1/* 2 * NSA Security-Enhanced Linux (SELinux) security module 3 * 4 * This file contains the SELinux security data structures for kernel objects. 5 * 6 * Author(s): Stephen Smalley, <sds@epoch.ncsc.mil> 7 * Chris Vance, <cvance@nai.com> 8 * Wayne Salamon, <wsalamon@nai.com> 9 * James Morris <jmorris@redhat.com> 10 * 11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc. 12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 13 * 14 * This program is free software; you can redistribute it and/or modify 15 * it under the terms of the GNU General Public License version 2, 16 * as published by the Free Software Foundation. 17 */ 18#ifndef _SELINUX_OBJSEC_H_ 19#define _SELINUX_OBJSEC_H_ 20 21#include <linux/list.h> 22#include <linux/sched.h> 23#include <linux/fs.h> 24#include <linux/binfmts.h> 25#include <linux/in.h> 26#include <linux/spinlock.h> 27#include <net/net_namespace.h> 28#include "flask.h" 29#include "avc.h" 30 31struct task_security_struct { 32 u32 osid; /* SID prior to last execve */ 33 u32 sid; /* current SID */ 34 u32 exec_sid; /* exec SID */ 35 u32 create_sid; /* fscreate SID */ 36 u32 keycreate_sid; /* keycreate SID */ 37 u32 sockcreate_sid; /* fscreate SID */ 38}; 39 40enum label_initialized { 41 LABEL_INVALID, /* invalid or not initialized */ 42 LABEL_INITIALIZED, /* initialized */ 43 LABEL_PENDING 44}; 45 46struct inode_security_struct { 47 struct inode *inode; /* back pointer to inode object */ 48 union { 49 struct list_head list; /* list of inode_security_struct */ 50 struct rcu_head rcu; /* for freeing the inode_security_struct */ 51 }; 52 u32 task_sid; /* SID of creating task */ 53 u32 sid; /* SID of this object */ 54 u16 sclass; /* security class of this object */ 55 unsigned char initialized; /* initialization flag */ 56 spinlock_t lock; 57}; 58 59struct file_security_struct { 60 u32 sid; /* SID of open file description */ 61 u32 fown_sid; /* SID of file owner (for SIGIO) */ 62 u32 isid; /* SID of inode at the time of file open */ 63 u32 pseqno; /* Policy seqno at the time of file open */ 64}; 65 66struct superblock_security_struct { 67 struct super_block *sb; /* back pointer to sb object */ 68 u32 sid; /* SID of file system superblock */ 69 u32 def_sid; /* default SID for labeling */ 70 u32 mntpoint_sid; /* SECURITY_FS_USE_MNTPOINT context for files */ 71 unsigned short behavior; /* labeling behavior */ 72 unsigned short flags; /* which mount options were specified */ 73 struct mutex lock; 74 struct list_head isec_head; 75 spinlock_t isec_lock; 76}; 77 78struct msg_security_struct { 79 u32 sid; /* SID of message */ 80}; 81 82struct ipc_security_struct { 83 u16 sclass; /* security class of this object */ 84 u32 sid; /* SID of IPC resource */ 85}; 86 87struct netif_security_struct { 88 struct net *ns; /* network namespace */ 89 int ifindex; /* device index */ 90 u32 sid; /* SID for this interface */ 91}; 92 93struct netnode_security_struct { 94 union { 95 __be32 ipv4; /* IPv4 node address */ 96 struct in6_addr ipv6; /* IPv6 node address */ 97 } addr; 98 u32 sid; /* SID for this node */ 99 u16 family; /* address family */ 100}; 101 102struct netport_security_struct { 103 u32 sid; /* SID for this node */ 104 u16 port; /* port number */ 105 u8 protocol; /* transport protocol */ 106}; 107 108struct sk_security_struct { 109#ifdef CONFIG_NETLABEL 110 enum { /* NetLabel state */ 111 NLBL_UNSET = 0, 112 NLBL_REQUIRE, 113 NLBL_LABELED, 114 NLBL_REQSKB, 115 NLBL_CONNLABELED, 116 } nlbl_state; 117 struct netlbl_lsm_secattr *nlbl_secattr; /* NetLabel sec attributes */ 118#endif 119 u32 sid; /* SID of this object */ 120 u32 peer_sid; /* SID of peer */ 121 u16 sclass; /* sock security class */ 122}; 123 124struct tun_security_struct { 125 u32 sid; /* SID for the tun device sockets */ 126}; 127 128struct key_security_struct { 129 u32 sid; /* SID of key */ 130}; 131 132extern unsigned int selinux_checkreqprot; 133 134#endif /* _SELINUX_OBJSEC_H_ */ 135