]>
Commit | Line | Data |
---|---|---|
d2912cb1 | 1 | /* SPDX-License-Identifier: GPL-2.0-only */ |
1da177e4 LT |
2 | /* |
3 | * NSA Security-Enhanced Linux (SELinux) security module | |
4 | * | |
5 | * This file contains the SELinux security data structures for kernel objects. | |
6 | * | |
7efbb60b | 7 | * Author(s): Stephen Smalley, <sds@tycho.nsa.gov> |
a936b79b EP |
8 | * Chris Vance, <cvance@nai.com> |
9 | * Wayne Salamon, <wsalamon@nai.com> | |
10 | * James Morris <jmorris@redhat.com> | |
1da177e4 LT |
11 | * |
12 | * Copyright (C) 2001,2002 Networks Associates Technology, Inc. | |
13 | * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> | |
3a976fa6 | 14 | * Copyright (C) 2016 Mellanox Technologies |
1da177e4 LT |
15 | */ |
16 | #ifndef _SELINUX_OBJSEC_H_ | |
17 | #define _SELINUX_OBJSEC_H_ | |
18 | ||
19 | #include <linux/list.h> | |
20 | #include <linux/sched.h> | |
21 | #include <linux/fs.h> | |
22 | #include <linux/binfmts.h> | |
23 | #include <linux/in.h> | |
9f2ad665 | 24 | #include <linux/spinlock.h> |
bbd3662a | 25 | #include <linux/lsm_hooks.h> |
7c653828 | 26 | #include <linux/msg.h> |
cbe0d6e8 | 27 | #include <net/net_namespace.h> |
1da177e4 LT |
28 | #include "flask.h" |
29 | #include "avc.h" | |
30 | ||
31 | struct task_security_struct { | |
a936b79b EP |
32 | u32 osid; /* SID prior to last execve */ |
33 | u32 sid; /* current SID */ | |
34 | u32 exec_sid; /* exec SID */ | |
35 | u32 create_sid; /* fscreate SID */ | |
36 | u32 keycreate_sid; /* keycreate SID */ | |
37 | u32 sockcreate_sid; /* fscreate SID */ | |
5c108d4e | 38 | } __randomize_layout; |
1da177e4 | 39 | |
6f3be9f5 | 40 | enum label_initialized { |
4b57d6bc | 41 | LABEL_INVALID, /* invalid or not initialized */ |
9287aed2 AG |
42 | LABEL_INITIALIZED, /* initialized */ |
43 | LABEL_PENDING | |
6f3be9f5 AG |
44 | }; |
45 | ||
1da177e4 | 46 | struct inode_security_struct { |
a936b79b | 47 | struct inode *inode; /* back pointer to inode object */ |
afb1cbe3 | 48 | struct list_head list; /* list of inode_security_struct */ |
a936b79b EP |
49 | u32 task_sid; /* SID of creating task */ |
50 | u32 sid; /* SID of this object */ | |
51 | u16 sclass; /* security class of this object */ | |
52 | unsigned char initialized; /* initialization flag */ | |
9287aed2 | 53 | spinlock_t lock; |
1da177e4 LT |
54 | }; |
55 | ||
56 | struct file_security_struct { | |
a936b79b EP |
57 | u32 sid; /* SID of open file description */ |
58 | u32 fown_sid; /* SID of file owner (for SIGIO) */ | |
59 | u32 isid; /* SID of inode at the time of file open */ | |
60 | u32 pseqno; /* Policy seqno at the time of file open */ | |
1da177e4 LT |
61 | }; |
62 | ||
63 | struct superblock_security_struct { | |
c312feb2 | 64 | u32 sid; /* SID of file system superblock */ |
1da177e4 | 65 | u32 def_sid; /* default SID for labeling */ |
c312feb2 | 66 | u32 mntpoint_sid; /* SECURITY_FS_USE_MNTPOINT context for files */ |
f936c6e5 | 67 | unsigned short behavior; /* labeling behavior */ |
cfca0303 | 68 | unsigned short flags; /* which mount options were specified */ |
bc7e982b | 69 | struct mutex lock; |
1da177e4 LT |
70 | struct list_head isec_head; |
71 | spinlock_t isec_lock; | |
72 | }; | |
73 | ||
74 | struct msg_security_struct { | |
a936b79b | 75 | u32 sid; /* SID of message */ |
1da177e4 LT |
76 | }; |
77 | ||
78 | struct ipc_security_struct { | |
1da177e4 | 79 | u16 sclass; /* security class of this object */ |
a936b79b | 80 | u32 sid; /* SID of IPC resource */ |
1da177e4 LT |
81 | }; |
82 | ||
1da177e4 | 83 | struct netif_security_struct { |
cbe0d6e8 | 84 | struct net *ns; /* network namespace */ |
e8bfdb9d PM |
85 | int ifindex; /* device index */ |
86 | u32 sid; /* SID for this interface */ | |
1da177e4 LT |
87 | }; |
88 | ||
224dfbd8 PM |
89 | struct netnode_security_struct { |
90 | union { | |
91 | __be32 ipv4; /* IPv4 node address */ | |
92 | struct in6_addr ipv6; /* IPv6 node address */ | |
93 | } addr; | |
94 | u32 sid; /* SID for this node */ | |
