1
+ /* SPDX-License-Identifier: GPL-2.0-only */
1
2
/*
2
3
* Implementation of the access vector table type.
3
4
*
4
5
* Author : Stephen Smalley, <[email protected] >
5
6
*/
6
7
7
- /* Updated: Frank Mayer <[email protected] > and Karl MacMillan <[email protected] >
8
- *
9
- * Added conditional policy language extensions
10
- *
11
- * Copyright (C) 2003 Tresys Technology, LLC
12
- * This program is free software; you can redistribute it and/or modify
13
- * it under the terms of the GNU General Public License as published by
14
- * the Free Software Foundation, version 2.
8
+ /* Updated: Frank Mayer <[email protected] > and
9
+ * Karl MacMillan <[email protected] >
10
+ * Added conditional policy language extensions
11
+ * Copyright (C) 2003 Tresys Technology, LLC
15
12
*
16
13
* Updated: Yuichi Nakamura <[email protected] >
17
- * Tuned number of hash slots for avtab to reduce memory usage
14
+ * Tuned number of hash slots for avtab to reduce memory usage
18
15
*/
19
16
20
17
#include <linux/bitops.h>
@@ -36,19 +33,20 @@ static inline u32 avtab_hash(const struct avtab_key *keyp, u32 mask)
36
33
static const u32 c2 = 0x1b873593 ;
37
34
static const u32 r1 = 15 ;
38
35
static const u32 r2 = 13 ;
39
- static const u32 m = 5 ;
40
- static const u32 n = 0xe6546b64 ;
36
+ static const u32 m = 5 ;
37
+ static const u32 n = 0xe6546b64 ;
41
38
42
39
u32 hash = 0 ;
43
40
44
- #define mix (input ) do { \
45
- u32 v = input; \
46
- v *= c1; \
47
- v = (v << r1) | (v >> (32 - r1)); \
48
- v *= c2; \
49
- hash ^= v; \
41
+ #define mix (input ) \
42
+ do { \
43
+ u32 v = input; \
44
+ v *= c1; \
45
+ v = (v << r1) | (v >> (32 - r1)); \
46
+ v *= c2; \
47
+ hash ^= v; \
50
48
hash = (hash << r2) | (hash >> (32 - r2)); \
51
- hash = hash * m + n; \
49
+ hash = hash * m + n; \
52
50
} while (0)
53
51
54
52
mix (keyp -> target_class );
@@ -66,9 +64,10 @@ static inline u32 avtab_hash(const struct avtab_key *keyp, u32 mask)
66
64
return hash & mask ;
67
65
}
68
66
69
- static struct avtab_node *
70
- avtab_insert_node (struct avtab * h , struct avtab_node * * dst ,
71
- const struct avtab_key * key , const struct avtab_datum * datum )
67
+ static struct avtab_node * avtab_insert_node (struct avtab * h ,
68
+ struct avtab_node * * dst ,
69
+ const struct avtab_key * key ,
70
+ const struct avtab_datum * datum )
72
71
{
73
72
struct avtab_node * newnode ;
74
73
struct avtab_extended_perms * xperms ;
@@ -99,7 +98,7 @@ avtab_insert_node(struct avtab *h, struct avtab_node **dst,
99
98
static int avtab_node_cmp (const struct avtab_key * key1 ,
100
99
const struct avtab_key * key2 )
101
100
{
102
- u16 specified = key1 -> specified & ~(AVTAB_ENABLED | AVTAB_ENABLED_OLD );
101
+ u16 specified = key1 -> specified & ~(AVTAB_ENABLED | AVTAB_ENABLED_OLD );
103
102
104
103
if (key1 -> source_type == key2 -> source_type &&
105
104
key1 -> target_type == key2 -> target_type &&
@@ -129,8 +128,7 @@ static int avtab_insert(struct avtab *h, const struct avtab_key *key,
129
128
return - EINVAL ;
130
129
131
130
hvalue = avtab_hash (key , h -> mask );
132
- for (prev = NULL , cur = h -> htable [hvalue ];
133
- cur ;
131
+ for (prev = NULL , cur = h -> htable [hvalue ]; cur ;
134
132
prev = cur , cur = cur -> next ) {
135
133
cmp = avtab_node_cmp (key , & cur -> key );
136
134
/* extended perms may not be unique */
@@ -163,8 +161,7 @@ struct avtab_node *avtab_insert_nonunique(struct avtab *h,
163
161
if (!h || !h -> nslot || h -> nel == U32_MAX )
