%d", handle_unknown);
return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
@ -224,8 +216,7 @@ static const struct file_operations sel_handle_unknown_ops = {
static int sel_open_handle_status(struct inode *inode, struct file *filp) static int sel_open_handle_status(struct inode *inode, struct file *filp)
{ {
struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info; struct page *status = selinux_kernel_status_page();
struct page *status = selinux_kernel_status_page(fsi->state);
if (!status) if (!status)
return -ENOMEM; return -ENOMEM;
@ -281,7 +272,6 @@ static ssize_t sel_write_disable(struct file *file, const char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
char *page; char *page;
ssize_t length; ssize_t length;
int new_value; int new_value;
@ -312,8 +302,8 @@ static ssize_t sel_write_disable(struct file *file, const char __user *buf,
goto out; goto out;
if (new_value) { if (new_value) {
enforcing = enforcing_enabled(fsi->state); enforcing = enforcing_enabled();
length = selinux_disable(fsi->state); length = selinux_disable();
if (length) if (length)
goto out; goto out;
audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS, audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS,
@ -375,12 +365,11 @@ static void sel_remove_entries(struct dentry *de);
static ssize_t sel_read_mls(struct file *filp, char __user *buf, static ssize_t sel_read_mls(struct file *filp, char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
char tmpbuf[TMPBUFLEN]; char tmpbuf[TMPBUFLEN];
ssize_t length; ssize_t length;
length = scnprintf(tmpbuf, TMPBUFLEN, "%d", length = scnprintf(tmpbuf, TMPBUFLEN, "%d",
security_mls_enabled(fsi->state)); security_mls_enabled());
return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
} }
@ -397,16 +386,14 @@ struct policy_load_memory {
static int sel_open_policy(struct inode *inode, struct file *filp) static int sel_open_policy(struct inode *inode, struct file *filp)
{ {
struct selinux_fs_info *fsi = inode->i_sb->s_fs_info; struct selinux_fs_info *fsi = inode->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
struct policy_load_memory *plm = NULL; struct policy_load_memory *plm = NULL;
int rc; int rc;
BUG_ON(filp->private_data); BUG_ON(filp->private_data);
mutex_lock(&fsi->state->policy_mutex); mutex_lock(&selinux_state.policy_mutex);
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL); SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL);
if (rc) if (rc)
goto err; goto err;
@ -420,7 +407,7 @@ static int sel_open_policy(struct inode *inode, struct file *filp)
if (!plm) if (!plm)
goto err; goto err;
rc = security_read_policy(state, &plm->data, &plm->len); rc = security_read_policy(&plm->data, &plm->len);
if (rc) if (rc)
goto err; goto err;
@ -434,11 +421,11 @@ static int sel_open_policy(struct inode *inode, struct file *filp)
filp->private_data = plm; filp->private_data = plm;
mutex_unlock(&fsi->state->policy_mutex); mutex_unlock(&selinux_state.policy_mutex);
return 0; return 0;
err: err:
mutex_unlock(&fsi->state->policy_mutex); mutex_unlock(&selinux_state.policy_mutex);
if (plm) if (plm)
vfree(plm->data); vfree(plm->data);
@ -467,8 +454,7 @@ static ssize_t sel_read_policy(struct file *filp, char __user *buf,
struct policy_load_memory *plm = filp->private_data; struct policy_load_memory *plm = filp->private_data;
int ret; int ret;
ret = avc_has_perm(&selinux_state, ret = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL); SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL);
if (ret) if (ret)
return ret; return ret;
@ -621,10 +607,9 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
ssize_t length; ssize_t length;
void *data = NULL; void *data = NULL;
mutex_lock(&fsi->state->policy_mutex); mutex_lock(&selinux_state.policy_mutex);
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__LOAD_POLICY, NULL); SECCLASS_SECURITY, SECURITY__LOAD_POLICY, NULL);
if (length) if (length)
goto out; goto out;
@ -643,7 +628,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
