1
2
3
4
5
6#ifndef _SELINUX_AVC_H_
7#define _SELINUX_AVC_H_
8
9#include <linux/stddef.h>
10#include <linux/errno.h>
11#include <linux/kernel.h>
12#include <linux/kdev_t.h>
13#include <linux/spinlock.h>
14#include <linux/init.h>
15#include <linux/audit.h>
16#include <linux/lsm_audit.h>
17#include <linux/in6.h>
18#include <linux/path.h>
19#include <asm/system.h>
20#include "flask.h"
21#include "av_permissions.h"
22#include "security.h"
23
24#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
25extern int selinux_enforcing;
26#else
27#define selinux_enforcing 1
28#endif
29
30
31
32
33struct avc_entry;
34
35struct task_struct;
36struct inode;
37struct sock;
38struct sk_buff;
39
40
41
42
43struct avc_cache_stats {
44 unsigned int lookups;
45 unsigned int hits;
46 unsigned int misses;
47 unsigned int allocations;
48 unsigned int reclaims;
49 unsigned int frees;
50};
51
52
53
54
55
56void __init avc_init(void);
57
58void avc_audit(u32 ssid, u32 tsid,
59 u16 tclass, u32 requested,
60 struct av_decision *avd,
61 int result,
62 struct common_audit_data *a);
63
64#define AVC_STRICT 1
65int avc_has_perm_noaudit(u32 ssid, u32 tsid,
66 u16 tclass, u32 requested,
67 unsigned flags,
68 struct av_decision *avd);
69
70int avc_has_perm(u32 ssid, u32 tsid,
71 u16 tclass, u32 requested,
72 struct common_audit_data *auditdata);
73
74u32 avc_policy_seqno(void);
75
76#define AVC_CALLBACK_GRANT 1
77#define AVC_CALLBACK_TRY_REVOKE 2
78#define AVC_CALLBACK_REVOKE 4
79#define AVC_CALLBACK_RESET 8
80#define AVC_CALLBACK_AUDITALLOW_ENABLE 16
81#define AVC_CALLBACK_AUDITALLOW_DISABLE 32
82#define AVC_CALLBACK_AUDITDENY_ENABLE 64
83#define AVC_CALLBACK_AUDITDENY_DISABLE 128
84
85int avc_add_callback(int (*callback)(u32 event, u32 ssid, u32 tsid,
86 u16 tclass, u32 perms,
87 u32 *out_retained),
88 u32 events, u32 ssid, u32 tsid,
89 u16 tclass, u32 perms);
90
91
92int avc_get_hash_stats(char *page);
93extern unsigned int avc_cache_threshold;
94
95
96void avc_disable(void);
97
98#ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
99DECLARE_PER_CPU(struct avc_cache_stats, avc_cache_stats);
100#endif
101
102#endif
103
104