1*4882a593Smuzhiyun // SPDX-License-Identifier: GPL-2.0-only
2*4882a593Smuzhiyun /*
3*4882a593Smuzhiyun * mmap based event notifications for SELinux
4*4882a593Smuzhiyun *
5*4882a593Smuzhiyun * Author: KaiGai Kohei <kaigai@ak.jp.nec.com>
6*4882a593Smuzhiyun *
7*4882a593Smuzhiyun * Copyright (C) 2010 NEC corporation
8*4882a593Smuzhiyun */
9*4882a593Smuzhiyun #include <linux/kernel.h>
10*4882a593Smuzhiyun #include <linux/gfp.h>
11*4882a593Smuzhiyun #include <linux/mm.h>
12*4882a593Smuzhiyun #include <linux/mutex.h>
13*4882a593Smuzhiyun #include "avc.h"
14*4882a593Smuzhiyun #include "security.h"
15*4882a593Smuzhiyun
16*4882a593Smuzhiyun /*
17*4882a593Smuzhiyun * The selinux_status_page shall be exposed to userspace applications
18*4882a593Smuzhiyun * using mmap interface on /selinux/status.
19*4882a593Smuzhiyun * It enables to notify applications a few events that will cause reset
20*4882a593Smuzhiyun * of userspace access vector without context switching.
21*4882a593Smuzhiyun *
22*4882a593Smuzhiyun * The selinux_kernel_status structure on the head of status page is
23*4882a593Smuzhiyun * protected from concurrent accesses using seqlock logic, so userspace
24*4882a593Smuzhiyun * application should reference the status page according to the seqlock
25*4882a593Smuzhiyun * logic.
26*4882a593Smuzhiyun *
27*4882a593Smuzhiyun * Typically, application checks status->sequence at the head of access
28*4882a593Smuzhiyun * control routine. If it is odd-number, kernel is updating the status,
29*4882a593Smuzhiyun * so please wait for a moment. If it is changed from the last sequence
30*4882a593Smuzhiyun * number, it means something happen, so application will reset userspace
31*4882a593Smuzhiyun * avc, if needed.
32*4882a593Smuzhiyun * In most cases, application shall confirm the kernel status is not
33*4882a593Smuzhiyun * changed without any system call invocations.
34*4882a593Smuzhiyun */
35*4882a593Smuzhiyun
36*4882a593Smuzhiyun /*
37*4882a593Smuzhiyun * selinux_kernel_status_page
38*4882a593Smuzhiyun *
39*4882a593Smuzhiyun * It returns a reference to selinux_status_page. If the status page is
40*4882a593Smuzhiyun * not allocated yet, it also tries to allocate it at the first time.
41*4882a593Smuzhiyun */
selinux_kernel_status_page(struct selinux_state * state)42*4882a593Smuzhiyun struct page *selinux_kernel_status_page(struct selinux_state *state)
43*4882a593Smuzhiyun {
44*4882a593Smuzhiyun struct selinux_kernel_status *status;
45*4882a593Smuzhiyun struct page *result = NULL;
46*4882a593Smuzhiyun
47*4882a593Smuzhiyun mutex_lock(&state->status_lock);
48*4882a593Smuzhiyun if (!state->status_page) {
49*4882a593Smuzhiyun state->status_page = alloc_page(GFP_KERNEL|__GFP_ZERO);
50*4882a593Smuzhiyun
51*4882a593Smuzhiyun if (state->status_page) {
52*4882a593Smuzhiyun status = page_address(state->status_page);
53*4882a593Smuzhiyun
54*4882a593Smuzhiyun status->version = SELINUX_KERNEL_STATUS_VERSION;
55*4882a593Smuzhiyun status->sequence = 0;
56*4882a593Smuzhiyun status->enforcing = enforcing_enabled(state);
57*4882a593Smuzhiyun /*
58*4882a593Smuzhiyun * NOTE: the next policyload event shall set
59*4882a593Smuzhiyun * a positive value on the status->policyload,
60*4882a593Smuzhiyun * although it may not be 1, but never zero.
