blob: dffca22ce6f747429c48cf84b3ccf4f810e1f61c [file] [log] [blame]
Thomas Gleixnerd2912cb2019-06-04 10:11:33 +02001// SPDX-License-Identifier: GPL-2.0-only
KaiGai Kohei11904162010-09-14 18:28:39 +09002/*
3 * mmap based event notifications for SELinux
4 *
5 * Author: KaiGai Kohei <kaigai@ak.jp.nec.com>
6 *
7 * Copyright (C) 2010 NEC corporation
KaiGai Kohei11904162010-09-14 18:28:39 +09008 */
9#include <linux/kernel.h>
10#include <linux/gfp.h>
11#include <linux/mm.h>
12#include <linux/mutex.h>
13#include "avc.h"
Ondrej Mosnacek4b36cb72020-01-17 14:15:14 +010014#include "security.h"
KaiGai Kohei11904162010-09-14 18:28:39 +090015
16/*
17 * The selinux_status_page shall be exposed to userspace applications
18 * using mmap interface on /selinux/status.
19 * It enables to notify applications a few events that will cause reset
20 * of userspace access vector without context switching.
21 *
22 * The selinux_kernel_status structure on the head of status page is
23 * protected from concurrent accesses using seqlock logic, so userspace
24 * application should reference the status page according to the seqlock
25 * logic.
26 *
27 * Typically, application checks status->sequence at the head of access
28 * control routine. If it is odd-number, kernel is updating the status,
29 * so please wait for a moment. If it is changed from the last sequence
30 * number, it means something happen, so application will reset userspace
31 * avc, if needed.
32 * In most cases, application shall confirm the kernel status is not
33 * changed without any system call invocations.
34 */
KaiGai Kohei11904162010-09-14 18:28:39 +090035
36/*
37 * selinux_kernel_status_page
38 *
39 * It returns a reference to selinux_status_page. If the status page is
40 * not allocated yet, it also tries to allocate it at the first time.
41 */
Stephen Smalleye67b7982023-03-09 13:30:37 -050042struct page *selinux_kernel_status_page(void)
KaiGai Kohei11904162010-09-14 18:28:39 +090043{
44 struct selinux_kernel_status *status;
45 struct page *result = NULL;
46
Stephen Smalleye67b7982023-03-09 13:30:37 -050047 mutex_lock(&selinux_state.status_lock);
48 if (!selinux_state.status_page) {
49 selinux_state.status_page = alloc_page(GFP_KERNEL|__GFP_ZERO);
KaiGai Kohei36f7f282010-09-30 11:49:55 +090050
Stephen Smalleye67b7982023-03-09 13:30:37 -050051 if (selinux_state.status_page) {
52 status = page_address(selinux_state.status_page);
KaiGai Kohei11904162010-09-14 18:28:39 +090053
54 status->version = SELINUX_KERNEL_STATUS_VERSION;
55 status->sequence = 0;
Stephen Smalleye67b7982023-03-09 13:30:37 -050056 status->enforcing = enforcing_enabled();
KaiGai Kohei11904162010-09-14 18:28:39 +090057 /*
58 * NOTE: the next policyload event shall set
59 * a positive value on the status->policyload,
60 * although it may not be 1, but never zero.
61 * So, application can know it was updated.
62 */
63 status->policyload = 0;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -050064 status->deny_unknown =
Stephen Smalleye67b7982023-03-09 13:30:37 -050065 !security_get_allow_unknown();
KaiGai Kohei11904162010-09-14 18:28:39 +090066 }
67 }
Stephen Smalleye67b7982023-03-09 13:30:37 -050068 result = selinux_state.status_page;
69 mutex_unlock(&selinux_state.status_lock);
KaiGai Kohei11904162010-09-14 18:28:39 +090070
71 return result;
72}
73
74/*
75 * selinux_status_update_setenforce
76 *
77 * It updates status of the current enforcing/permissive mode.
78 */
Christian Göttschec8672482023-07-06 15:23:34 +020079void selinux_status_update_setenforce(bool enforcing)
KaiGai Kohei11904162010-09-14 18:28:39 +090080{
81 struct selinux_kernel_status *status;
82
Stephen Smalleye67b7982023-03-09 13:30:37 -050083 mutex_lock(&selinux_state.status_lock);
84 if (selinux_state.status_page) {
85 status = page_address(selinux_state.status_page);
KaiGai Kohei11904162010-09-14 18:28:39 +090086
87 status->sequence++;
88 smp_wmb();
89
Christian Göttschec8672482023-07-06 15:23:34 +020090 status->enforcing = enforcing ? 1 : 0;
KaiGai Kohei11904162010-09-14 18:28:39 +090091
92 smp_wmb();
93 status->sequence++;
94 }
Stephen Smalleye67b7982023-03-09 13:30:37 -050095 mutex_unlock(&selinux_state.status_lock);
KaiGai Kohei11904162010-09-14 18:28:39 +090096}
97
98/*
99 * selinux_status_update_policyload
100 *
101 * It updates status of the times of policy reloaded, and current
102 * setting of deny_unknown.
103 */
Christian Göttsche1f270f12023-07-06 15:23:24 +0200104void selinux_status_update_policyload(u32 seqno)
KaiGai Kohei11904162010-09-14 18:28:39 +0900105{
106 struct selinux_kernel_status *status;
107
Stephen Smalleye67b7982023-03-09 13:30:37 -0500108 mutex_lock(&selinux_state.status_lock);
109 if (selinux_state.status_page) {
110 status = page_address(selinux_state.status_page);
KaiGai Kohei11904162010-09-14 18:28:39 +0900111
112 status->sequence++;
113 smp_wmb();
114
115 status->policyload = seqno;
Stephen Smalleye67b7982023-03-09 13:30:37 -0500116 status->deny_unknown = !security_get_allow_unknown();
KaiGai Kohei11904162010-09-14 18:28:39 +0900117
118 smp_wmb();
119 status->sequence++;
120 }
Stephen Smalleye67b7982023-03-09 13:30:37 -0500121 mutex_unlock(&selinux_state.status_lock);
KaiGai Kohei11904162010-09-14 18:28:39 +0900122}