1/* SPDX-License-Identifier: GPL-2.0-only */ 2/* 3 * Security-Enhanced Linux (SELinux) security module 4 * 5 * This file contains the SELinux security data structures for kernel objects. 6 * 7 * Author(s): Stephen Smalley, <stephen.smalley.work@gmail.com> 8 * Chris Vance, <cvance@nai.com> 9 * Wayne Salamon, <wsalamon@nai.com> 10 * James Morris <jmorris@redhat.com> 11 * 12 * Copyright (C) 2001,2002 Networks Associates Technology, Inc. 13 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 14 * Copyright (C) 2016 Mellanox Technologies 15 */ 16 17#ifndef _SELINUX_OBJSEC_H_ 18#define _SELINUX_OBJSEC_H_ 19 20#include <linux/list.h> 21#include <linux/sched.h> 22#include <linux/fs.h> 23#include <linux/binfmts.h> 24#include <linux/in.h> 25#include <linux/spinlock.h> 26#include <linux/lsm_hooks.h> 27#include <linux/msg.h> 28#include <net/net_namespace.h> 29#include "flask.h" 30#include "avc.h" 31 32struct task_security_struct { 33 u32 osid; /* SID prior to last execve */ 34 u32 sid; /* current SID */ 35 u32 exec_sid; /* exec SID */ 36 u32 create_sid; /* fscreate SID */ 37 u32 keycreate_sid; /* keycreate SID */ 38 u32 sockcreate_sid; /* fscreate SID */ 39} __randomize_layout; 40 41enum label_initialized { 42 LABEL_INVALID, /* invalid or not initialized */ 43 LABEL_INITIALIZED, /* initialized */ 44 LABEL_PENDING 45}; 46 47struct inode_security_struct { 48 struct inode *inode; /* back pointer to inode object */ 49 struct list_head list; /* list of inode_security_struct */ 50 u32 task_sid; /* SID of creating task */ 51 u32 sid; /* SID of this object */ 52 u16 sclass; /* security class of this object */ 53 unsigned char initialized; /* initialization flag */ 54 spinlock_t lock; 55}; 56 57struct file_security_struct { 58 u32 sid; /* SID of open file description */ 59 u32 fown_sid; /* SID of file owner (for SIGIO) */ 60 u32 isid; /* SID of inode at the time of file open */ 61 u32 pseqno; /* Policy seqno at the time of file open */ 62}; 63 64struct superblock_security_struct { 65 u32 sid; /* SID of file system superblock */ 66 u32 def_sid; /* default SID for labeling */ 67 u32 mntpoint_sid; /* SECURITY_FS_USE_MNTPOINT context for files */ 68 unsigned short behavior; /* labeling behavior */ 69 unsigned short flags; /* which mount options were specified */ 70 struct mutex lock; 71 struct list_head isec_head; 72 spinlock_t isec_lock; 73}; 74 75struct msg_security_struct { 76 u32 sid; /* SID of message */ 77}; 78 79struct ipc_security_struct { 80 u16 sclass; /* security class of this object */ 81 u32 sid; /* SID of IPC resource */ 82}; 83 84struct netif_security_struct { 85 struct net *ns; /* network namespace */ 86 int ifindex; /* device index */ 87 u32 sid; /* SID for this interface */ 88}; 89 90struct netnode_security_struct { 91 union { 92 __be32 ipv4; /* IPv4 node address */ 93 struct in6_addr ipv6; /* IPv6 node address */ 94 } addr; 95 u32 sid; /* SID for this node */ 96 u16 family; /* address family */ 97}; 98 99struct netport_security_struct { 100 u32 sid; /* SID for this node */ 101 u16 port; /* port number */ 102 u8 protocol; /* transport protocol */ 103}; 104 105struct sk_security_struct { 106#ifdef CONFIG_NETLABEL 107 enum { /* NetLabel state */ 108 NLBL_UNSET = 0, 109 NLBL_REQUIRE, 110 NLBL_LABELED, 111 NLBL_REQSKB, 112 NLBL_CONNLABELED, 113 } nlbl_state; 114 struct netlbl_lsm_secattr *nlbl_secattr; /* NetLabel sec attributes */ 115#endif 116 u32 sid; /* SID of this object */ 117 u32 peer_sid; /* SID of peer */ 118 u16 sclass; /* sock security class */ 119 enum { /* SCTP association state */ 120 SCTP_ASSOC_UNSET = 0, 121 SCTP_ASSOC_SET, 122 } sctp_assoc_state; 123}; 124 125struct tun_security_struct { 126 u32 sid; /* SID for the tun device sockets */ 127}; 128 129struct key_security_struct { 130 u32 sid; /* SID of key */ 131}; 132 133struct ib_security_struct { 134 u32 sid; /* SID of the queue pair or MAD agent */ 135}; 136 137struct pkey_security_struct { 138 u64 subnet_prefix; /* Port subnet prefix */ 139 u16 pkey; /* PKey number */ 140 u32 sid; /* SID of pkey */ 141}; 142 143struct bpf_security_struct { 144 u32 sid; /* SID of bpf obj creator */ 145}; 146 147struct perf_event_security_struct { 148 u32 sid; /* SID of perf_event obj creator */ 149}; 150 151extern struct lsm_blob_sizes selinux_blob_sizes; 152static inline struct task_security_struct *selinux_cred(const struct cred *cred) 153{ 154 return cred->security + selinux_blob_sizes.lbs_cred; 155} 156 157static inline struct file_security_struct *selinux_file(const struct file *file) 158{ 159 return file->f_security + selinux_blob_sizes.lbs_file; 160} 161 162static inline struct inode_security_struct * 163selinux_inode(const struct inode *inode) 164{ 165 if (unlikely(!inode->i_security)) 166 return NULL; 167 return inode->i_security + selinux_blob_sizes.lbs_inode; 168} 169 170static inline struct msg_security_struct * 171selinux_msg_msg(const struct msg_msg *msg_msg) 172{ 173 return msg_msg->security + selinux_blob_sizes.lbs_msg_msg; 174} 175 176static inline struct ipc_security_struct * 177selinux_ipc(const struct kern_ipc_perm *ipc) 178{ 179 return ipc->security + selinux_blob_sizes.lbs_ipc; 180} 181 182/* 183 * get the subjective security ID of the current task 184 */ 185static inline u32 current_sid(void) 186{ 187 const struct task_security_struct *tsec = selinux_cred(current_cred()); 188 189 return tsec->sid; 190} 191 192static inline struct superblock_security_struct * 193selinux_superblock(const struct super_block *superblock) 194{ 195 return superblock->s_security + selinux_blob_sizes.lbs_superblock; 196} 197 198#endif /* _SELINUX_OBJSEC_H_ */ 199