]>
Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* |
2 | * NSA Security-Enhanced Linux (SELinux) security module | |
3 | * | |
4 | * This file contains the SELinux security data structures for kernel objects. | |
5 | * | |
7efbb60b | 6 | * Author(s): Stephen Smalley, <sds@tycho.nsa.gov> |
a936b79b EP |
7 | * Chris Vance, <cvance@nai.com> |
8 | * Wayne Salamon, <wsalamon@nai.com> | |
9 | * James Morris <jmorris@redhat.com> | |
1da177e4 LT |
10 | * |
11 | * Copyright (C) 2001,2002 Networks Associates Technology, Inc. | |
12 | * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> | |
3a976fa6 | 13 | * Copyright (C) 2016 Mellanox Technologies |
1da177e4 LT |
14 | * |
15 | * This program is free software; you can redistribute it and/or modify | |
16 | * it under the terms of the GNU General Public License version 2, | |
a936b79b | 17 | * as published by the Free Software Foundation. |
1da177e4 LT |
18 | */ |
19 | #ifndef _SELINUX_OBJSEC_H_ | |
20 | #define _SELINUX_OBJSEC_H_ | |
21 | ||
22 | #include <linux/list.h> | |
23 | #include <linux/sched.h> | |
24 | #include <linux/fs.h> | |
25 | #include <linux/binfmts.h> | |
26 | #include <linux/in.h> | |
9f2ad665 | 27 | #include <linux/spinlock.h> |
f1efc8c4 CS |
28 | #include <linux/lsm_hooks.h> |
29 | #include <linux/msg.h> | |
30 | #include <net/sock.h> | |
cbe0d6e8 | 31 | #include <net/net_namespace.h> |
1da177e4 LT |
32 | #include "flask.h" |
33 | #include "avc.h" | |
34 | ||
35 | struct task_security_struct { | |
a936b79b EP |
36 | u32 osid; /* SID prior to last execve */ |
37 | u32 sid; /* current SID */ | |
38 | u32 exec_sid; /* exec SID */ | |
39 | u32 create_sid; /* fscreate SID */ | |
40 | u32 keycreate_sid; /* keycreate SID */ | |
41 | u32 sockcreate_sid; /* fscreate SID */ | |
1da177e4 LT |
42 | }; |
43 | ||
be0554c9 SS |
44 | /* |
45 | * get the subjective security ID of the current task | |
46 | */ | |
47 | static inline u32 current_sid(void) | |
48 | { | |
49 | const struct task_security_struct *tsec = current_security(); | |
50 | ||
51 | return tsec->sid; | |
52 | } | |
53 | ||
6f3be9f5 | 54 | enum label_initialized { |
4b57d6bc | 55 | LABEL_INVALID, /* invalid or not initialized */ |
9287aed2 AG |
56 | LABEL_INITIALIZED, /* initialized */ |
57 | LABEL_PENDING | |
6f3be9f5 AG |
58 | }; |
59 | ||
1da177e4 | 60 | struct inode_security_struct { |
a936b79b | 61 | struct inode *inode; /* back pointer to inode object */ |
3dc91d43 SR |
62 | union { |
63 | struct list_head list; /* list of inode_security_struct */ | |
64 | struct rcu_head rcu; /* for freeing the inode_security_struct */ | |
65 | }; | |
a936b79b EP |
66 | u32 task_sid; /* SID of creating task */ |
67 | u32 sid; /* SID of this object */ | |
68 | u16 sclass; /* security class of this object */ | |
69 | unsigned char initialized; /* initialization flag */ | |
9287aed2 | 70 | spinlock_t lock; |
1da177e4 LT |
71 | }; |
72 | ||
73 | struct file_security_struct { | |
a936b79b EP |
74 | u32 sid; /* SID of open file description */ |
75 | u32 fown_sid; /* SID of file owner (for SIGIO) */ | |
76 | u32 isid; /* SID of inode at the time of file open */ | |
77 | u32 pseqno; /* Policy seqno at the time of file open */ | |
1da177e4 LT |
78 | }; |
79 | ||
80 | struct superblock_security_struct { | |
a936b79b | 81 | struct super_block *sb; /* back pointer to sb object */ |
c312feb2 | 82 | u32 sid; /* SID of file system superblock */ |