61*4882a593Smuzhiyun * So, application can know it was updated.
62*4882a593Smuzhiyun */
63*4882a593Smuzhiyun status->policyload = 0;
64*4882a593Smuzhiyun status->deny_unknown =
65*4882a593Smuzhiyun !security_get_allow_unknown(state);
66*4882a593Smuzhiyun }
67*4882a593Smuzhiyun }
68*4882a593Smuzhiyun result = state->status_page;
69*4882a593Smuzhiyun mutex_unlock(&state->status_lock);
70*4882a593Smuzhiyun
71*4882a593Smuzhiyun return result;
72*4882a593Smuzhiyun }
73*4882a593Smuzhiyun
74*4882a593Smuzhiyun /*
75*4882a593Smuzhiyun * selinux_status_update_setenforce
76*4882a593Smuzhiyun *
77*4882a593Smuzhiyun * It updates status of the current enforcing/permissive mode.
78*4882a593Smuzhiyun */
selinux_status_update_setenforce(struct selinux_state * state,int enforcing)79*4882a593Smuzhiyun void selinux_status_update_setenforce(struct selinux_state *state,
80*4882a593Smuzhiyun int enforcing)
81*4882a593Smuzhiyun {
82*4882a593Smuzhiyun struct selinux_kernel_status *status;
83*4882a593Smuzhiyun
84*4882a593Smuzhiyun mutex_lock(&state->status_lock);
85*4882a593Smuzhiyun if (state->status_page) {
86*4882a593Smuzhiyun status = page_address(state->status_page);
87*4882a593Smuzhiyun
88*4882a593Smuzhiyun status->sequence++;
89*4882a593Smuzhiyun smp_wmb();
90*4882a593Smuzhiyun
91*4882a593Smuzhiyun status->enforcing = enforcing;
92*4882a593Smuzhiyun
93*4882a593Smuzhiyun smp_wmb();
94*4882a593Smuzhiyun status->sequence++;
95*4882a593Smuzhiyun }
96*4882a593Smuzhiyun mutex_unlock(&state->status_lock);
97*4882a593Smuzhiyun }
98*4882a593Smuzhiyun
99*4882a593Smuzhiyun /*
100*4882a593Smuzhiyun * selinux_status_update_policyload
101*4882a593Smuzhiyun *
102*4882a593Smuzhiyun * It updates status of the times of policy reloaded, and current
103*4882a593Smuzhiyun * setting of deny_unknown.
104*4882a593Smuzhiyun */
selinux_status_update_policyload(struct selinux_state * state,int seqno)105*4882a593Smuzhiyun void selinux_status_update_policyload(struct selinux_state *state,
106*4882a593Smuzhiyun int seqno)
107*4882a593Smuzhiyun {
108*4882a593Smuzhiyun struct selinux_kernel_status *status;
109*4882a593Smuzhiyun
110*4882a593Smuzhiyun mutex_lock(&state->status_lock);
111*4882a593Smuzhiyun if (state->status_page) {
112*4882a593Smuzhiyun status = page_address(state->status_page);
113*4882a593Smuzhiyun
114*4882a593Smuzhiyun status->sequence++;
115*4882a593Smuzhiyun smp_wmb();
116*4882a593Smuzhiyun
117*4882a593Smuzhiyun status->policyload = seqno;
118*4882a593Smuzhiyun status->deny_unknown = !security_get_allow_unknown(state);
119*4882a593Smuzhiyun
120*4882a593Smuzhiyun smp_wmb();
121*4882a593Smuzhiyun status->sequence++;
122*4882a593Smuzhiyun }
123*4882a593Smuzhiyun mutex_unlock(&state->status_lock);
124*4882a593Smuzhiyun }
125