Commit | Line | Data |
---|---|---|
d2912cb1 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
11904167 KK |
2 | /* |
3 | * mmap based event notifications for SELinux | |
4 | * | |
5 | * Author: KaiGai Kohei <kaigai@ak.jp.nec.com> | |
6 | * | |
7 | * Copyright (C) 2010 NEC corporation | |
11904167 KK |
8 | */ |
9 | #include <linux/kernel.h> | |
10 | #include <linux/gfp.h> | |
11 | #include <linux/mm.h> | |
12 | #include <linux/mutex.h> | |
13 | #include "avc.h" | |
4b36cb77 | 14 | #include "security.h" |
11904167 KK |
15 | |
16 | /* | |
17 | * The selinux_status_page shall be exposed to userspace applications | |
18 | * using mmap interface on /selinux/status. | |
19 | * It enables to notify applications a few events that will cause reset | |
20 | * of userspace access vector without context switching. | |
21 | * | |
22 | * The selinux_kernel_status structure on the head of status page is | |
23 | * protected from concurrent accesses using seqlock logic, so userspace | |
24 | * application should reference the status page according to the seqlock | |
25 | * logic. | |
26 | * | |
27 | * Typically, application checks status->sequence at the head of access | |
28 | * control routine. If it is odd-number, kernel is updating the status, | |
29 | * so please wait for a moment. If it is changed from the last sequence | |
30 | * number, it means something happen, so application will reset userspace | |
31 | * avc, if needed. | |
32 | * In most cases, application shall confirm the kernel status is not | |
33 | * changed without any system call invocations. | |
34 | */ | |
11904167 KK |
35 | |
36 | /* | |
37 | * selinux_kernel_status_page | |
38 | * | |
39 | * It returns a reference to selinux_status_page. If the status page is | |
40 | * not allocated yet, it also tries to allocate it at the first time. | |
41 | */ | |
e67b7985 | 42 | struct page *selinux_kernel_status_page(void) |
11904167 KK |
43 | { |
44 | struct selinux_kernel_status *status; | |
45 | struct page *result = NULL; | |
46 | ||
e67b7985 SS |
47 | mutex_lock(&selinux_state.status_lock); |
48 | if (!selinux_state.status_page) { | |
49 | selinux_state.status_page = alloc_page(GFP_KERNEL|__GFP_ZERO); | |
36f7f284 | 50 | |
e67b7985 SS |
51 | if (selinux_state.status_page) { |
52 | status = page_address(selinux_state.status_page); | |
11904167 KK |
53 | |
54 | status->version = SELINUX_KERNEL_STATUS_VERSION; | |
55 | status->sequence = 0; | |
e67b7985 | 56 | status->enforcing = enforcing_enabled(); |
11904167 KK |
57 | /* |
58 | * NOTE: the next policyload event shall set | |
59 | * a positive value on the status->policyload, | |
60 | * although it may not be 1, but never zero. | |
61 | * So, application can know it was updated. | |
62 | */ | |
63 | status->policyload = 0; | |
aa8e712c | 64 | status->deny_unknown = |
e67b7985 | 65 | !security_get_allow_unknown(); |
11904167 KK |
66 | } |
67 | } | |
e67b7985 SS |
68 | result = selinux_state.status_page; |
69 | mutex_unlock(&selinux_state.status_lock); | |
11904167 KK |
70 | |
71 | return result; | |
72 | } | |
73 | ||
74 | /* | |
75 | * selinux_status_update_setenforce | |
76 | * | |
77 | * It updates status of the current enforcing/permissive mode. | |
78 | */ | |
e67b7985 | 79 | void selinux_status_update_setenforce(int enforcing) |
11904167 KK |
80 | { |
81 | struct selinux_kernel_status *status; | |
82 | ||
e67b7985 SS |
83 | mutex_lock(&selinux_state.status_lock); |
84 | if (selinux_state.status_page) { | |
85 | status = page_address(selinux_state.status_page); | |
11904167 KK |
86 | |
87 | status->sequence++; | |
88 | smp_wmb(); | |
89 | ||
90 | status->enforcing = enforcing; | |
91 | ||
92 | smp_wmb(); | |
93 | status->sequence++; | |
94 | } | |
e67b7985 | 95 | mutex_unlock(&selinux_state.status_lock); |
11904167 KK |
96 | } |
97 | ||
98 | /* | |
99 | * selinux_status_update_policyload | |
100 | * | |
101 | * It updates status of the times of policy reloaded, and current | |
102 | * setting of deny_unknown. | |
103 | */ | |
e67b7985 | 104 | void selinux_status_update_policyload(int seqno) |
11904167 KK |
105 | { |
106 | struct selinux_kernel_status *status; | |
107 | ||
e67b7985 SS |
108 | mutex_lock(&selinux_state.status_lock); |
109 | if (selinux_state.status_page) { | |
110 | status = page_address(selinux_state.status_page); | |
11904167 KK |
111 | |
112 | status->sequence++; | |
113 | smp_wmb(); | |
114 | ||
115 | status->policyload = seqno; | |
e67b7985 | 116 | status->deny_unknown = !security_get_allow_unknown(); |
11904167 KK |
117 | |
118 | smp_wmb(); | |
119 | status->sequence++; | |
120 | } | |
e67b7985 | 121 | mutex_unlock(&selinux_state.status_lock); |
11904167 | 122 | } |