1/* 2 * NSA Security-Enhanced Linux (SELinux) security module 3 * 4 * This file contains the SELinux security data structures for kernel objects. 5 * 6 * Author(s): Stephen Smalley, <sds@epoch.ncsc.mil> 7 * Chris Vance, <cvance@nai.com> 8 * Wayne Salamon, <wsalamon@nai.com> 9 * James Morris <jmorris@redhat.com> 10 * 11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc. 12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 13 * Copyright (C) 2016 Mellanox Technologies 14 * 15 * This program is free software; you can redistribute it and/or modify 16 * it under the terms of the GNU General Public License version 2, 17 * as published by the Free Software Foundation. 18 */ 19#ifndef _SELINUX_OBJSEC_H_ 20#define _SELINUX_OBJSEC_H_ 21 22#include <linux/list.h> 23#include <linux/sched.h> 24#include <linux/fs.h> 25#include <linux/binfmts.h> 26#include <linux/in.h> 27#include <linux/spinlock.h> 28#include <net/net_namespace.h> 29#include "flask.h" 30#include "avc.h" 31 32struct task_security_struct { 33 u32 osid; /* SID prior to last execve */ 34 u32 sid; /* current SID */ 35 u32 exec_sid; /* exec SID */ 36 u32 create_sid; /* fscreate SID */ 37 u32 keycreate_sid; /* keycreate SID */ 38 u32 sockcreate_sid; /* fscreate SID */ 39}; 40 41/* 42 * get the subjective security ID of the current task 43 */ 44static inline u32 current_sid(void) 45{ 46 const struct task_security_struct *tsec = current_security(); 47 48 return tsec->sid; 49} 50 51enum label_initialized { 52 LABEL_INVALID, /* invalid or not initialized */ 53 LABEL_INITIALIZED, /* initialized */ 54 LABEL_PENDING 55}; 56 57struct inode_security_struct { 58 struct inode *inode; /* back pointer to inode object */ 59 union { 60 struct list_head list; /* list of inode_security_struct */ 61 struct rcu_head rcu; /* for freeing the inode_security_struct */ 62 }; 63 u32 task_sid; /* SID of creating task */ 64 u32 sid; /* SID of this object */ 65 u16 sclass; /* security class of this object */ 66 unsigned char initialized; /* initialization flag */ 67 spinlock_t lock; 68}; 69 70struct file_security_struct { 71 u32 sid; /* SID of open file description */ 72 u32 fown_sid; /* SID of file owner (for SIGIO) */ 73 u32 isid; /* SID of inode at the time of file open */ 74 u32 pseqno; /* Policy seqno at the time of file open */ 75}; 76 77struct superblock_security_struct { 78 struct super_block *sb; /* back pointer to sb object */ 79 u32 sid; /* SID of file system superblock */ 80 u32 def_sid; /* default SID for labeling */ 81 u32 mntpoint_sid; /* SECURITY_FS_USE_MNTPOINT context for files */ 82 unsigned short behavior; /* labeling behavior */ 83 unsigned short flags; /* which mount options were specified */ 84 struct mutex lock; 85 struct list_head isec_head; 86 spinlock_t isec_lock; 87}; 88 89struct msg_security_struct { 90 u32 sid; /* SID of message */ 91}; 92 93struct ipc_security_struct { 94 u16 sclass; /* security class of this object */ 95 u32 sid; /* SID of IPC resource */ 96}; 97 98struct netif_security_struct { 99 struct net *ns; /* network namespace */ 100 int ifindex; /* device index */ 101 u32 sid; /* SID for this interface */ 102}; 103 104struct netnode_security_struct { 105 union { 106 __be32 ipv4; /* IPv4 node address */ 107 struct in6_addr ipv6; /* IPv6 node address */ 108 } addr; 109 u32 sid; /* SID for this node */ 110 u16 family; /* address family */ 111}; 112 113struct netport_security_struct { 114 u32 sid; /* SID for this node */ 115 u16 port; /* port number */ 116 u8 protocol; /* transport protocol */ 117}; 118 119struct sk_security_struct { 120#ifdef CONFIG_NETLABEL 121 enum { /* NetLabel state */ 122 NLBL_UNSET = 0, 123 NLBL_REQUIRE, 124 NLBL_LABELED, 125 NLBL_REQSKB, 126 NLBL_CONNLABELED, 127 } nlbl_state; 128 struct netlbl_lsm_secattr *nlbl_secattr; /* NetLabel sec attributes */ 129#endif 130 u32 sid; /* SID of this object */ 131 u32 peer_sid; /* SID of peer */ 132 u16 sclass; /* sock security class */ 133}; 134 135struct tun_security_struct { 136 u32 sid; /* SID for the tun device sockets */ 137}; 138 139struct key_security_struct { 140 u32 sid; /* SID of key */ 141}; 142 143struct ib_security_struct { 144 u32 sid; /* SID of the queue pair or MAD agent */ 145}; 146 147struct pkey_security_struct { 148 u64 subnet_prefix; /* Port subnet prefix */ 149 u16 pkey; /* PKey number */ 150 u32 sid; /* SID of pkey */ 151}; 152 153extern unsigned int selinux_checkreqprot; 154 155#endif /* _SELINUX_OBJSEC_H_ */ 156