if (copy_from_user(data, buf, count) != 0) if (copy_from_user(data, buf, count) != 0)
goto out; goto out;
length = security_load_policy(fsi->state, data, count, &load_state); length = security_load_policy(data, count, &load_state);
if (length) { if (length) {
pr_warn_ratelimited("SELinux: failed to load policy\n"); pr_warn_ratelimited("SELinux: failed to load policy\n");
goto out; goto out;
@ -652,11 +637,11 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
length = sel_make_policy_nodes(fsi, load_state.policy); length = sel_make_policy_nodes(fsi, load_state.policy);
if (length) { if (length) {
pr_warn_ratelimited("SELinux: failed to initialize selinuxfs\n"); pr_warn_ratelimited("SELinux: failed to initialize selinuxfs\n");
selinux_policy_cancel(fsi->state, &load_state); selinux_policy_cancel(&load_state);
goto out; goto out;
} }
selinux_policy_commit(fsi->state, &load_state); selinux_policy_commit(&load_state);
length = count; length = count;
@ -665,7 +650,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
from_kuid(&init_user_ns, audit_get_loginuid(current)), from_kuid(&init_user_ns, audit_get_loginuid(current)),
audit_get_sessionid(current)); audit_get_sessionid(current));
out: out:
mutex_unlock(&fsi->state->policy_mutex); mutex_unlock(&selinux_state.policy_mutex);
vfree(data); vfree(data);
return length; return length;
} }
@ -677,23 +662,20 @@ static const struct file_operations sel_load_ops = {
static ssize_t sel_write_context(struct file *file, char *buf, size_t size) static ssize_t sel_write_context(struct file *file, char *buf, size_t size)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *canon = NULL; char *canon = NULL;
u32 sid, len; u32 sid, len;
ssize_t length; ssize_t length;
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__CHECK_CONTEXT, NULL); SECCLASS_SECURITY, SECURITY__CHECK_CONTEXT, NULL);
if (length) if (length)
goto out; goto out;
length = security_context_to_sid(state, buf, size, &sid, GFP_KERNEL); length = security_context_to_sid(buf, size, &sid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
length = security_sid_to_context(state, sid, &canon, &len); length = security_sid_to_context(sid, &canon, &len);
if (length) if (length)
goto out; goto out;
@ -714,25 +696,22 @@ out:
static ssize_t sel_read_checkreqprot(struct file *filp, char __user *buf, static ssize_t sel_read_checkreqprot(struct file *filp, char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
char tmpbuf[TMPBUFLEN]; char tmpbuf[TMPBUFLEN];
ssize_t length; ssize_t length;
length = scnprintf(tmpbuf, TMPBUFLEN, "%u", length = scnprintf(tmpbuf, TMPBUFLEN, "%u",
checkreqprot_get(fsi->state)); checkreqprot_get());
return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
} }
static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf, static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
char *page; char *page;
ssize_t length; ssize_t length;
unsigned int new_value; unsigned int new_value;
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__SETCHECKREQPROT, SECCLASS_SECURITY, SECURITY__SETCHECKREQPROT,
NULL); NULL);
if (length) if (length)
@ -761,12 +740,12 @@ static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
comm, current->pid); comm, current->pid);
} }
checkreqprot_set(fsi->state, (new_value ? 1 : 0)); checkreqprot_set((new_value ? 1 : 0));
if (new_value) if (new_value)
ssleep(15); ssleep(15);
length = count; length = count;
selinux_ima_measure_state(fsi->state); selinux_ima_measure_state();
out: out:
kfree(page); kfree(page);
@ -782,16 +761,13 @@ static ssize_t sel_write_validatetrans(struct file *file,
const char __user *buf, const char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *oldcon = NULL, *newcon = NULL, *taskcon = NULL; char *oldcon = NULL, *newcon = NULL, *taskcon = NULL;
char *req = NULL; char *req = NULL;
u32 osid, nsid, tsid; u32 osid, nsid, tsid;
u16 tclass; u16 tclass;
int rc; int rc;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__VALIDATE_TRANS, NULL); SECCLASS_SECURITY, SECURITY__VALIDATE_TRANS, NULL);
