1 /* 2 * NSA Security-Enhanced Linux (SELinux) security module 3 * 4 * This file contains the SELinux security data structures for kernel objects. 5 * 6 * Author(s): Stephen Smalley, <sds@tycho.nsa.gov> 7 * Chris Vance, <cvance@nai.com> 8 * Wayne Salamon, <wsalamon@nai.com> 9 * James Morris <jmorris@redhat.com> 10 * 11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc. 12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 13 * Copyright (C) 2016 Mellanox Technologies 14 * 15 * This program is free software; you can redistribute it and/or modify 16 * it under the terms of the GNU General Public License version 2, 17 * as published by the Free Software Foundation. 18 */ 19 #ifndef _SELINUX_OBJSEC_H_ 20 #define _SELINUX_OBJSEC_H_ 21 22 #include <linux/list.h> 23 #include <linux/sched.h> 24 #include <linux/fs.h> 25 #include <linux/binfmts.h> 26 #include <linux/in.h> 27 #include <linux/spinlock.h> 28 #include <linux/lsm_hooks.h> 29 #include <linux/msg.h> 30 #include <net/net_namespace.h> 31 #include "flask.h" 32 #include "avc.h" 33 34 struct task_security_struct { 35 u32 osid; /* SID prior to last execve */ 36 u32 sid; /* current SID */ 37 u32 exec_sid; /* exec SID */ 38 u32 create_sid; /* fscreate SID */ 39 u32 keycreate_sid; /* keycreate SID */ 40 u32 sockcreate_sid; /* fscreate SID */ 41 }; 42 43 /* 44 * get the subjective security ID of the current task 45 */ 46 static inline u32 current_sid(void) 47 { 48 const struct task_security_struct *tsec = current_security(); 49 50 return tsec->sid; 51 } 52 53 enum label_initialized { 54 LABEL_INVALID, /* invalid or not initialized */ 55 LABEL_INITIALIZED, /* initialized */ 56 LABEL_PENDING 57 }; 58 59 struct inode_security_struct { 60 struct inode *inode; /* back pointer to inode object */ 61 struct list_head list; /* list of inode_security_struct */ 62 u32 task_sid; /* SID of creating task */ 63 u32 sid; /* SID of this object */ 64 u16 sclass; /* security class of this object */ 65 unsigned char initialized; /* initialization flag */ 66 spinlock_t lock; 67 }; 68 69 struct file_security_struct { 70 u32 sid; /* SID of open file description */ 71 u32 fown_sid; /* SID of file owner (for SIGIO) */ 72 u32 isid; /* SID of inode at the time of file open */ 73 u32 pseqno; /* Policy seqno at the time of file open */ 74 }; 75 76 struct superblock_security_struct { 77 struct super_block *sb; /* back pointer to sb object */ 78 u32 sid; /* SID of file system superblock */ 79 u32 def_sid; /* default SID for labeling */ 80 u32 mntpoint_sid; /* SECURITY_FS_USE_MNTPOINT context for files */ 81 unsigned short behavior; /* labeling behavior */ 82 unsigned short flags; /* which mount options were specified */ 83 struct mutex lock; 84 struct list_head isec_head; 85 spinlock_t isec_lock; 86 }; 87 88 struct msg_security_struct { 89 u32 sid; /* SID of message */ 90 }; 91 92 struct ipc_security_struct { 93 u16 sclass; /* security class of this object */ 94 u32 sid; /* SID of IPC resource */ 95 }; 96 97 struct netif_security_struct { 98 struct net *ns; /* network namespace */ 99 int ifindex; /* device index */ 100 u32 sid; /* SID for this interface */ 101 }; 102 103 struct netnode_security_struct { 104 union { 105 __be32 ipv4; /* IPv4 node address */ 106 struct in6_addr ipv6; /* IPv6 node address */ 107 } addr; 108 u32 sid; /* SID for this node */ 109 u16 family; /* address family */ 110 }; 111 112 struct netport_security_struct { 113 u32 sid; /* SID for this node */ 114 u16 port; /* port number */ 115 u8 protocol; /* transport protocol */ 116 }; 117 118 struct sk_security_struct { 119 #ifdef CONFIG_NETLABEL 120 enum { /* NetLabel state */ 121 NLBL_UNSET = 0, 122 NLBL_REQUIRE, 123 NLBL_LABELED, 124 NLBL_REQSKB, 125 NLBL_CONNLABELED, 126 } nlbl_state; 127 struct netlbl_lsm_secattr *nlbl_secattr; /* NetLabel sec attributes */ 128 #endif 129 u32 sid; /* SID of this object */ 130 u32 peer_sid; /* SID of peer */ 131 u16 sclass; /* sock security class */ 132 enum { /* SCTP association state */ 133 SCTP_ASSOC_UNSET = 0, 134 SCTP_ASSOC_SET, 135 } sctp_assoc_state; 136 }; 137 138 struct tun_security_struct { 139 u32 sid; /* SID for the tun device sockets */ 140 }; 141 142 struct key_security_struct { 143 u32 sid; /* SID of key */ 144 }; 145 146 struct ib_security_struct { 147 u32 sid; /* SID of the queue pair or MAD agent */ 148 }; 149 150 struct pkey_security_struct { 151 u64 subnet_prefix; /* Port subnet prefix */ 152 u16 pkey; /* PKey number */ 153 u32 sid; /* SID of pkey */ 154 }; 155 156 struct bpf_security_struct { 157 u32 sid; /*SID of bpf obj creater*/ 158 }; 159 160 extern struct lsm_blob_sizes selinux_blob_sizes; 161 static inline struct task_security_struct *selinux_cred(const struct cred *cred) 162 { 163 return cred->security + selinux_blob_sizes.lbs_cred; 164 } 165 166 static inline struct file_security_struct *selinux_file(const struct file *file) 167 { 168 return file->f_security + selinux_blob_sizes.lbs_file; 169 } 170 171 static inline struct inode_security_struct *selinux_inode( 172 const struct inode *inode) 173 { 174 if (unlikely(!inode->i_security)) 175 return NULL; 176 return inode->i_security + selinux_blob_sizes.lbs_inode; 177 } 178 179 static inline struct msg_security_struct *selinux_msg_msg( 180 const struct msg_msg *msg_msg) 181 { 182 return msg_msg->security + selinux_blob_sizes.lbs_msg_msg; 183 } 184 185 static inline struct ipc_security_struct *selinux_ipc( 186 const struct kern_ipc_perm *ipc) 187 { 188 return ipc->security + selinux_blob_sizes.lbs_ipc; 189 } 190 191 #endif /* _SELINUX_OBJSEC_H_ */ 192