95 | u16 family; /* address family */ | |
96 | }; | |
97 | ||
3e112172 PM |
98 | struct netport_security_struct { |
99 | u32 sid; /* SID for this node */ | |
100 | u16 port; /* port number */ | |
101 | u8 protocol; /* transport protocol */ | |
102 | }; | |
103 | ||
1da177e4 | 104 | struct sk_security_struct { |
220deb96 | 105 | #ifdef CONFIG_NETLABEL |
7420ed23 VY |
106 | enum { /* NetLabel state */ |
107 | NLBL_UNSET = 0, | |
108 | NLBL_REQUIRE, | |
109 | NLBL_LABELED, | |
948bf85c | 110 | NLBL_REQSKB, |
014ab19a | 111 | NLBL_CONNLABELED, |
7420ed23 | 112 | } nlbl_state; |
6c5b3fc0 | 113 | struct netlbl_lsm_secattr *nlbl_secattr; /* NetLabel sec attributes */ |
7420ed23 | 114 | #endif |
6c5b3fc0 PM |
115 | u32 sid; /* SID of this object */ |
116 | u32 peer_sid; /* SID of peer */ | |
117 | u16 sclass; /* sock security class */ | |
d452930f RH |
118 | enum { /* SCTP association state */ |
119 | SCTP_ASSOC_UNSET = 0, | |
120 | SCTP_ASSOC_SET, | |
121 | } sctp_assoc_state; | |
1da177e4 LT |
122 | }; |
123 | ||
5dbbaf2d PM |
124 | struct tun_security_struct { |
125 | u32 sid; /* SID for the tun device sockets */ | |
126 | }; | |
127 | ||
d720024e | 128 | struct key_security_struct { |
a936b79b | 129 | u32 sid; /* SID of key */ |
d720024e ML |
130 | }; |
131 | ||
3a976fa6 DJ |
132 | struct ib_security_struct { |
133 | u32 sid; /* SID of the queue pair or MAD agent */ | |
134 | }; | |
135 | ||
409dcf31 DJ |
136 | struct pkey_security_struct { |
137 | u64 subnet_prefix; /* Port subnet prefix */ | |
138 | u16 pkey; /* PKey number */ | |
139 | u32 sid; /* SID of pkey */ | |
140 | }; | |
141 | ||
ec27c356 | 142 | struct bpf_security_struct { |
da97e184 JFG |
143 | u32 sid; /* SID of bpf obj creator */ |
144 | }; | |
145 | ||
146 | struct perf_event_security_struct { | |
147 | u32 sid; /* SID of perf_event obj creator */ | |
ec27c356 CF |
148 | }; |
149 | ||
bbd3662a | 150 | extern struct lsm_blob_sizes selinux_blob_sizes; |
0c6cfa62 CS |
151 | static inline struct task_security_struct *selinux_cred(const struct cred *cred) |
152 | { | |
bbd3662a | 153 | return cred->security + selinux_blob_sizes.lbs_cred; |
0c6cfa62 CS |
154 | } |
155 | ||
bb6c6b02 CS |
156 | static inline struct file_security_struct *selinux_file(const struct file *file) |
157 | { | |
33bf60ca | 158 | return file->f_security + selinux_blob_sizes.lbs_file; |
bb6c6b02 CS |
159 | } |
160 | ||
80788c22 CS |
161 | static inline struct inode_security_struct *selinux_inode( |
162 | const struct inode *inode) | |
163 | { | |
afb1cbe3 CS |
164 | if (unlikely(!inode->i_security)) |
165 | return NULL; | |
166 | return inode->i_security + selinux_blob_sizes.lbs_inode; | |
80788c22 CS |
167 | } |
168 | ||
7c653828 CS |
169 | static inline struct msg_security_struct *selinux_msg_msg( |
170 | const struct msg_msg *msg_msg) | |
171 | { | |
ecd5f82e | 172 | return msg_msg->security + selinux_blob_sizes.lbs_msg_msg; |
7c653828 CS |
173 | } |
174 | ||
175 | static inline struct ipc_security_struct *selinux_ipc( | |
176 | const struct kern_ipc_perm *ipc) | |
177 | { | |
ecd5f82e | 178 | return ipc->security + selinux_blob_sizes.lbs_ipc; |
7c653828 CS |
179 | } |
180 | ||
169ce0c0 SS |
181 | /* |
182 | * get the subjective security ID of the current task | |
183 | */ | |
184 | static inline u32 current_sid(void) | |
185 | { | |
186 | const struct task_security_struct *tsec = selinux_cred(current_cred()); | |
187 | ||
188 | return tsec->sid; | |
189 | } | |
190 | ||
1aea7808 CS |
191 | static inline struct superblock_security_struct *selinux_superblock( |
192 | const struct super_block *superblock) | |
193 | { | |
194 | return superblock->s_security + selinux_blob_sizes.lbs_superblock; | |
195 | } | |
196 | ||
12ddb08a CS |
197 | static inline struct sk_security_struct *selinux_sock(const struct sock *sock) |
198 | { | |
199 | return sock->sk_security + selinux_blob_sizes.lbs_sock; | |
200 | } | |
201 | ||
1da177e4 | 202 | #endif /* _SELINUX_OBJSEC_H_ */ |