if (rc) if (rc)
goto out; goto out;
@ -829,19 +805,19 @@ static ssize_t sel_write_validatetrans(struct file *file,
if (sscanf(req, "%s %s %hu %s", oldcon, newcon, &tclass, taskcon) != 4) if (sscanf(req, "%s %s %hu %s", oldcon, newcon, &tclass, taskcon) != 4)
goto out; goto out;
rc = security_context_str_to_sid(state, oldcon, &osid, GFP_KERNEL); rc = security_context_str_to_sid(oldcon, &osid, GFP_KERNEL);
if (rc) if (rc)
goto out; goto out;
rc = security_context_str_to_sid(state, newcon, &nsid, GFP_KERNEL); rc = security_context_str_to_sid(newcon, &nsid, GFP_KERNEL);
if (rc) if (rc)
goto out; goto out;
rc = security_context_str_to_sid(state, taskcon, &tsid, GFP_KERNEL); rc = security_context_str_to_sid(taskcon, &tsid, GFP_KERNEL);
if (rc) if (rc)
goto out; goto out;
rc = security_validate_transition_user(state, osid, nsid, tsid, tclass); rc = security_validate_transition_user(osid, nsid, tsid, tclass);
if (!rc) if (!rc)
rc = count; rc = count;
out: out:
@ -911,16 +887,13 @@ static const struct file_operations transaction_ops = {
static ssize_t sel_write_access(struct file *file, char *buf, size_t size) static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *scon = NULL, *tcon = NULL; char *scon = NULL, *tcon = NULL;
u32 ssid, tsid; u32 ssid, tsid;
u16 tclass; u16 tclass;
struct av_decision avd; struct av_decision avd;
ssize_t length; ssize_t length;
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__COMPUTE_AV, NULL); SECCLASS_SECURITY, SECURITY__COMPUTE_AV, NULL);
if (length) if (length)
goto out; goto out;
@ -939,15 +912,15 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3) if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
goto out; goto out;
length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL); length = security_context_str_to_sid(scon, &ssid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL); length = security_context_str_to_sid(tcon, &tsid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
security_compute_av_user(state, ssid, tsid, tclass, &avd); security_compute_av_user(ssid, tsid, tclass, &avd);
length = scnprintf(buf, SIMPLE_TRANSACTION_LIMIT, length = scnprintf(buf, SIMPLE_TRANSACTION_LIMIT,
"%x %x %x %x %u %x", "%x %x %x %x %u %x",
@ -962,8 +935,6 @@ out:
static ssize_t sel_write_create(struct file *file, char *buf, size_t size) static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *scon = NULL, *tcon = NULL; char *scon = NULL, *tcon = NULL;
char *namebuf = NULL, *objname = NULL; char *namebuf = NULL, *objname = NULL;
u32 ssid, tsid, newsid; u32 ssid, tsid, newsid;
@ -973,8 +944,7 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
u32 len; u32 len;
int nargs; int nargs;
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__COMPUTE_CREATE, SECCLASS_SECURITY, SECURITY__COMPUTE_CREATE,
NULL); NULL);
if (length) if (length)
@ -1030,20 +1000,20 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
objname = namebuf; objname = namebuf;
} }
length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL); length = security_context_str_to_sid(scon, &ssid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL); length = security_context_str_to_sid(tcon, &tsid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
length = security_transition_sid_user(state, ssid, tsid, tclass, length = security_transition_sid_user(ssid, tsid, tclass,
objname, &newsid); objname, &newsid);
if (length) if (length)
goto out; goto out;
length = security_sid_to_context(state, newsid, &newcon, &len); length = security_sid_to_context(newsid, &newcon, &len);
if (length) if (length)
goto out; goto out;
@ -1066,8 +1036,6 @@ out:
static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size) static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *scon = NULL, *tcon = NULL; char *scon = NULL, *tcon = NULL;
u32 ssid, tsid, newsid; u32 ssid, tsid, newsid;
u16 tclass; u16 tclass;
@ -1075,8 +1043,7 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size)
