1/* SPDX-License-Identifier: GPL-2.0-only */ 2/* 3 * NSA Security-Enhanced Linux (SELinux) security module 4 * 5 * This file contains the SELinux security data structures for kernel objects. 6 * 7 * Author(s): Stephen Smalley, <sds@tycho.nsa.gov> 8 * Chris Vance, <cvance@nai.com> 9 * Wayne Salamon, <wsalamon@nai.com> 10 * James Morris <jmorris@redhat.com> 11 * 12 * Copyright (C) 2001,2002 Networks Associates Technology, Inc. 13 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 14 * Copyright (C) 2016 Mellanox Technologies 15 */ 16#ifndef _SELINUX_OBJSEC_H_ 17#define _SELINUX_OBJSEC_H_ 18 19#include <linux/list.h> 20#include <linux/sched.h> 21#include <linux/fs.h> 22#include <linux/binfmts.h> 23#include <linux/in.h> 24#include <linux/spinlock.h> 25#include <linux/lsm_hooks.h> 26#include <linux/msg.h> 27#include <net/net_namespace.h> 28#include "flask.h" 29#include "avc.h" 30 31struct task_security_struct { 32 u32 osid; /* SID prior to last execve */ 33 u32 sid; /* current SID */ 34 u32 exec_sid; /* exec SID */ 35 u32 create_sid; /* fscreate SID */ 36 u32 keycreate_sid; /* keycreate SID */ 37 u32 sockcreate_sid; /* fscreate SID */ 38}; 39 40/* 41 * get the subjective security ID of the current task 42 */ 43static inline u32 current_sid(void) 44{ 45 const struct task_security_struct *tsec = current_security(); 46 47 return tsec->sid; 48} 49 50enum label_initialized { 51 LABEL_INVALID, /* invalid or not initialized */ 52 LABEL_INITIALIZED, /* initialized */ 53 LABEL_PENDING 54}; 55 56struct inode_security_struct { 57 struct inode *inode; /* back pointer to inode object */ 58 struct list_head list; /* list of inode_security_struct */ 59 u32 task_sid; /* SID of creating task */ 60 u32 sid; /* SID of this object */ 61 u16 sclass; /* security class of this object */ 62 unsigned char initialized; /* initialization flag */ 63 spinlock_t lock; 64}; 65 66struct file_security_struct { 67 u32 sid; /* SID of open file description */ 68 u32 fown_sid; /* SID of file owner (for SIGIO) */ 69 u32 isid; /* SID of inode at the time of file open */ 70 u32 pseqno; /* Policy seqno at the time of file open */ 71}; 72 73struct superblock_security_struct { 74 struct super_block *sb; /* back pointer to sb object */ 75 u32 sid; /* SID of file system superblock */ 76 u32 def_sid; /* default SID for labeling */ 77 u32 mntpoint_sid; /* SECURITY_FS_USE_MNTPOINT context for files */ 78 unsigned short behavior; /* labeling behavior */ 79 unsigned short flags; /* which mount options were specified */ 80 struct mutex lock; 81 struct list_head isec_head; 82 spinlock_t isec_lock; 83}; 84 85struct msg_security_struct { 86 u32 sid; /* SID of message */ 87}; 88 89struct ipc_security_struct { 90 u16 sclass; /* security class of this object */ 91 u32 sid; /* SID of IPC resource */ 92}; 93 94struct netif_security_struct { 95 struct net *ns; /* network namespace */ 96 int ifindex; /* device index */ 97 u32 sid; /* SID for this interface */ 98}; 99 100struct netnode_security_struct { 101 union { 102 __be32 ipv4; /* IPv4 node address */ 103 struct in6_addr ipv6; /* IPv6 node address */ 104 } addr; 105 u32 sid; /* SID for this node */ 106 u16 family; /* address family */ 107}; 108 109struct netport_security_struct { 110 u32 sid; /* SID for this node */ 111 u16 port; /* port number */ 112 u8 protocol; /* transport protocol */ 113}; 114 115struct sk_security_struct { 116#ifdef CONFIG_NETLABEL 117 enum { /* NetLabel state */ 118 NLBL_UNSET = 0, 119 NLBL_REQUIRE, 120 NLBL_LABELED, 121 NLBL_REQSKB, 122 NLBL_CONNLABELED, 123 } nlbl_state; 124 struct netlbl_lsm_secattr *nlbl_secattr; /* NetLabel sec attributes */ 125#endif 126 u32 sid; /* SID of this object */ 127 u32 peer_sid; /* SID of peer */ 128 u16 sclass; /* sock security class */ 129 enum { /* SCTP association state */ 130 SCTP_ASSOC_UNSET = 0, 131 SCTP_ASSOC_SET, 132 } sctp_assoc_state; 133}; 134 135struct tun_security_struct { 136 u32 sid; /* SID for the tun device sockets */ 137}; 138 139struct key_security_struct { 140 u32 sid; /* SID of key */ 141}; 142 143struct ib_security_struct { 144 u32 sid; /* SID of the queue pair or MAD agent */ 145}; 146 147struct pkey_security_struct { 148 u64 subnet_prefix; /* Port subnet prefix */ 149 u16 pkey; /* PKey number */ 150 u32 sid; /* SID of pkey */ 151}; 152 153struct bpf_security_struct { 154 u32 sid; /*SID of bpf obj creater*/ 155}; 156 157extern struct lsm_blob_sizes selinux_blob_sizes; 158static inline struct task_security_struct *selinux_cred(const struct cred *cred) 159{ 160 return cred->security + selinux_blob_sizes.lbs_cred; 161} 162 163static inline struct file_security_struct *selinux_file(const struct file *file) 164{ 165 return file->f_security + selinux_blob_sizes.lbs_file; 166} 167 168static inline struct inode_security_struct *selinux_inode( 169 const struct inode *inode) 170{ 171 if (unlikely(!inode->i_security)) 172 return NULL; 173 return inode->i_security + selinux_blob_sizes.lbs_inode; 174} 175 176static inline struct msg_security_struct *selinux_msg_msg( 177 const struct msg_msg *msg_msg) 178{ 179 return msg_msg->security + selinux_blob_sizes.lbs_msg_msg; 180} 181 182static inline struct ipc_security_struct *selinux_ipc( 183 const struct kern_ipc_perm *ipc) 184{ 185 return ipc->security + selinux_blob_sizes.lbs_ipc; 186} 187 188#endif /* _SELINUX_OBJSEC_H_ */ 189