sidtab.c

Go to the documentation of this file.

/*
 * Implementation of the SID table type.
 *
 * Author : Stephen Smalley, <[email protected]>
 */
#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/spinlock.h>
#include <linux/errno.h>
#include "flask.h"
#include "security.h"
#include "sidtab.h"

#define SIDTAB_HASH(sid) \
(sid & SIDTAB_HASH_MASK)

int sidtab_init(struct sidtab *s)
{
    int i;

    s->htable = kmalloc(sizeof(*(s->htable)) * SIDTAB_SIZE, GFP_ATOMIC);
    if (!s->htable)
        return -ENOMEM;
    for (i = 0; i < SIDTAB_SIZE; i++)
        s->htable[i] = NULL;
    s->nel = 0;
    s->next_sid = 1;
    s->shutdown = 0;
    spin_lock_init(&s->lock);
    return 0;
}

int sidtab_insert(struct sidtab *s, u32 sid, struct context *context)
{
    int hvalue, rc = 0;
    struct sidtab_node *prev, *cur, *newnode;

    if (!s) {
        rc = -ENOMEM;
        goto out;
    }

    hvalue = SIDTAB_HASH(sid);
    prev = NULL;
    cur = s->htable[hvalue];
    while (cur && sid > cur->sid) {
        prev = cur;
        cur = cur->next;
    }

    if (cur && sid == cur->sid) {
        rc = -EEXIST;
        goto out;
    }

    newnode = kmalloc(sizeof(*newnode), GFP_ATOMIC);
    if (newnode == NULL) {
        rc = -ENOMEM;
        goto out;
    }
    newnode->sid = sid;
    if (context_cpy(&newnode->context, context)) {
        kfree(newnode);
        rc = -ENOMEM;
        goto out;
    }

    if (prev) {
        newnode->next = prev->next;
        wmb();
        prev->next = newnode;
    } else {
        newnode->next = s->htable[hvalue];
        wmb();
        s->htable[hvalue] = newnode;
    }

    s->nel++;
    if (sid >= s->next_sid)
        s->next_sid = sid + 1;
out:
    return rc;
}

static struct context *sidtab_search_core(struct sidtab *s, u32 sid, int force)
{
    int hvalue;
    struct sidtab_node *cur;

    if (!s)
        return NULL;

    hvalue = SIDTAB_HASH(sid);
    cur = s->htable[hvalue];
    while (cur && sid > cur->sid)
        cur = cur->next;

    if (force && cur && sid == cur->sid && cur->context.len)
        return &cur->context;

    if (cur == NULL || sid != cur->sid || cur->context.len) {
        /* Remap invalid SIDs to the unlabeled SID. */
        sid = SECINITSID_UNLABELED;
        hvalue = SIDTAB_HASH(sid);
        cur = s->htable[hvalue];
        while (cur && sid > cur->sid)
            cur = cur->next;
        if (!cur || sid != cur->sid)
            return NULL;
    }

    return &cur->context;
}

struct context *sidtab_search(struct sidtab *s, u32 sid)
{
    return sidtab_search_core(s, sid, 0);
}

struct context *sidtab_search_force(struct sidtab *s, u32 sid)
{
    return sidtab_search_core(s, sid, 1);
}

int sidtab_map(struct sidtab *s,
           int (*apply) (u32 sid,
                 struct context *context,
                 void *args),
           void *args)
{
    int i, rc = 0;
    struct sidtab_node *cur;

    if (!s)
        goto out;

    for (i = 0; i < SIDTAB_SIZE; i++) {
        cur = s->htable[i];
        while (cur) {
            rc = apply(cur->sid, &cur->context, args);
            if (rc)
                goto out;
            cur = cur->next;
        }
    }
out:
    return rc;
}

static void sidtab_update_cache(struct sidtab *s, struct sidtab_node *n, int loc)
{
    BUG_ON(loc >= SIDTAB_CACHE_LEN);

    while (loc > 0) {
        s->cache[loc] = s->cache[loc - 1];
        loc--;
    }
    s->cache[0] = n;
}