char *newcon = NULL; char *newcon = NULL;
u32 len; u32 len;
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__COMPUTE_RELABEL, SECCLASS_SECURITY, SECURITY__COMPUTE_RELABEL,
NULL); NULL);
if (length) if (length)
@ -1096,19 +1063,19 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size)
if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3) if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
goto out; goto out;
length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL); length = security_context_str_to_sid(scon, &ssid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL); length = security_context_str_to_sid(tcon, &tsid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
length = security_change_sid(state, ssid, tsid, tclass, &newsid); length = security_change_sid(ssid, tsid, tclass, &newsid);
if (length) if (length)
goto out; goto out;
length = security_sid_to_context(state, newsid, &newcon, &len); length = security_sid_to_context(newsid, &newcon, &len);
if (length) if (length)
goto out; goto out;
@ -1127,8 +1094,6 @@ out:
static ssize_t sel_write_user(struct file *file, char *buf, size_t size) static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *con = NULL, *user = NULL, *ptr; char *con = NULL, *user = NULL, *ptr;
u32 sid, *sids = NULL; u32 sid, *sids = NULL;
ssize_t length; ssize_t length;
@ -1136,8 +1101,7 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
int i, rc; int i, rc;
u32 len, nsids; u32 len, nsids;
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__COMPUTE_USER, SECCLASS_SECURITY, SECURITY__COMPUTE_USER,
NULL); NULL);
if (length) if (length)
@ -1157,18 +1121,18 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
if (sscanf(buf, "%s %s", con, user) != 2) if (sscanf(buf, "%s %s", con, user) != 2)
goto out; goto out;
length = security_context_str_to_sid(state, con, &sid, GFP_KERNEL); length = security_context_str_to_sid(con, &sid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
length = security_get_user_sids(state, sid, user, &sids, &nsids); length = security_get_user_sids(sid, user, &sids, &nsids);
if (length) if (length)
goto out; goto out;
length = sprintf(buf, "%u", nsids) + 1; length = sprintf(buf, "%u", nsids) + 1;
ptr = buf + length; ptr = buf + length;
for (i = 0; i < nsids; i++) { for (i = 0; i < nsids; i++) {
rc = security_sid_to_context(state, sids[i], &newcon, &len); rc = security_sid_to_context(sids[i], &newcon, &len);
if (rc) { if (rc) {
length = rc; length = rc;
goto out; goto out;
@ -1192,8 +1156,6 @@ out:
static ssize_t sel_write_member(struct file *file, char *buf, size_t size) static ssize_t sel_write_member(struct file *file, char *buf, size_t size)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *scon = NULL, *tcon = NULL; char *scon = NULL, *tcon = NULL;
u32 ssid, tsid, newsid; u32 ssid, tsid, newsid;
u16 tclass; u16 tclass;
@ -1201,8 +1163,7 @@ static ssize_t sel_write_member(struct file *file, char *buf, size_t size)
char *newcon = NULL; char *newcon = NULL;
u32 len; u32 len;
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__COMPUTE_MEMBER, SECCLASS_SECURITY, SECURITY__COMPUTE_MEMBER,
NULL); NULL);
if (length) if (length)
@ -1222,19 +1183,19 @@ static ssize_t sel_write_member(struct file *file, char *buf, size_t size)
if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3) if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
goto out; goto out;
length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL); length = security_context_str_to_sid(scon, &ssid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL); length = security_context_str_to_sid(tcon, &tsid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
length = security_member_sid(state, ssid, tsid, tclass, &newsid); length = security_member_sid(ssid, tsid, tclass, &newsid);
if (length) if (length)
goto out; goto out;
length = security_sid_to_context(state, newsid, &newcon, &len); length = security_sid_to_context(newsid, &newcon, &len);
if (length) if (length)
