2 * Access vector cache interface for object managers.
4 * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
6 #ifndef _SELINUX_AVC_H_
7 #define _SELINUX_AVC_H_
9 #include <linux/stddef.h>
10 #include <linux/errno.h>
11 #include <linux/kernel.h>
12 #include <linux/kdev_t.h>
13 #include <linux/spinlock.h>
14 #include <linux/init.h>
15 #include <linux/audit.h>
16 #include <linux/lsm_audit.h>
17 #include <linux/in6.h>
19 #include "av_permissions.h"
22 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
23 extern int selinux_enforcing;
25 #define selinux_enforcing 1
29 * An entry in the AVC.
41 struct avc_cache_stats {
44 unsigned int allocations;
45 unsigned int reclaims;
53 void __init avc_init(void);
55 int avc_audit(u32 ssid, u32 tsid,
56 u16 tclass, u32 requested,
57 struct av_decision *avd,
59 struct common_audit_data *a, unsigned flags);
61 #define AVC_STRICT 1 /* Ignore permissive mode. */
62 int avc_has_perm_noaudit(u32 ssid, u32 tsid,
63 u16 tclass, u32 requested,
65 struct av_decision *avd);
67 int avc_has_perm_flags(u32 ssid, u32 tsid,
68 u16 tclass, u32 requested,
69 struct common_audit_data *auditdata,
72 static inline int avc_has_perm(u32 ssid, u32 tsid,
73 u16 tclass, u32 requested,
74 struct common_audit_data *auditdata)
76 return avc_has_perm_flags(ssid, tsid, tclass, requested, auditdata, 0);
79 u32 avc_policy_seqno(void);
81 #define AVC_CALLBACK_GRANT 1
82 #define AVC_CALLBACK_TRY_REVOKE 2
83 #define AVC_CALLBACK_REVOKE 4
84 #define AVC_CALLBACK_RESET 8
85 #define AVC_CALLBACK_AUDITALLOW_ENABLE 16
86 #define AVC_CALLBACK_AUDITALLOW_DISABLE 32
87 #define AVC_CALLBACK_AUDITDENY_ENABLE 64
88 #define AVC_CALLBACK_AUDITDENY_DISABLE 128
90 int avc_add_callback(int (*callback)(u32 event, u32 ssid, u32 tsid,
91 u16 tclass, u32 perms,
93 u32 events, u32 ssid, u32 tsid,
94 u16 tclass, u32 perms);
96 /* Exported to selinuxfs */
97 int avc_get_hash_stats(char *page);
98 extern unsigned int avc_cache_threshold;
100 /* Attempt to free avc node cache */
101 void avc_disable(void);
103 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
104 DECLARE_PER_CPU(struct avc_cache_stats, avc_cache_stats);
107 #endif /* _SELINUX_AVC_H_ */