1 /*
2  * Security server interface.
3  *
4  * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
5  *
6  */
7 
8 #ifndef _SELINUX_SECURITY_H_
9 #define _SELINUX_SECURITY_H_
10 
11 #include <linux/compiler.h>
12 #include <linux/dcache.h>
13 #include <linux/magic.h>
14 #include <linux/types.h>
15 #include "flask.h"
16 
17 #define SECSID_NULL			0x00000000 /* unspecified SID */
18 #define SECSID_WILD			0xffffffff /* wildcard SID */
19 #define SECCLASS_NULL			0x0000 /* no class */
20 
21 /* Identify specific policy version changes */
22 #define POLICYDB_VERSION_BASE		15
23 #define POLICYDB_VERSION_BOOL		16
24 #define POLICYDB_VERSION_IPV6		17
25 #define POLICYDB_VERSION_NLCLASS	18
26 #define POLICYDB_VERSION_VALIDATETRANS	19
27 #define POLICYDB_VERSION_MLS		19
28 #define POLICYDB_VERSION_AVTAB		20
29 #define POLICYDB_VERSION_RANGETRANS	21
30 #define POLICYDB_VERSION_POLCAP		22
31 #define POLICYDB_VERSION_PERMISSIVE	23
32 #define POLICYDB_VERSION_BOUNDARY	24
33 #define POLICYDB_VERSION_FILENAME_TRANS	25
34 #define POLICYDB_VERSION_ROLETRANS	26
35 #define POLICYDB_VERSION_NEW_OBJECT_DEFAULTS	27
36 #define POLICYDB_VERSION_DEFAULT_TYPE	28
37 #define POLICYDB_VERSION_CONSTRAINT_NAMES	29
38 
39 /* Range of policy versions we understand*/
40 #define POLICYDB_VERSION_MIN   POLICYDB_VERSION_BASE
41 #ifdef CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX
42 #define POLICYDB_VERSION_MAX	CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE
43 #else
44 #define POLICYDB_VERSION_MAX	POLICYDB_VERSION_CONSTRAINT_NAMES
45 #endif
46 
47 /* Mask for just the mount related flags */
48 #define SE_MNTMASK	0x0f
49 /* Super block security struct flags for mount options */
50 /* BE CAREFUL, these need to be the low order bits for selinux_get_mnt_opts */
51 #define CONTEXT_MNT	0x01
52 #define FSCONTEXT_MNT	0x02
53 #define ROOTCONTEXT_MNT	0x04
54 #define DEFCONTEXT_MNT	0x08
55 #define SBLABEL_MNT	0x10
56 /* Non-mount related flags */
57 #define SE_SBINITIALIZED	0x0100
58 #define SE_SBPROC		0x0200
59 #define SE_SBGENFS		0x0400
60 
61 #define CONTEXT_STR	"context="
62 #define FSCONTEXT_STR	"fscontext="
63 #define ROOTCONTEXT_STR	"rootcontext="
64 #define DEFCONTEXT_STR	"defcontext="
65 #define LABELSUPP_STR "seclabel"
66 
67 struct netlbl_lsm_secattr;
68 
69 extern int selinux_enabled;
70 
71 /* Policy capabilities */
72 enum {
73 	POLICYDB_CAPABILITY_NETPEER,
74 	POLICYDB_CAPABILITY_OPENPERM,
75 	POLICYDB_CAPABILITY_REDHAT1,
76 	POLICYDB_CAPABILITY_ALWAYSNETWORK,
77 	__POLICYDB_CAPABILITY_MAX
78 };
79 #define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
80 
81 extern int selinux_policycap_netpeer;
82 extern int selinux_policycap_openperm;
83 extern int selinux_policycap_alwaysnetwork;
84 
85 /*
86  * type_datum properties
87  * available at the kernel policy version >= POLICYDB_VERSION_BOUNDARY
88  */
89 #define TYPEDATUM_PROPERTY_PRIMARY	0x0001
90 #define TYPEDATUM_PROPERTY_ATTRIBUTE	0x0002
91 
92 /* limitation of boundary depth  */
93 #define POLICYDB_BOUNDS_MAXDEPTH	4
94 
95 int security_mls_enabled(void);
96 
97 int security_load_policy(void *data, size_t len);
98 int security_read_policy(void **data, size_t *len);
99 size_t security_policydb_len(void);
100 
101 int security_policycap_supported(unsigned int req_cap);
102 
103 #define SEL_VEC_MAX 32
104 struct av_decision {
105 	u32 allowed;
106 	u32 auditallow;
107 	u32 auditdeny;
108 	u32 seqno;
109 	u32 flags;
110 };
111 
112 /* definitions of av_decision.flags */
113 #define AVD_FLAGS_PERMISSIVE	0x0001
114 
115 void security_compute_av(u32 ssid, u32 tsid,
116 			 u16 tclass, struct av_decision *avd);
117 
118 void security_compute_av_user(u32 ssid, u32 tsid,
119 			     u16 tclass, struct av_decision *avd);
120 
121 int security_transition_sid(u32 ssid, u32 tsid, u16 tclass,
122 			    const struct qstr *qstr, u32 *out_sid);
123 
124 int security_transition_sid_user(u32 ssid, u32 tsid, u16 tclass,
125 				 const char *objname, u32 *out_sid);
126 
127 int security_member_sid(u32 ssid, u32 tsid,