goto out; goto out;
@ -1276,7 +1237,7 @@ static ssize_t sel_read_bool(struct file *filep, char __user *buf,
unsigned index = file_inode(filep)->i_ino & SEL_INO_MASK; unsigned index = file_inode(filep)->i_ino & SEL_INO_MASK;
const char *name = filep->f_path.dentry->d_name.name; const char *name = filep->f_path.dentry->d_name.name;
mutex_lock(&fsi->state->policy_mutex); mutex_lock(&selinux_state.policy_mutex);
ret = -EINVAL; ret = -EINVAL;
if (index >= fsi->bool_num || strcmp(name, if (index >= fsi->bool_num || strcmp(name,
@ -1288,21 +1249,21 @@ static ssize_t sel_read_bool(struct file *filep, char __user *buf,
if (!page) if (!page)
goto out_unlock; goto out_unlock;
cur_enforcing = security_get_bool_value(fsi->state, index); cur_enforcing = security_get_bool_value(index);
if (cur_enforcing < 0) { if (cur_enforcing < 0) {
ret = cur_enforcing; ret = cur_enforcing;
goto out_unlock; goto out_unlock;
} }
length = scnprintf(page, PAGE_SIZE, "%d %d", cur_enforcing, length = scnprintf(page, PAGE_SIZE, "%d %d", cur_enforcing,
fsi->bool_pending_values[index]); fsi->bool_pending_values[index]);
mutex_unlock(&fsi->state->policy_mutex); mutex_unlock(&selinux_state.policy_mutex);
ret = simple_read_from_buffer(buf, count, ppos, page, length); ret = simple_read_from_buffer(buf, count, ppos, page, length);
out_free: out_free:
free_page((unsigned long)page); free_page((unsigned long)page);
return ret; return ret;
out_unlock: out_unlock:
mutex_unlock(&fsi->state->policy_mutex); mutex_unlock(&selinux_state.policy_mutex);
goto out_free; goto out_free;
} }
@ -1327,10 +1288,9 @@ static ssize_t sel_write_bool(struct file *filep, const char __user *buf,
if (IS_ERR(page)) if (IS_ERR(page))
return PTR_ERR(page); return PTR_ERR(page);
mutex_lock(&fsi->state->policy_mutex); mutex_lock(&selinux_state.policy_mutex);
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__SETBOOL, SECCLASS_SECURITY, SECURITY__SETBOOL,
NULL); NULL);
if (length) if (length)
@ -1352,7 +1312,7 @@ static ssize_t sel_write_bool(struct file *filep, const char __user *buf,
length = count; length = count;
out: out:
mutex_unlock(&fsi->state->policy_mutex); mutex_unlock(&selinux_state.policy_mutex);
kfree(page); kfree(page);
return length; return length;
} }
@ -1383,10 +1343,9 @@ static ssize_t sel_commit_bools_write(struct file *filep,
if (IS_ERR(page)) if (IS_ERR(page))
return PTR_ERR(page); return PTR_ERR(page);
mutex_lock(&fsi->state->policy_mutex); mutex_lock(&selinux_state.policy_mutex);
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__SETBOOL, SECCLASS_SECURITY, SECURITY__SETBOOL,
NULL); NULL);
if (length) if (length)
@ -1398,14 +1357,14 @@ static ssize_t sel_commit_bools_write(struct file *filep,
length = 0; length = 0;
if (new_value && fsi->bool_pending_values) if (new_value && fsi->bool_pending_values)
length = security_set_bools(fsi->state, fsi->bool_num, length = security_set_bools(fsi->bool_num,
fsi->bool_pending_values); fsi->bool_pending_values);
if (!length) if (!length)
length = count; length = count;
out: out:
mutex_unlock(&fsi->state->policy_mutex); mutex_unlock(&selinux_state.policy_mutex);
kfree(page); kfree(page);
return length; return length;
} }
@ -1503,13 +1462,11 @@ out:
static ssize_t sel_read_avc_cache_threshold(struct file *filp, char __user *buf, static ssize_t sel_read_avc_cache_threshold(struct file *filp, char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char tmpbuf[TMPBUFLEN]; char tmpbuf[TMPBUFLEN];
ssize_t length; ssize_t length;
length = scnprintf(tmpbuf, TMPBUFLEN, "%u", length = scnprintf(tmpbuf, TMPBUFLEN, "%u",
avc_get_cache_threshold(state->avc)); avc_get_cache_threshold());
return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
} }
@ -1518,14 +1475,11 @@ static ssize_t sel_write_avc_cache_threshold(struct file *file,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *page; char *page;
ssize_t ret; ssize_t ret;
unsigned int new_value; unsigned int new_value;
