1 /*
2  *  NSA Security-Enhanced Linux (SELinux) security module
3  *
4  *  This file contains the SELinux security data structures for kernel objects.
5  *
6  *  Author(s):  Stephen Smalley, <sds@tycho.nsa.gov>
7  *		Chris Vance, <cvance@nai.com>
8  *		Wayne Salamon, <wsalamon@nai.com>
9  *		James Morris <jmorris@redhat.com>
10  *
11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13  *  Copyright (C) 2016 Mellanox Technologies
14  *
15  *	This program is free software; you can redistribute it and/or modify
16  *	it under the terms of the GNU General Public License version 2,
17  *	as published by the Free Software Foundation.
18  */
19 #ifndef _SELINUX_OBJSEC_H_
20 #define _SELINUX_OBJSEC_H_
21 
22 #include <linux/list.h>
23 #include <linux/sched.h>
24 #include <linux/fs.h>
25 #include <linux/binfmts.h>
26 #include <linux/in.h>
27 #include <linux/spinlock.h>
28 #include <linux/lsm_hooks.h>
29 #include <linux/msg.h>
30 #include <net/net_namespace.h>
31 #include "flask.h"
32 #include "avc.h"
33 
34 struct task_security_struct {
35 	u32 osid;		/* SID prior to last execve */
36 	u32 sid;		/* current SID */
37 	u32 exec_sid;		/* exec SID */
38 	u32 create_sid;		/* fscreate SID */
39 	u32 keycreate_sid;	/* keycreate SID */
40 	u32 sockcreate_sid;	/* fscreate SID */
41 };
42 
43 /*
44  * get the subjective security ID of the current task
45  */
46 static inline u32 current_sid(void)
47 {
48 	const struct task_security_struct *tsec = current_security();
49 
50 	return tsec->sid;
51 }
52 
53 enum label_initialized {
54 	LABEL_INVALID,		/* invalid or not initialized */
55 	LABEL_INITIALIZED,	/* initialized */
56 	LABEL_PENDING
57 };
58 
59 struct inode_security_struct {
60 	struct inode *inode;	/* back pointer to inode object */
61 	struct list_head list;	/* list of inode_security_struct */
62 	u32 task_sid;		/* SID of creating task */
63 	u32 sid;		/* SID of this object */
64 	u16 sclass;		/* security class of this object */
65 	unsigned char initialized;	/* initialization flag */
66 	spinlock_t lock;
67 };
68 
69 struct file_security_struct {
70 	u32 sid;		/* SID of open file description */
71 	u32 fown_sid;		/* SID of file owner (for SIGIO) */
72 	u32 isid;		/* SID of inode at the time of file open */
73 	u32 pseqno;		/* Policy seqno at the time of file open */
74 };
75 
76 struct superblock_security_struct {
77 	struct super_block *sb;		/* back pointer to sb object */
78 	u32 sid;			/* SID of file system superblock */
79 	u32 def_sid;			/* default SID for labeling */
80 	u32 mntpoint_sid;		/* SECURITY_FS_USE_MNTPOINT context for files */
81 	unsigned short behavior;	/* labeling behavior */
82 	unsigned short flags;		/* which mount options were specified */
83 	struct mutex lock;
84 	struct list_head isec_head;
85 	spinlock_t isec_lock;
86 };
87 
88 struct msg_security_struct {
89 	u32 sid;	/* SID of message */
90 };
91 
92 struct ipc_security_struct {
93 	u16 sclass;	/* security class of this object */
94 	u32 sid;	/* SID of IPC resource */
95 };
96 
97 struct netif_security_struct {
98 	struct net *ns;			/* network namespace */
99 	int ifindex;			/* device index */
100 	u32 sid;			/* SID for this interface */
101 };
102 
103 struct netnode_security_struct {
104 	union {
105 		__be32 ipv4;		/* IPv4 node address */
106 		struct in6_addr ipv6;	/* IPv6 node address */
107 	} addr;
108 	u32 sid;			/* SID for this node */
109 	u16 family;			/* address family */
110 };
111 
112 struct netport_security_struct {
113 	u32 sid;			/* SID for this node */
114 	u16 port;			/* port number */
115 	u8 protocol;			/* transport protocol */
116 };
117 
118 struct sk_security_struct {
119 #ifdef CONFIG_NETLABEL
120 	enum {				/* NetLabel state */
121 		NLBL_UNSET = 0,
122 		NLBL_REQUIRE,
123 		NLBL_LABELED,
124 		NLBL_REQSKB,
125 		NLBL_CONNLABELED,
126 	} nlbl_state;
127 	struct netlbl_lsm_secattr *nlbl_secattr; /* NetLabel sec attributes */
128 #endif
129 	u32 sid;			/* SID of this object */
130 	u32 peer_sid;			/* SID of peer */
131 	u16 sclass;			/* sock security class */
132 	enum {				/* SCTP association state */
133 		SCTP_ASSOC_UNSET = 0,
134 		SCTP_ASSOC_SET,
135 	} sctp_assoc_state;
136 };
137 
138 struct tun_security_struct {
139 	u32 sid;			/* SID for the tun device sockets */
140 };
141 
142 struct key_security_struct {
143 	u32 sid;	/* SID of key */
144 };
145 
146 struct ib_security_struct {
147 	u32 sid;        /* SID of the queue pair or MAD agent */
148 };
149 
150 struct pkey_security_struct {
151 	u64	subnet_prefix; /* Port subnet prefix */
152 	u16	pkey;	/* PKey number */
153 	u32	sid;	/* SID of pkey */
154 };
155 
156 struct bpf_security_struct {
157 	u32 sid;  /*SID of bpf obj creater*/
158 };
159 
160 extern struct lsm_blob_sizes selinux_blob_sizes;
161 static inline struct task_security_struct *selinux_cred(const struct cred *cred)
162 {
163 	return cred->security + selinux_blob_sizes.lbs_cred;
164 }
165 
166 static inline struct file_security_struct *selinux_file(const struct file *file)
167 {
168 	return file->f_security + selinux_blob_sizes.lbs_file;
169 }
170 
171 static inline struct inode_security_struct *selinux_inode(
172 						const struct inode *inode)
173 {
174 	if (unlikely(!inode->i_security))
175 		return NULL;
176 	return inode->i_security + selinux_blob_sizes.lbs_inode;
177 }
178 
179 static inline struct msg_security_struct *selinux_msg_msg(
180 						const struct msg_msg *msg_msg)
181 {
182 	return msg_msg->security + selinux_blob_sizes.lbs_msg_msg;
183 }
184 
185 static inline struct ipc_security_struct *selinux_ipc(
186 						const struct kern_ipc_perm *ipc)
187 {
188 	return ipc->security + selinux_blob_sizes.lbs_ipc;
189 }
190 
191 #endif /* _SELINUX_OBJSEC_H_ */
192