2 * Access vector cache interface for object managers.
4 * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
6 #ifndef _SELINUX_AVC_H_
7 #define _SELINUX_AVC_H_
9 #include <linux/stddef.h>
10 #include <linux/errno.h>
11 #include <linux/kernel.h>
12 #include <linux/kdev_t.h>
13 #include <linux/spinlock.h>
14 #include <linux/init.h>
15 #include <linux/audit.h>
16 #include <linux/lsm_audit.h>
17 #include <linux/in6.h>
19 #include "av_permissions.h"
22 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
23 extern int selinux_enforcing;
25 #define selinux_enforcing 1
29 * An entry in the AVC.
41 struct avc_cache_stats {
44 unsigned int allocations;
45 unsigned int reclaims;
49 struct selinux_audit_data {
57 * auditdeny is a bit tricky and unintuitive. See the
58 * comments in avc.c for it's meaning and usage.
61 struct av_decision *avd;
69 void __init avc_init(void);
71 int avc_audit(u32 ssid, u32 tsid,
72 u16 tclass, u32 requested,
73 struct av_decision *avd,
75 struct common_audit_data *a, unsigned flags);
77 #define AVC_STRICT 1 /* Ignore permissive mode. */
78 int avc_has_perm_noaudit(u32 ssid, u32 tsid,
79 u16 tclass, u32 requested,
81 struct av_decision *avd);
83 int avc_has_perm_flags(u32 ssid, u32 tsid,
84 u16 tclass, u32 requested,
85 struct common_audit_data *auditdata,
88 static inline int avc_has_perm(u32 ssid, u32 tsid,
89 u16 tclass, u32 requested,
90 struct common_audit_data *auditdata)
92 return avc_has_perm_flags(ssid, tsid, tclass, requested, auditdata, 0);
95 u32 avc_policy_seqno(void);
97 #define AVC_CALLBACK_GRANT 1
98 #define AVC_CALLBACK_TRY_REVOKE 2
99 #define AVC_CALLBACK_REVOKE 4
100 #define AVC_CALLBACK_RESET 8
101 #define AVC_CALLBACK_AUDITALLOW_ENABLE 16
102 #define AVC_CALLBACK_AUDITALLOW_DISABLE 32
103 #define AVC_CALLBACK_AUDITDENY_ENABLE 64
104 #define AVC_CALLBACK_AUDITDENY_DISABLE 128
106 int avc_add_callback(int (*callback)(u32 event, u32 ssid, u32 tsid,
107 u16 tclass, u32 perms,
109 u32 events, u32 ssid, u32 tsid,
110 u16 tclass, u32 perms);
112 /* Exported to selinuxfs */
113 int avc_get_hash_stats(char *page);
114 extern unsigned int avc_cache_threshold;
116 /* Attempt to free avc node cache */
117 void avc_disable(void);
119 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
120 DECLARE_PER_CPU(struct avc_cache_stats, avc_cache_stats);
123 #endif /* _SELINUX_AVC_H_ */