ret = avc_has_perm(&selinux_state, ret = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__SETSECPARAM, SECCLASS_SECURITY, SECURITY__SETSECPARAM,
NULL); NULL);
if (ret) if (ret)
@ -1546,7 +1500,7 @@ static ssize_t sel_write_avc_cache_threshold(struct file *file,
if (sscanf(page, "%u", &new_value) != 1) if (sscanf(page, "%u", &new_value) != 1)
goto out; goto out;
avc_set_cache_threshold(state->avc, new_value); avc_set_cache_threshold(new_value);
ret = count; ret = count;
out: out:
@ -1557,8 +1511,6 @@ out:
static ssize_t sel_read_avc_hash_stats(struct file *filp, char __user *buf, static ssize_t sel_read_avc_hash_stats(struct file *filp, char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *page; char *page;
ssize_t length; ssize_t length;
@ -1566,7 +1518,7 @@ static ssize_t sel_read_avc_hash_stats(struct file *filp, char __user *buf,
if (!page) if (!page)
return -ENOMEM; return -ENOMEM;
length = avc_get_hash_stats(state->avc, page); length = avc_get_hash_stats(page);
if (length >= 0) if (length >= 0)
length = simple_read_from_buffer(buf, count, ppos, page, length); length = simple_read_from_buffer(buf, count, ppos, page, length);
free_page((unsigned long)page); free_page((unsigned long)page);
@ -1577,8 +1529,6 @@ static ssize_t sel_read_avc_hash_stats(struct file *filp, char __user *buf,
static ssize_t sel_read_sidtab_hash_stats(struct file *filp, char __user *buf, static ssize_t sel_read_sidtab_hash_stats(struct file *filp, char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *page; char *page;
ssize_t length; ssize_t length;
@ -1586,7 +1536,7 @@ static ssize_t sel_read_sidtab_hash_stats(struct file *filp, char __user *buf,
if (!page) if (!page)
return -ENOMEM; return -ENOMEM;
length = security_sidtab_hash_stats(state, page); length = security_sidtab_hash_stats(page);
if (length >= 0) if (length >= 0)
length = simple_read_from_buffer(buf, count, ppos, page, length = simple_read_from_buffer(buf, count, ppos, page,
length); length);
@ -1752,13 +1702,12 @@ static int sel_make_ss_files(struct dentry *dir)
static ssize_t sel_read_initcon(struct file *file, char __user *buf, static ssize_t sel_read_initcon(struct file *file, char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
char *con; char *con;
u32 sid, len; u32 sid, len;
ssize_t ret; ssize_t ret;
sid = file_inode(file)->i_ino&SEL_INO_MASK; sid = file_inode(file)->i_ino&SEL_INO_MASK;
ret = security_sid_to_context(fsi->state, sid, &con, &len); ret = security_sid_to_context(sid, &con, &len);
if (ret) if (ret)
return ret; return ret;
@ -1852,13 +1801,12 @@ static const struct file_operations sel_perm_ops = {
static ssize_t sel_read_policycap(struct file *file, char __user *buf, static ssize_t sel_read_policycap(struct file *file, char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
int value; int value;
char tmpbuf[TMPBUFLEN]; char tmpbuf[TMPBUFLEN];
ssize_t length; ssize_t length;
unsigned long i_ino = file_inode(file)->i_ino; unsigned long i_ino = file_inode(file)->i_ino;
value = security_policycap_supported(fsi->state, i_ino & SEL_INO_MASK); value = security_policycap_supported(i_ino & SEL_INO_MASK);
length = scnprintf(tmpbuf, TMPBUFLEN, "%d", value); length = scnprintf(tmpbuf, TMPBUFLEN, "%d", value);
return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);

346
security/selinux/ss/services.c
View File

File diff suppressed because it is too large Load Diff

1
security/selinux/ss/services.h
View File

@ -30,7 +30,6 @@ struct selinux_policy {
} __randomize_layout; } __randomize_layout;
struct convert_context_args { struct convert_context_args {
struct selinux_state *state;
struct policydb *oldp; struct policydb *oldp;
struct policydb *newp; struct policydb *newp;
}; };

44
security/selinux/status.c
View File

@ -39,21 +39,21 @@
* It returns a reference to selinux_status_page. If the status page is * It returns a reference to selinux_status_page. If the status page is
* not allocated yet, it also tries to allocate it at the first time. * not allocated yet, it also tries to allocate it at the first time.