164
162
return NULL ;
165
163
hvalue = avtab_hash (key , h -> mask );
166
- for (prev = NULL , cur = h -> htable [hvalue ];
167
- cur ;
164
+ for (prev = NULL , cur = h -> htable [hvalue ]; cur ;
168
165
prev = cur , cur = cur -> next ) {
169
166
cmp = avtab_node_cmp (key , & cur -> key );
170
167
if (cmp <= 0 )
@@ -188,8 +185,7 @@ struct avtab_node *avtab_search_node(struct avtab *h,
188
185
return NULL ;
189
186
190
187
hvalue = avtab_hash (key , h -> mask );
191
- for (cur = h -> htable [hvalue ]; cur ;
192
- cur = cur -> next ) {
188
+ for (cur = h -> htable [hvalue ]; cur ; cur = cur -> next ) {
193
189
cmp = avtab_node_cmp (key , & cur -> key );
194
190
if (cmp == 0 )
195
191
return cur ;
@@ -199,8 +195,8 @@ struct avtab_node *avtab_search_node(struct avtab *h,
199
195
return NULL ;
200
196
}
201
197
202
- struct avtab_node *
203
- avtab_search_node_next ( struct avtab_node * node , u16 specified )
198
+ struct avtab_node * avtab_search_node_next ( struct avtab_node * node ,
199
+ u16 specified )
204
200
{
205
201
struct avtab_key tmp_key ;
206
202
struct avtab_node * cur ;
@@ -314,17 +310,19 @@ void avtab_hash_eval(struct avtab *h, const char *tag)
314
310
315
311
if (chain_len > max_chain_len )
316
312
max_chain_len = chain_len ;
317
- chain2_len_sum += (unsigned long long )chain_len * chain_len ;
313
+ chain2_len_sum +=
314
+ (unsigned long long )chain_len * chain_len ;
318
315
}
319
316
}
320
317
321
318
pr_debug ("SELinux: %s: %d entries and %d/%d buckets used, "
322
- "longest chain length %d, sum of chain length^2 %llu\n" ,
323
- tag , h -> nel , slots_used , h -> nslot , max_chain_len ,
324
- chain2_len_sum );
319
+ "longest chain length %d, sum of chain length^2 %llu\n" ,
320
+ tag , h -> nel , slots_used , h -> nslot , max_chain_len ,
321
+ chain2_len_sum );
325
322
}
326
323
#endif /* CONFIG_SECURITY_SELINUX_DEBUG */
327
324
325
+ /* clang-format off */
328
326
static const uint16_t spec_order [] = {
329
327
AVTAB_ALLOWED ,
330
328
AVTAB_AUDITDENY ,
@@ -336,6 +334,7 @@ static const uint16_t spec_order[] = {
336
334
AVTAB_XPERMS_AUDITALLOW ,
337
335
AVTAB_XPERMS_DONTAUDIT
338
336
};
337
+ /* clang-format on */
339
338
340
339
int avtab_read_item (struct avtab * a , void * fp , struct policydb * pol ,
341
340
int (* insertf )(struct avtab * a , const struct avtab_key * k ,
@@ -365,9 +364,8 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
365
364
if (items2 > ARRAY_SIZE (buf32 )) {
366
365
pr_err ("SELinux: avtab: entry overflow\n" );
367
366
return - EINVAL ;
368
-
369
367
}
370
- rc = next_entry (buf32 , fp , sizeof (u32 )* items2 );
368
+ rc = next_entry (buf32 , fp , sizeof (u32 ) * items2 );
371
369
if (rc ) {
372
370
pr_err ("SELinux: avtab: truncated entry\n" );
373
371
return rc ;
@@ -400,8 +398,7 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
400
398
pr_err ("SELinux: avtab: null entry\n" );
401
399
return - EINVAL ;
402
400
}
403
- if ((val & AVTAB_AV ) &&
404
- (val & AVTAB_TYPE )) {
401
+ if ((val & AVTAB_AV ) && (val & AVTAB_TYPE )) {
405
402
pr_err ("SELinux: avtab: entry has both access vectors and types\n" );
406
403
return - EINVAL ;
407
404
}
@@ -428,7 +425,7 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
428
425
return 0 ;
429
426
}
430
427
431
- rc = next_entry (buf16 , fp , sizeof (u16 )* 4 );
428
+ rc = next_entry (buf16 , fp , sizeof (u16 ) * 4 );
432
429
if (rc ) {
433
430
pr_err ("SELinux: avtab: truncated entry\n" );
434
431
return rc ;
