tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1/* SPDX-License-Identifier: GPL-2.0 */
2/*
3 * A security identifier table (sidtab) is a lookup table
4 * of security context structures indexed by SID value.
5 *
6 * Original author: Stephen Smalley, <sds@tycho.nsa.gov>
7 * Author: Ondrej Mosnacek, <omosnacek@gmail.com>
8 *
9 * Copyright (C) 2018 Red Hat, Inc.
10 */
11#ifndef _SS_SIDTAB_H_
12#define _SS_SIDTAB_H_
13
14#include <linux/spinlock_types.h>
15#include <linux/log2.h>
16
17#include "context.h"
18
19struct sidtab_entry_leaf {
20 struct context context;
21};
22
23struct sidtab_node_inner;
24struct sidtab_node_leaf;
25
26union sidtab_entry_inner {
27 struct sidtab_node_inner *ptr_inner;
28 struct sidtab_node_leaf *ptr_leaf;
29};
30
31/* align node size to page boundary */
32#define SIDTAB_NODE_ALLOC_SHIFT PAGE_SHIFT
33#define SIDTAB_NODE_ALLOC_SIZE PAGE_SIZE
34
35#define size_to_shift(size) ((size) == 1 ? 1 : (const_ilog2((size) - 1) + 1))
36
37#define SIDTAB_INNER_SHIFT \
38 (SIDTAB_NODE_ALLOC_SHIFT - size_to_shift(sizeof(union sidtab_entry_inner)))
39#define SIDTAB_INNER_ENTRIES ((size_t)1 << SIDTAB_INNER_SHIFT)
40#define SIDTAB_LEAF_ENTRIES \
41 (SIDTAB_NODE_ALLOC_SIZE / sizeof(struct sidtab_entry_leaf))
42
43#define SIDTAB_MAX_BITS 31 /* limited to INT_MAX due to atomic_t range */
44#define SIDTAB_MAX (((u32)1 << SIDTAB_MAX_BITS) - 1)
45/* ensure enough tree levels for SIDTAB_MAX entries */
46#define SIDTAB_MAX_LEVEL \
47 DIV_ROUND_UP(SIDTAB_MAX_BITS - size_to_shift(SIDTAB_LEAF_ENTRIES), \
48 SIDTAB_INNER_SHIFT)
49
50struct sidtab_node_leaf {
51 struct sidtab_entry_leaf entries[SIDTAB_LEAF_ENTRIES];
52};
53
54struct sidtab_node_inner {
55 union sidtab_entry_inner entries[SIDTAB_INNER_ENTRIES];
56};
57
58struct sidtab_isid_entry {
59 int set;
60 struct context context;
61};
62
63struct sidtab_convert_params {
64 int (*func)(struct context *oldc, struct context *newc, void *args);
65 void *args;
66 struct sidtab *target;
67};
68
69#define SIDTAB_RCACHE_SIZE 3
70
71struct sidtab {
72 union sidtab_entry_inner roots[SIDTAB_MAX_LEVEL + 1];
73 atomic_t count;
74 struct sidtab_convert_params *convert;
75 spinlock_t lock;
76
77 /* reverse lookup cache */
78 atomic_t rcache[SIDTAB_RCACHE_SIZE];
79
80 /* index == SID - 1 (no entry for SECSID_NULL) */
81 struct sidtab_isid_entry isids[SECINITSID_NUM];
82};
83
84int sidtab_init(struct sidtab *s);
85int sidtab_set_initial(struct sidtab *s, u32 sid, struct context *context);
86struct context *sidtab_search(struct sidtab *s, u32 sid);
87struct context *sidtab_search_force(struct sidtab *s, u32 sid);
88
89int sidtab_convert(struct sidtab *s, struct sidtab_convert_params *params);
90
91int sidtab_context_to_sid(struct sidtab *s, struct context *context, u32 *sid);
92
93void sidtab_destroy(struct sidtab *s);
94
95#endif /* _SS_SIDTAB_H_ */
96
97