diff options
Diffstat (limited to 'security/selinux/avc.c')
-rw-r--r-- | security/selinux/avc.c | 78 |
1 files changed, 9 insertions, 69 deletions
diff --git a/security/selinux/avc.c b/security/selinux/avc.c index b4b5da1c0a42..f2dde268165a 100644 --- a/security/selinux/avc.c +++ b/security/selinux/avc.c | |||
@@ -31,43 +31,7 @@ | |||
31 | #include <net/ipv6.h> | 31 | #include <net/ipv6.h> |
32 | #include "avc.h" | 32 | #include "avc.h" |
33 | #include "avc_ss.h" | 33 | #include "avc_ss.h" |
34 | 34 | #include "classmap.h" | |
35 | static const struct av_perm_to_string av_perm_to_string[] = { | ||
36 | #define S_(c, v, s) { c, v, s }, | ||
37 | #include "av_perm_to_string.h" | ||
38 | #undef S_ | ||
39 | }; | ||
40 | |||
41 | static const char *class_to_string[] = { | ||
42 | #define S_(s) s, | ||
43 | #include "class_to_string.h" | ||
44 | #undef S_ | ||
45 | }; | ||
46 | |||
47 | #define TB_(s) static const char *s[] = { | ||
48 | #define TE_(s) }; | ||
49 | #define S_(s) s, | ||
50 | #include "common_perm_to_string.h" | ||
51 | #undef TB_ | ||
52 | #undef TE_ | ||
53 | #undef S_ | ||
54 | |||
55 | static const struct av_inherit av_inherit[] = { | ||
56 | #define S_(c, i, b) { .tclass = c,\ | ||
57 | .common_pts = common_##i##_perm_to_string,\ | ||
58 | .common_base = b }, | ||
59 | #include "av_inherit.h" | ||
60 | #undef S_ | ||
61 | }; | ||
62 | |||
63 | const struct selinux_class_perm selinux_class_perm = { | ||
64 | .av_perm_to_string = av_perm_to_string, | ||
65 | .av_pts_len = ARRAY_SIZE(av_perm_to_string), | ||
66 | .class_to_string = class_to_string, | ||
67 | .cts_len = ARRAY_SIZE(class_to_string), | ||
68 | .av_inherit = av_inherit, | ||
69 | .av_inherit_len = ARRAY_SIZE(av_inherit) | ||
70 | }; | ||
71 | 35 | ||
72 | #define AVC_CACHE_SLOTS 512 | 36 | #define AVC_CACHE_SLOTS 512 |
73 | #define AVC_DEF_CACHE_THRESHOLD 512 | 37 | #define AVC_DEF_CACHE_THRESHOLD 512 |
@@ -139,52 +103,28 @@ static inline int avc_hash(u32 ssid, u32 tsid, u16 tclass) | |||
139 | */ | 103 | */ |
140 | static void avc_dump_av(struct audit_buffer *ab, u16 tclass, u32 av) | 104 | static void avc_dump_av(struct audit_buffer *ab, u16 tclass, u32 av) |
141 | { | 105 | { |
142 | const char **common_pts = NULL; | 106 | const char **perms; |
143 | u32 common_base = 0; | 107 | int i, perm; |
144 | int i, i2, perm; | ||
145 | 108 | ||
146 | if (av == 0) { | 109 | if (av == 0) { |
147 | audit_log_format(ab, " null"); | 110 | audit_log_format(ab, " null"); |
148 | return; | 111 | return; |
149 | } | 112 | } |
150 | 113 | ||
151 | for (i = 0; i < ARRAY_SIZE(av_inherit); i++) { | 114 | perms = secclass_map[tclass-1].perms; |
152 | if (av_inherit[i].tclass == tclass) { | ||
153 | common_pts = av_inherit[i].common_pts; | ||
154 | common_base = av_inherit[i].common_base; | ||
155 | break; | ||
156 | } | ||
157 | } | ||
158 | 115 | ||
159 | audit_log_format(ab, " {"); | 116 | audit_log_format(ab, " {"); |
160 | i = 0; | 117 | i = 0; |
161 | perm = 1; | 118 | perm = 1; |
162 | while (perm < common_base) { | 119 | while (i < (sizeof(av) * 8)) { |
163 | if (perm & av) { | 120 | if ((perm & av) && perms[i]) { |
164 | audit_log_format(ab, " %s", common_pts[i]); | 121 | audit_log_format(ab, " %s", perms[i]); |
165 | av &= ~perm; | 122 | av &= ~perm; |
166 | } | 123 | } |
167 | i++; | 124 | i++; |
168 | perm <<= 1; | 125 | perm <<= 1; |
169 | } | 126 | } |
170 | 127 | ||
171 | while (i < sizeof(av) * 8) { | ||
172 | if (perm & av) { | ||
173 | for (i2 = 0; i2 < ARRAY_SIZE(av_perm_to_string); i2++) { | ||
174 | if ((av_perm_to_string[i2].tclass == tclass) && | ||
175 | (av_perm_to_string[i2].value == perm)) | ||
176 | break; | ||
177 | } | ||
178 | if (i2 < ARRAY_SIZE(av_perm_to_string)) { | ||
179 | audit_log_format(ab, " %s", | ||
180 | av_perm_to_string[i2].name); | ||
181 | av &= ~perm; | ||
182 | } | ||
183 | } | ||
184 | i++; | ||
185 | perm <<= 1; | ||
186 | } | ||
187 | |||
188 | if (av) | 128 | if (av) |
189 | audit_log_format(ab, " 0x%x", av); | 129 | audit_log_format(ab, " 0x%x", av); |
190 | 130 | ||
@@ -219,8 +159,8 @@ static void avc_dump_query(struct audit_buffer *ab, u32 ssid, u32 tsid, u16 tcla | |||
219 | kfree(scontext); | 159 | kfree(scontext); |
220 | } | 160 | } |
221 | 161 | ||
222 | BUG_ON(tclass >= ARRAY_SIZE(class_to_string) || !class_to_string[tclass]); | 162 | BUG_ON(tclass >= ARRAY_SIZE(secclass_map)); |
223 | audit_log_format(ab, " tclass=%s", class_to_string[tclass]); | 163 | audit_log_format(ab, " tclass=%s", secclass_map[tclass-1].name); |
224 | } | 164 | } |
225 | 165 | ||
226 | /** | 166 | /** |