@@ -454,10 +451,11 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
454
451
}
455
452
456
453
if ((vers < POLICYDB_VERSION_XPERMS_IOCTL ) &&
457
- (key .specified & AVTAB_XPERMS )) {
454
+ (key .specified & AVTAB_XPERMS )) {
458
455
pr_err ("SELinux: avtab: policy version %u does not "
459
- "support extended permissions rules and one "
460
- "was specified\n" , vers );
456
+ "support extended permissions rules and one "
457
+ "was specified\n" ,
458
+ vers );
461
459
return - EINVAL ;
462
460
} else if (key .specified & AVTAB_XPERMS ) {
463
461
memset (& xperms , 0 , sizeof (struct avtab_extended_perms ));
@@ -471,7 +469,8 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
471
469
pr_err ("SELinux: avtab: truncated entry\n" );
472
470
return rc ;
473
471
}
474
- rc = next_entry (buf32 , fp , sizeof (u32 )* ARRAY_SIZE (xperms .perms .p ));
472
+ rc = next_entry (buf32 , fp ,
473
+ sizeof (u32 ) * ARRAY_SIZE (xperms .perms .p ));
475
474
if (rc ) {
476
475
pr_err ("SELinux: avtab: truncated entry\n" );
477
476
return rc ;
@@ -507,7 +506,6 @@ int avtab_read(struct avtab *a, void *fp, struct policydb *pol)
507
506
__le32 buf [1 ];
508
507
u32 nel , i ;
509
508
510
-
511
509
rc = next_entry (buf , fp , sizeof (u32 ));
512
510
if (rc < 0 ) {
513
511
pr_err ("SELinux: avtab: truncated table\n" );
@@ -561,7 +559,8 @@ int avtab_write_item(struct policydb *p, const struct avtab_node *cur, void *fp)
561
559
return rc ;
562
560
563
561
if (cur -> key .specified & AVTAB_XPERMS ) {
564
- rc = put_entry (& cur -> datum .u .xperms -> specified , sizeof (u8 ), 1 , fp );
562
+ rc = put_entry (& cur -> datum .u .xperms -> specified , sizeof (u8 ), 1 ,
563
+ fp );
565
564
if (rc )
566
565
return rc ;
567
566
rc = put_entry (& cur -> datum .u .xperms -> driver , sizeof (u8 ), 1 , fp );
@@ -570,7 +569,7 @@ int avtab_write_item(struct policydb *p, const struct avtab_node *cur, void *fp)
570
569
for (i = 0 ; i < ARRAY_SIZE (cur -> datum .u .xperms -> perms .p ); i ++ )
571
570
buf32 [i ] = cpu_to_le32 (cur -> datum .u .xperms -> perms .p [i ]);
572
571
rc = put_entry (buf32 , sizeof (u32 ),
573
- ARRAY_SIZE (cur -> datum .u .xperms -> perms .p ), fp );
572
+ ARRAY_SIZE (cur -> datum .u .xperms -> perms .p ), fp );
574
573
} else {
575
574
buf32 [0 ] = cpu_to_le32 (cur -> datum .u .data );
576
575
rc = put_entry (buf32 , sizeof (u32 ), 1 , fp );
@@ -593,8 +592,7 @@ int avtab_write(struct policydb *p, struct avtab *a, void *fp)
593
592
return rc ;
594
593
595
594
for (i = 0 ; i < a -> nslot ; i ++ ) {
596
- for (cur = a -> htable [i ]; cur ;
597
- cur = cur -> next ) {
595
+ for (cur = a -> htable [i ]; cur ; cur = cur -> next ) {
598
596
rc = avtab_write_item (p , cur , fp );
599
597
if (rc )
600
598
return rc ;
@@ -606,10 +604,9 @@ int avtab_write(struct policydb *p, struct avtab *a, void *fp)
606
604
607
605
void __init avtab_cache_init (void )
608
606
{
609
- avtab_node_cachep = kmem_cache_create ("avtab_node" ,
610
- sizeof (struct avtab_node ),
611
- 0 , SLAB_PANIC , NULL );
612
- avtab_xperms_cachep = kmem_cache_create ("avtab_extended_perms" ,
613
- sizeof (struct avtab_extended_perms ),
614
- 0 , SLAB_PANIC , NULL );
607
+ avtab_node_cachep = kmem_cache_create (
608
+ "avtab_node" , sizeof (struct avtab_node ), 0 , SLAB_PANIC , NULL );
609
+ avtab_xperms_cachep = kmem_cache_create (
610
+ "avtab_extended_perms" , sizeof (struct avtab_extended_perms ), 0 ,
611
+ SLAB_PANIC , NULL );
615
612
}
0 commit comments