128 	u16 tclass, u32 *out_sid);
129 
130 int security_change_sid(u32 ssid, u32 tsid,
131 	u16 tclass, u32 *out_sid);
132 
133 int security_sid_to_context(u32 sid, char **scontext,
134 	u32 *scontext_len);
135 
136 int security_sid_to_context_force(u32 sid, char **scontext, u32 *scontext_len);
137 
138 int security_context_to_sid(const char *scontext, u32 scontext_len,
139 			    u32 *out_sid, gfp_t gfp);
140 
141 int security_context_to_sid_default(const char *scontext, u32 scontext_len,
142 				    u32 *out_sid, u32 def_sid, gfp_t gfp_flags);
143 
144 int security_context_to_sid_force(const char *scontext, u32 scontext_len,
145 				  u32 *sid);
146 
147 int security_get_user_sids(u32 callsid, char *username,
148 			   u32 **sids, u32 *nel);
149 
150 int security_port_sid(u8 protocol, u16 port, u32 *out_sid);
151 
152 int security_netif_sid(char *name, u32 *if_sid);
153 
154 int security_node_sid(u16 domain, void *addr, u32 addrlen,
155 	u32 *out_sid);
156 
157 int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,
158 				 u16 tclass);
159 
160 int security_bounded_transition(u32 oldsid, u32 newsid);
161 
162 int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid);
163 
164 int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type,
165 				 u32 xfrm_sid,
166 				 u32 *peer_sid);
167 
168 int security_get_classes(char ***classes, int *nclasses);
169 int security_get_permissions(char *class, char ***perms, int *nperms);
170 int security_get_reject_unknown(void);
171 int security_get_allow_unknown(void);
172 
173 #define SECURITY_FS_USE_XATTR		1 /* use xattr */
174 #define SECURITY_FS_USE_TRANS		2 /* use transition SIDs, e.g. devpts/tmpfs */
175 #define SECURITY_FS_USE_TASK		3 /* use task SIDs, e.g. pipefs/sockfs */
176 #define SECURITY_FS_USE_GENFS		4 /* use the genfs support */
177 #define SECURITY_FS_USE_NONE		5 /* no labeling support */
178 #define SECURITY_FS_USE_MNTPOINT	6 /* use mountpoint labeling */
179 #define SECURITY_FS_USE_NATIVE		7 /* use native label support */
180 #define SECURITY_FS_USE_MAX		7 /* Highest SECURITY_FS_USE_XXX */
181 
182 int security_fs_use(struct super_block *sb);
183 
184 int security_genfs_sid(const char *fstype, char *name, u16 sclass,
185 	u32 *sid);
186 
187 #ifdef CONFIG_NETLABEL
188 int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
189 				   u32 *sid);
190 
191 int security_netlbl_sid_to_secattr(u32 sid,
192 				   struct netlbl_lsm_secattr *secattr);
193 #else
194 static inline int security_netlbl_secattr_to_sid(
195 					    struct netlbl_lsm_secattr *secattr,
196 					    u32 *sid)
197 {
198 	return -EIDRM;
199 }
200 
201 static inline int security_netlbl_sid_to_secattr(u32 sid,
202 					   struct netlbl_lsm_secattr *secattr)
203 {
204 	return -ENOENT;
205 }
206 #endif /* CONFIG_NETLABEL */
207 
208 const char *security_get_initial_sid_context(u32 sid);
209 
210 /*
211  * status notifier using mmap interface
212  */
213 extern struct page *selinux_kernel_status_page(void);
214 
215 #define SELINUX_KERNEL_STATUS_VERSION	1
216 struct selinux_kernel_status {
217 	u32	version;	/* version number of thie structure */
218 	u32	sequence;	/* sequence number of seqlock logic */
219 	u32	enforcing;	/* current setting of enforcing mode */
220 	u32	policyload;	/* times of policy reloaded */
221 	u32	deny_unknown;	/* current setting of deny_unknown */
222 	/*
223 	 * The version > 0 supports above members.
224 	 */
225 } __packed;
226 
227 extern void selinux_status_update_setenforce(int enforcing);
228 extern void selinux_status_update_policyload(int seqno);
229 extern void selinux_complete_init(void);
230 extern int selinux_disable(void);
231 extern void exit_sel_fs(void);
232 extern struct path selinux_null;
233 extern struct vfsmount *selinuxfs_mount;
234 extern void selnl_notify_setenforce(int val);
235 extern void selnl_notify_policyload(u32 seqno);
236 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
237 
238 #endif /* _SELINUX_SECURITY_H_ */
239 
240