forked from ~ljy/RK356X_SDK_RELEASE

blame | history | patch | commit | commitdiff
hc
2024-12-19 9370bb92b2d16684ee45cf24e879c93c509162da 
 kernel/security/selinux/include/security.h
....@@ -13,9 +13,11 @@
1313 #include <linux/dcache.h>
1414 #include <linux/magic.h>
1515 #include <linux/types.h>
16
+#include <linux/rcupdate.h>
1617 #include <linux/refcount.h>
1718 #include <linux/workqueue.h>
1819 #include "flask.h"
20
+#include "policycap.h"
1921 
2022 #define SECSID_NULL			0x00000000 /* unspecified SID */
2123 #define SECSID_WILD			0xffffffff /* wildcard SID */
....@@ -40,10 +42,12 @@
4042 #define POLICYDB_VERSION_CONSTRAINT_NAMES	29
4143 #define POLICYDB_VERSION_XPERMS_IOCTL	30
4244 #define POLICYDB_VERSION_INFINIBAND		31
45
+#define POLICYDB_VERSION_GLBLUB		32
46
+#define POLICYDB_VERSION_COMP_FTRANS	33 /* compressed filename transitions */
4347 
4448 /* Range of policy versions we understand*/
4549 #define POLICYDB_VERSION_MIN   POLICYDB_VERSION_BASE
46
-#define POLICYDB_VERSION_MAX   POLICYDB_VERSION_INFINIBAND
50
+#define POLICYDB_VERSION_MAX   POLICYDB_VERSION_COMP_FTRANS
4751 
4852 /* Mask for just the mount related flags */
4953 #define SE_MNTMASK	0x0f
....@@ -58,30 +62,17 @@
5862 #define SE_SBINITIALIZED	0x0100
5963 #define SE_SBPROC		0x0200
6064 #define SE_SBGENFS		0x0400
65
+#define SE_SBGENFS_XATTR	0x0800
6166 
62
-#define CONTEXT_STR	"context="
63
-#define FSCONTEXT_STR	"fscontext="
64
-#define ROOTCONTEXT_STR	"rootcontext="
65
-#define DEFCONTEXT_STR	"defcontext="
66
-#define LABELSUPP_STR "seclabel"
67
+#define CONTEXT_STR	"context"
68
+#define FSCONTEXT_STR	"fscontext"
69
+#define ROOTCONTEXT_STR	"rootcontext"
70
+#define DEFCONTEXT_STR	"defcontext"
71
+#define SECLABEL_STR "seclabel"
6772 
6873 struct netlbl_lsm_secattr;
6974 
70
-extern int selinux_enabled;
71
-
72
-/* Policy capabilities */
73
-enum {
74
-	POLICYDB_CAPABILITY_NETPEER,
75
-	POLICYDB_CAPABILITY_OPENPERM,
76
-	POLICYDB_CAPABILITY_EXTSOCKCLASS,
77
-	POLICYDB_CAPABILITY_ALWAYSNETWORK,
78
-	POLICYDB_CAPABILITY_CGROUPSECLABEL,
79
-	POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION,
80
-	__POLICYDB_CAPABILITY_MAX
81
-};
82
-#define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
83
-
84
-extern const char *selinux_policycap_names[__POLICYDB_CAPABILITY_MAX];
75
+extern int selinux_enabled_boot;
8576 
8677 /*
8778  * type_datum properties
....@@ -94,10 +85,12 @@
9485 #define POLICYDB_BOUNDS_MAXDEPTH	4
9586 
9687 struct selinux_avc;
97
-struct selinux_ss;
88
+struct selinux_policy;
9889 
9990 struct selinux_state {
91
+#ifdef CONFIG_SECURITY_SELINUX_DISABLE
10092 	bool disabled;
93
+#endif
10194 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
10295 	bool enforcing;
10396 #endif
....@@ -107,24 +100,39 @@
107100 	bool android_netlink_route;
108101 	bool android_netlink_getneigh;
109102 
110
-	struct selinux_avc *avc;
111
-	struct selinux_ss *ss;
112
-};
103
+	struct page *status_page;
104
+	struct mutex status_lock;
113105 
114
-void selinux_ss_init(struct selinux_ss **ss);
106
+	struct selinux_avc *avc;
107
+	struct selinux_policy __rcu *policy;
108
+	struct mutex policy_mutex;
109
+} __randomize_layout;
110
+
115111 void selinux_avc_init(struct selinux_avc **avc);
116112 
117113 extern struct selinux_state selinux_state;
118114 
115
+static inline bool selinux_initialized(const struct selinux_state *state)
116
+{
117