static inline u32 sidtab_search_context(struct sidtab *s,
                          struct context *context)
{
    int i;
    struct sidtab_node *cur;

    for (i = 0; i < SIDTAB_SIZE; i++) {
        cur = s->htable[i];
        while (cur) {
            if (context_cmp(&cur->context, context)) {
                sidtab_update_cache(s, cur, SIDTAB_CACHE_LEN - 1);
                return cur->sid;
            }
            cur = cur->next;
        }
    }
    return 0;
}

static inline u32 sidtab_search_cache(struct sidtab *s, struct context *context)
{
    int i;
    struct sidtab_node *node;

    for (i = 0; i < SIDTAB_CACHE_LEN; i++) {
        node = s->cache[i];
        if (unlikely(!node))
            return 0;
        if (context_cmp(&node->context, context)) {
            sidtab_update_cache(s, node, i);
            return node->sid;
        }
    }
    return 0;
}

int sidtab_context_to_sid(struct sidtab *s,
              struct context *context,
              u32 *out_sid)
{
    u32 sid;
    int ret = 0;
    unsigned long flags;

    *out_sid = SECSID_NULL;

    sid  = sidtab_search_cache(s, context);
    if (!sid)
        sid = sidtab_search_context(s, context);
    if (!sid) {
        spin_lock_irqsave(&s->lock, flags);
        /* Rescan now that we hold the lock. */
        sid = sidtab_search_context(s, context);
        if (sid)
            goto unlock_out;
        /* No SID exists for the context.  Allocate a new one. */
        if (s->next_sid == UINT_MAX || s->shutdown) {
            ret = -ENOMEM;
            goto unlock_out;
        }
        sid = s->next_sid++;
        if (context->len)
            printk(KERN_INFO
               "SELinux:  Context %s is not valid (left unmapped).\n",
                   context->str);
        ret = sidtab_insert(s, sid, context);
        if (ret)
            s->next_sid--;
unlock_out:
        spin_unlock_irqrestore(&s->lock, flags);
    }

    if (ret)
        return ret;

    *out_sid = sid;
    return 0;
}

void sidtab_hash_eval(struct sidtab *h, char *tag)
{
    int i, chain_len, slots_used, max_chain_len;
    struct sidtab_node *cur;

    slots_used = 0;
    max_chain_len = 0;
    for (i = 0; i < SIDTAB_SIZE; i++) {
        cur = h->htable[i];
        if (cur) {
            slots_used++;
            chain_len = 0;
            while (cur) {
                chain_len++;
                cur = cur->next;
            }

            if (chain_len > max_chain_len)
                max_chain_len = chain_len;
        }
    }

    printk(KERN_DEBUG "%s:  %d entries and %d/%d buckets used, longest "
           "chain length %d\n", tag, h->nel, slots_used, SIDTAB_SIZE,
           max_chain_len);
}

void sidtab_destroy(struct sidtab *s)
{
    int i;
    struct sidtab_node *cur, *temp;

    if (!s)
        return;

    for (i = 0; i < SIDTAB_SIZE; i++) {
        cur = s->htable[i];
        while (cur) {
            temp = cur;
            cur = cur->next;
            context_destroy(&temp->context);
            kfree(temp);
        }
        s->htable[i] = NULL;
    }
    kfree(s->htable);
    s->htable = NULL;
    s->nel = 0;
    s->next_sid = 1;
}

void sidtab_set(struct sidtab *dst, struct sidtab *src)
{
    unsigned long flags;
    int i;

    spin_lock_irqsave(&src->lock, flags);
    dst->htable = src->htable;
    dst->nel = src->nel;
    dst->next_sid = src->next_sid;
    dst->shutdown = 0;
    for (i = 0; i < SIDTAB_CACHE_LEN; i++)
        dst->cache[i] = NULL;
    spin_unlock_irqrestore(&src->lock, flags);
}

void sidtab_shutdown(struct sidtab *s)
{
    unsigned long flags;

    spin_lock_irqsave(&s->lock, flags);
    s->shutdown = 1;
    spin_unlock_irqrestore(&s->lock, flags);
}