*/ */
struct page *selinux_kernel_status_page(struct selinux_state *state) struct page *selinux_kernel_status_page(void)
{ {
struct selinux_kernel_status *status; struct selinux_kernel_status *status;
struct page *result = NULL; struct page *result = NULL;
mutex_lock(&state->status_lock); mutex_lock(&selinux_state.status_lock);
if (!state->status_page) { if (!selinux_state.status_page) {
state->status_page = alloc_page(GFP_KERNEL|__GFP_ZERO); selinux_state.status_page = alloc_page(GFP_KERNEL|__GFP_ZERO);
if (state->status_page) { if (selinux_state.status_page) {
status = page_address(state->status_page); status = page_address(selinux_state.status_page);
status->version = SELINUX_KERNEL_STATUS_VERSION; status->version = SELINUX_KERNEL_STATUS_VERSION;
status->sequence = 0; status->sequence = 0;
status->enforcing = enforcing_enabled(state); status->enforcing = enforcing_enabled();
/* /*
* NOTE: the next policyload event shall set * NOTE: the next policyload event shall set
* a positive value on the status->policyload, * a positive value on the status->policyload,
@ -62,11 +62,11 @@ struct page *selinux_kernel_status_page(struct selinux_state *state)
*/ */
status->policyload = 0; status->policyload = 0;
status->deny_unknown = status->deny_unknown =
!security_get_allow_unknown(state); !security_get_allow_unknown();
} }
} }
result = state->status_page; result = selinux_state.status_page;
mutex_unlock(&state->status_lock); mutex_unlock(&selinux_state.status_lock);
return result; return result;
} }
@ -76,14 +76,13 @@ struct page *selinux_kernel_status_page(struct selinux_state *state)
* *
* It updates status of the current enforcing/permissive mode. * It updates status of the current enforcing/permissive mode.
*/ */
void selinux_status_update_setenforce(struct selinux_state *state, void selinux_status_update_setenforce(int enforcing)
int enforcing)
{ {
struct selinux_kernel_status *status; struct selinux_kernel_status *status;
mutex_lock(&state->status_lock); mutex_lock(&selinux_state.status_lock);
if (state->status_page) { if (selinux_state.status_page) {
status = page_address(state->status_page); status = page_address(selinux_state.status_page);
status->sequence++; status->sequence++;
smp_wmb(); smp_wmb();
@ -93,7 +92,7 @@ void selinux_status_update_setenforce(struct selinux_state *state,
smp_wmb(); smp_wmb();
status->sequence++; status->sequence++;
} }
mutex_unlock(&state->status_lock); mutex_unlock(&selinux_state.status_lock);
} }
/* /*
@ -102,23 +101,22 @@ void selinux_status_update_setenforce(struct selinux_state *state,
* It updates status of the times of policy reloaded, and current * It updates status of the times of policy reloaded, and current
* setting of deny_unknown. * setting of deny_unknown.