+	/* do a synchronized load to avoid race conditions */
118
+	return smp_load_acquire(&state->initialized);
119
+}
120
+
121
+static inline void selinux_mark_initialized(struct selinux_state *state)
122
+{
123
+	/* do a synchronized write to avoid race conditions */
124
+	smp_store_release(&state->initialized, true);
125
+}
126
+
119127 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
120128 static inline bool enforcing_enabled(struct selinux_state *state)
121129 {
122
-	return state->enforcing;
130
+	return READ_ONCE(state->enforcing);
123131 }
124132 
125133 static inline void enforcing_set(struct selinux_state *state, bool value)
126134 {
127
-	state->enforcing = value;
135
+	WRITE_ONCE(state->enforcing, value);
128136 }
129137 #else
130138 static inline bool enforcing_enabled(struct selinux_state *state)
....@@ -137,46 +145,87 @@
137145 }
138146 #endif
139147 
148
+static inline bool checkreqprot_get(const struct selinux_state *state)
149
+{
150
+	return READ_ONCE(state->checkreqprot);
151
+}
152
+
153
+static inline void checkreqprot_set(struct selinux_state *state, bool value)
154
+{
155
+	WRITE_ONCE(state->checkreqprot, value);
156
+}
157
+
158
+#ifdef CONFIG_SECURITY_SELINUX_DISABLE
159
+static inline bool selinux_disabled(struct selinux_state *state)
160
+{
161
+	return READ_ONCE(state->disabled);
162
+}
163
+
164
+static inline void selinux_mark_disabled(struct selinux_state *state)
165
+{
166
+	WRITE_ONCE(state->disabled, true);
167
+}
168
+#else
169
+static inline bool selinux_disabled(struct selinux_state *state)
170
+{
171
+	return false;
172
+}
173
+#endif
174
+
140175 static inline bool selinux_policycap_netpeer(void)
141176 {
142177 	struct selinux_state *state = &selinux_state;
143178 
144
-	return state->policycap[POLICYDB_CAPABILITY_NETPEER];
179
+	return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_NETPEER]);
145180 }
146181 
147182 static inline bool selinux_policycap_openperm(void)
148183 {
149184 	struct selinux_state *state = &selinux_state;
150185 
151
-	return state->policycap[POLICYDB_CAPABILITY_OPENPERM];
186
+	return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_OPENPERM]);
152187 }
153188 
154189 static inline bool selinux_policycap_extsockclass(void)
155190 {
156191 	struct selinux_state *state = &selinux_state;
157192 
158
-	return state->policycap[POLICYDB_CAPABILITY_EXTSOCKCLASS];
193
+	return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_EXTSOCKCLASS]);
159194 }
160195 
161196 static inline bool selinux_policycap_alwaysnetwork(void)
162197 {
163198 	struct selinux_state *state = &selinux_state;
164199 
165
-	return state->policycap[POLICYDB_CAPABILITY_ALWAYSNETWORK];
200
+	return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_ALWAYSNETWORK]);
166201 }
167202 
168203 static inline bool selinux_policycap_cgroupseclabel(void)
169204 {
170205 	struct selinux_state *state = &selinux_state;
171206 
172
-	return state->policycap[POLICYDB_CAPABILITY_CGROUPSECLABEL];
207
+	return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_CGROUPSECLABEL]);
173208 }
174209 
175210 static inline bool selinux_policycap_nnp_nosuid_transition(void)
176211 {
177212 	struct selinux_state *state = &selinux_state;
178213 
179
-	return state->policycap[POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION];
214
+	return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION]);