1da177e4 | 83 | u32 def_sid; /* default SID for labeling */ |
c312feb2 | 84 | u32 mntpoint_sid; /* SECURITY_FS_USE_MNTPOINT context for files */ |
f936c6e5 | 85 | unsigned short behavior; /* labeling behavior */ |
cfca0303 | 86 | unsigned short flags; /* which mount options were specified */ |
bc7e982b | 87 | struct mutex lock; |
1da177e4 LT |
88 | struct list_head isec_head; |
89 | spinlock_t isec_lock; | |
90 | }; | |
91 | ||
92 | struct msg_security_struct { | |
a936b79b | 93 | u32 sid; /* SID of message */ |
1da177e4 LT |
94 | }; |
95 | ||
96 | struct ipc_security_struct { | |
1da177e4 | 97 | u16 sclass; /* security class of this object */ |
a936b79b | 98 | u32 sid; /* SID of IPC resource */ |
1da177e4 LT |
99 | }; |
100 | ||
1da177e4 | 101 | struct netif_security_struct { |
cbe0d6e8 | 102 | struct net *ns; /* network namespace */ |
e8bfdb9d PM |
103 | int ifindex; /* device index */ |
104 | u32 sid; /* SID for this interface */ | |
1da177e4 LT |
105 | }; |
106 | ||
224dfbd8 PM |
107 | struct netnode_security_struct { |
108 | union { | |
109 | __be32 ipv4; /* IPv4 node address */ | |
110 | struct in6_addr ipv6; /* IPv6 node address */ | |
111 | } addr; | |
112 | u32 sid; /* SID for this node */ | |
113 | u16 family; /* address family */ | |
114 | }; | |
115 | ||
3e112172 PM |
116 | struct netport_security_struct { |
117 | u32 sid; /* SID for this node */ | |
118 | u16 port; /* port number */ | |
119 | u8 protocol; /* transport protocol */ | |
120 | }; | |
121 | ||
1da177e4 | 122 | struct sk_security_struct { |
220deb96 | 123 | #ifdef CONFIG_NETLABEL |
7420ed23 VY |
124 | enum { /* NetLabel state */ |
125 | NLBL_UNSET = 0, | |
126 | NLBL_REQUIRE, | |
127 | NLBL_LABELED, | |
948bf85c | 128 | NLBL_REQSKB, |
014ab19a | 129 | NLBL_CONNLABELED, |
7420ed23 | 130 | } nlbl_state; |
6c5b3fc0 | 131 | struct netlbl_lsm_secattr *nlbl_secattr; /* NetLabel sec attributes */ |
7420ed23 | 132 | #endif |
6c5b3fc0 PM |
133 | u32 sid; /* SID of this object */ |
134 | u32 peer_sid; /* SID of peer */ | |
135 | u16 sclass; /* sock security class */ | |
1da177e4 LT |
136 | }; |
137 | ||
5dbbaf2d PM |
138 | struct tun_security_struct { |
139 | u32 sid; /* SID for the tun device sockets */ | |
140 | }; | |
141 | ||
d720024e | 142 | struct key_security_struct { |
a936b79b | 143 | u32 sid; /* SID of key */ |
d720024e ML |
144 | }; |
145 | ||
3a976fa6 DJ |
146 | struct ib_security_struct { |
147 | u32 sid; /* SID of the queue pair or MAD agent */ | |
148 | }; | |
149 | ||
409dcf31 DJ |
150 | struct pkey_security_struct { |
151 | u64 subnet_prefix; /* Port subnet prefix */ | |
152 | u16 pkey; /* PKey number */ | |
153 | u32 sid; /* SID of pkey */ | |
154 | }; | |
155 | ||
ec27c356 CF |
156 | struct bpf_security_struct { |
157 | u32 sid; /*SID of bpf obj creater*/ | |
158 | }; | |
159 | ||
1da177e4 | 160 | extern unsigned int selinux_checkreqprot; |
f1efc8c4 CS |
161 | extern struct lsm_blob_sizes selinux_blob_sizes; |
162 | ||
163 | static inline struct task_security_struct *selinux_cred(const struct cred *cred) | |
164 | { | |
165 | return cred->security; | |
166 | } | |
1da177e4 | 167 | |
ab9b110b CS |
168 | static inline struct file_security_struct *selinux_file(const struct file *file) |
169 | { | |
170 | return file->f_security; | |
171 | } | |
172 | ||
1da177e4 | 173 | #endif /* _SELINUX_OBJSEC_H_ */ |