*/ */
void selinux_status_update_policyload(struct selinux_state *state, void selinux_status_update_policyload(int seqno)
int seqno)
{ {
struct selinux_kernel_status *status; struct selinux_kernel_status *status;
mutex_lock(&state->status_lock); mutex_lock(&selinux_state.status_lock);
if (state->status_page) { if (selinux_state.status_page) {
status = page_address(state->status_page); status = page_address(selinux_state.status_page);
status->sequence++; status->sequence++;
smp_wmb(); smp_wmb();
status->policyload = seqno; status->policyload = seqno;
status->deny_unknown = !security_get_allow_unknown(state); status->deny_unknown = !security_get_allow_unknown();
smp_wmb(); smp_wmb();
status->sequence++; status->sequence++;
} }
mutex_unlock(&state->status_lock); mutex_unlock(&selinux_state.status_lock);
} }

20
security/selinux/xfrm.c
View File

@ -98,13 +98,12 @@ static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp,
ctx->ctx_len = str_len; ctx->ctx_len = str_len;
memcpy(ctx->ctx_str, &uctx[1], str_len); memcpy(ctx->ctx_str, &uctx[1], str_len);
ctx->ctx_str[str_len] = '\0'; ctx->ctx_str[str_len] = '\0';
rc = security_context_to_sid(&selinux_state, ctx->ctx_str, str_len, rc = security_context_to_sid(ctx->ctx_str, str_len,
&ctx->ctx_sid, gfp); &ctx->ctx_sid, gfp);
if (rc) if (rc)
goto err; goto err;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(tsec->sid, ctx->ctx_sid,
tsec->sid, ctx->ctx_sid,
SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT, NULL); SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT, NULL);
if (rc) if (rc)
goto err; goto err;
@ -140,8 +139,7 @@ static int selinux_xfrm_delete(struct xfrm_sec_ctx *ctx)
if (!ctx) if (!ctx)
return 0; return 0;
return avc_has_perm(&selinux_state, return avc_has_perm(tsec->sid, ctx->ctx_sid,
tsec->sid, ctx->ctx_sid,
SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT, SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT,
NULL); NULL);
} }
@ -163,8 +161,7 @@ int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid)
if (!selinux_authorizable_ctx(ctx)) if (!selinux_authorizable_ctx(ctx))
return -EINVAL; return -EINVAL;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(fl_secid, ctx->ctx_sid,
fl_secid, ctx->ctx_sid,
SECCLASS_ASSOCIATION, ASSOCIATION__POLMATCH, NULL); SECCLASS_ASSOCIATION, ASSOCIATION__POLMATCH, NULL);
return (rc == -EACCES ? -ESRCH : rc); return (rc == -EACCES ? -ESRCH : rc);
} }
@ -205,7 +202,7 @@ int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
/* We don't need a separate SA Vs. policy polmatch check since the SA /* We don't need a separate SA Vs. policy polmatch check since the SA
* is now of the same label as the flow and a flow Vs. policy polmatch * is now of the same label as the flow and a flow Vs. policy polmatch
* check had already happened in selinux_xfrm_policy_lookup() above. */ * check had already happened in selinux_xfrm_policy_lookup() above. */
return (avc_has_perm(&selinux_state, flic_sid, state_sid, return (avc_has_perm(flic_sid, state_sid,
SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO, SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO,
NULL) ? 0 : 1); NULL) ? 0 : 1);
} }
@ -355,7 +352,7 @@ int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x,
if (secid == 0) if (secid == 0)
return -EINVAL; return -EINVAL;
rc = security_sid_to_context(&selinux_state, secid, &ctx_str, rc = security_sid_to_context(secid, &ctx_str,
&str_len); &str_len);
if (rc) if (rc)
return rc; return rc;
@ -424,8 +421,7 @@ int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
/* This check even when there's no association involved is intended, /* This check even when there's no association involved is intended,
* according to Trent Jaeger, to make sure a process can't engage in * according to Trent Jaeger, to make sure a process can't engage in
* non-IPsec communication unless explicitly allowed by policy. */ * non-IPsec communication unless explicitly allowed by policy. */
return avc_has_perm(&selinux_state, return avc_has_perm(sk_sid, peer_sid,
sk_sid, peer_sid,
SECCLASS_ASSOCIATION, ASSOCIATION__RECVFROM, ad); SECCLASS_ASSOCIATION, ASSOCIATION__RECVFROM, ad);
} }
@ -468,6 +464,6 @@ int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
/* This check even when there's no association involved is intended, /* This check even when there's no association involved is intended,
* according to Trent Jaeger, to make sure a process can't engage in * according to Trent Jaeger, to make sure a process can't engage in
* non-IPsec communication unless explicitly allowed by policy. */ * non-IPsec communication unless explicitly allowed by policy. */
return avc_has_perm(&selinux_state, sk_sid, SECINITSID_UNLABELED, return avc_has_perm(sk_sid, SECINITSID_UNLABELED,
SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO, ad); SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO, ad);
} }