215
+}
216
+
217
+static inline bool selinux_policycap_genfs_seclabel_symlinks(void)
218
+{
219
+	struct selinux_state *state = &selinux_state;
220
+
221
+	return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS]);
222
+}
223
+
224
+static inline bool selinux_policycap_ioctl_skip_cloexec(void)
225
+{
226
+	struct selinux_state *state = &selinux_state;
227
+
228
+	return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_IOCTL_SKIP_CLOEXEC]);
180229 }
181230 
182231 static inline bool selinux_android_nlroute_getlink(void)
....@@ -193,12 +242,23 @@
193242 	return state->android_netlink_getneigh;
194243 }
195244 
245
+struct selinux_policy_convert_data;
246
+
247
+struct selinux_load_state {
248
+	struct selinux_policy *policy;
249
+	struct selinux_policy_convert_data *convert_data;
250
+};
251
+
196252 int security_mls_enabled(struct selinux_state *state);
197253 int security_load_policy(struct selinux_state *state,
198
-			 void *data, size_t len);
254
+			 void *data, size_t len,
255
+			 struct selinux_load_state *load_state);
256
+void selinux_policy_commit(struct selinux_state *state,
257
+			   struct selinux_load_state *load_state);
258
+void selinux_policy_cancel(struct selinux_state *state,
259
+			   struct selinux_load_state *load_state);
199260 int security_read_policy(struct selinux_state *state,
200261 			 void **data, size_t *len);
201
-size_t security_policydb_len(struct selinux_state *state);
202262 
203263 int security_policycap_supported(struct selinux_state *state,
204264 				 unsigned int req_cap);
....@@ -272,6 +332,9 @@
272332 int security_sid_to_context_force(struct selinux_state *state,
273333 				  u32 sid, char **scontext, u32 *scontext_len);
274334 
335
+int security_sid_to_context_inval(struct selinux_state *state,
336
+				  u32 sid, char **scontext, u32 *scontext_len);
337
+
275338 int security_context_to_sid(struct selinux_state *state,
276339 			    const char *scontext, u32 scontext_len,
277340 			    u32 *out_sid, gfp_t gfp);
....@@ -326,9 +389,9 @@
326389 				 u32 xfrm_sid,
327390 				 u32 *peer_sid);
328391 
329
-int security_get_classes(struct selinux_state *state,
392
+int security_get_classes(struct selinux_policy *policy,
330393 			 char ***classes, int *nclasses);
331
-int security_get_permissions(struct selinux_state *state,
394
+int security_get_permissions(struct selinux_policy *policy,
332395 			     char *class, char ***perms, int *nperms);
333396 int security_get_reject_unknown(struct selinux_state *state);
334397 int security_get_allow_unknown(struct selinux_state *state);
....@@ -345,6 +408,10 @@
345408 int security_fs_use(struct selinux_state *state, struct super_block *sb);
346409 
347410 int security_genfs_sid(struct selinux_state *state,
411
+		       const char *fstype, char *name, u16 sclass,
412
+		       u32 *sid);
413
+
414
+int selinux_policy_genfs_sid(struct selinux_policy *policy,
348415 		       const char *fstype, char *name, u16 sclass,
349416 		       u32 *sid);
350417 
....@@ -407,7 +474,7 @@
407474 extern void avtab_cache_init(void);
408475 extern void ebitmap_cache_init(void);
409476 extern void hashtab_cache_init(void);
410
-extern void selinux_nlmsg_init(void);
411477 extern int security_sidtab_hash_stats(struct selinux_state *state, char *page);
478
+extern void selinux_nlmsg_init(void);
412479 
413480 #endif /* _SELINUX_SECURITY_H_ */