11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * NSA Security-Enhanced Linux (SELinux) security module 31da177e4SLinus Torvalds * 41da177e4SLinus Torvalds * This file contains the SELinux security data structures for kernel objects. 51da177e4SLinus Torvalds * 61da177e4SLinus Torvalds * Author(s): Stephen Smalley, <sds@epoch.ncsc.mil> 71da177e4SLinus Torvalds * Chris Vance, <cvance@nai.com> 81da177e4SLinus Torvalds * Wayne Salamon, <wsalamon@nai.com> 91da177e4SLinus Torvalds * James Morris <jmorris@redhat.com> 101da177e4SLinus Torvalds * 111da177e4SLinus Torvalds * Copyright (C) 2001,2002 Networks Associates Technology, Inc. 121da177e4SLinus Torvalds * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 131da177e4SLinus Torvalds * 141da177e4SLinus Torvalds * This program is free software; you can redistribute it and/or modify 151da177e4SLinus Torvalds * it under the terms of the GNU General Public License version 2, 161da177e4SLinus Torvalds * as published by the Free Software Foundation. 171da177e4SLinus Torvalds */ 181da177e4SLinus Torvalds #ifndef _SELINUX_OBJSEC_H_ 191da177e4SLinus Torvalds #define _SELINUX_OBJSEC_H_ 201da177e4SLinus Torvalds 211da177e4SLinus Torvalds #include <linux/list.h> 221da177e4SLinus Torvalds #include <linux/sched.h> 231da177e4SLinus Torvalds #include <linux/fs.h> 241da177e4SLinus Torvalds #include <linux/binfmts.h> 251da177e4SLinus Torvalds #include <linux/in.h> 269f2ad665SPaul Moore #include <linux/spinlock.h> 27cbe0d6e8SPaul Moore #include <net/net_namespace.h> 281da177e4SLinus Torvalds #include "flask.h" 291da177e4SLinus Torvalds #include "avc.h" 301da177e4SLinus Torvalds 311da177e4SLinus Torvalds struct task_security_struct { 321da177e4SLinus Torvalds u32 osid; /* SID prior to last execve */ 331da177e4SLinus Torvalds u32 sid; /* current SID */ 341da177e4SLinus Torvalds u32 exec_sid; /* exec SID */ 351da177e4SLinus Torvalds u32 create_sid; /* fscreate SID */ 364eb582cfSMichael LeMay u32 keycreate_sid; /* keycreate SID */ 3742c3e03eSEric Paris u32 sockcreate_sid; /* fscreate SID */ 381da177e4SLinus Torvalds }; 391da177e4SLinus Torvalds 406f3be9f5SAndreas Gruenbacher enum label_initialized { 414b57d6bcSPaul Moore LABEL_INVALID, /* invalid or not initialized */ 42*9287aed2SAndreas Gruenbacher LABEL_INITIALIZED, /* initialized */ 43*9287aed2SAndreas Gruenbacher LABEL_PENDING 446f3be9f5SAndreas Gruenbacher }; 456f3be9f5SAndreas Gruenbacher 461da177e4SLinus Torvalds struct inode_security_struct { 471da177e4SLinus Torvalds struct inode *inode; /* back pointer to inode object */ 483dc91d43SSteven Rostedt union { 491da177e4SLinus Torvalds struct list_head list; /* list of inode_security_struct */ 503dc91d43SSteven Rostedt struct rcu_head rcu; /* for freeing the inode_security_struct */ 513dc91d43SSteven Rostedt }; 521da177e4SLinus Torvalds u32 task_sid; /* SID of creating task */ 531da177e4SLinus Torvalds u32 sid; /* SID of this object */ 541da177e4SLinus Torvalds u16 sclass; /* security class of this object */ 551da177e4SLinus Torvalds unsigned char initialized; /* initialization flag */ 56*9287aed2SAndreas Gruenbacher spinlock_t lock; 571da177e4SLinus Torvalds }; 581da177e4SLinus Torvalds 591da177e4SLinus Torvalds struct file_security_struct { 601da177e4SLinus Torvalds u32 sid; /* SID of open file description */ 611da177e4SLinus Torvalds u32 fown_sid; /* SID of file owner (for SIGIO) */ 62788e7dd4SYuichi Nakamura u32 isid; /* SID of inode at the time of file open */ 63788e7dd4SYuichi Nakamura u32 pseqno; /* Policy seqno at the time of file open */ 641da177e4SLinus Torvalds }; 651da177e4SLinus Torvalds 661da177e4SLinus Torvalds struct superblock_security_struct { 671da177e4SLinus Torvalds struct super_block *sb; /* back pointer to sb object */ 68c312feb2SEric Paris u32 sid; /* SID of file system superblock */ 691da177e4SLinus Torvalds u32 def_sid; /* default SID for labeling */ 70c312feb2SEric Paris u32 mntpoint_sid; /* SECURITY_FS_USE_MNTPOINT context for files */ 71f936c6e5SEric Paris unsigned short behavior; /* labeling behavior */ 72cfca0303SEric Paris unsigned short flags; /* which mount options were specified */ 73bc7e982bSEric Paris struct mutex lock; 741da177e4SLinus Torvalds struct list_head isec_head; 751da177e4SLinus Torvalds spinlock_t isec_lock; 761da177e4SLinus Torvalds }; 771da177e4SLinus Torvalds 781da177e4SLinus Torvalds struct msg_security_struct { 791da177e4SLinus Torvalds u32 sid; /* SID of message */ 801da177e4SLinus Torvalds }; 811da177e4SLinus Torvalds 821da177e4SLinus Torvalds struct ipc_security_struct { 831da177e4SLinus Torvalds u16 sclass; /* security class of this object */ 841da177e4SLinus Torvalds u32 sid; /* SID of IPC resource */ 851da177e4SLinus Torvalds }; 861da177e4SLinus Torvalds 871da177e4SLinus Torvalds struct netif_security_struct { 88cbe0d6e8SPaul Moore struct net *ns; /* network namespace */ 89e8bfdb9dSPaul Moore int ifindex; /* device index */ 90e8bfdb9dSPaul Moore u32 sid; /* SID for this interface */ 911da177e4SLinus Torvalds }; 921da177e4SLinus Torvalds 93224dfbd8SPaul Moore struct netnode_security_struct { 94224dfbd8SPaul Moore union { 95224dfbd8SPaul Moore __be32 ipv4; /* IPv4 node address */ 96224dfbd8SPaul Moore struct in6_addr ipv6; /* IPv6 node address */ 97224dfbd8SPaul Moore } addr; 98224dfbd8SPaul Moore u32 sid; /* SID for this node */ 99224dfbd8SPaul Moore u16 family; /* address family */ 100224dfbd8SPaul Moore }; 101224dfbd8SPaul Moore 1023e112172SPaul Moore struct netport_security_struct { 1033e112172SPaul Moore u32 sid; /* SID for this node */ 1043e112172SPaul Moore u16 port; /* port number */ 1053e112172SPaul Moore u8 protocol; /* transport protocol */ 1063e112172SPaul Moore }; 1073e112172SPaul Moore 1081da177e4SLinus Torvalds struct sk_security_struct { 109220deb96SPaul Moore #ifdef CONFIG_NETLABEL 1107420ed23SVenkat Yekkirala enum { /* NetLabel state */ 1117420ed23SVenkat Yekkirala NLBL_UNSET = 0, 1127420ed23SVenkat Yekkirala NLBL_REQUIRE, 1137420ed23SVenkat Yekkirala NLBL_LABELED, 114948bf85cSPaul Moore NLBL_REQSKB, 115014ab19aSPaul Moore NLBL_CONNLABELED, 1167420ed23SVenkat Yekkirala } nlbl_state; 1176c5b3fc0SPaul Moore struct netlbl_lsm_secattr *nlbl_secattr; /* NetLabel sec attributes */ 1187420ed23SVenkat Yekkirala #endif 1196c5b3fc0SPaul Moore u32 sid; /* SID of this object */ 1206c5b3fc0SPaul Moore u32 peer_sid; /* SID of peer */ 1216c5b3fc0SPaul Moore u16 sclass; /* sock security class */ 1221da177e4SLinus Torvalds }; 1231da177e4SLinus Torvalds 1245dbbaf2dSPaul Moore struct tun_security_struct { 1255dbbaf2dSPaul Moore u32 sid; /* SID for the tun device sockets */ 1265dbbaf2dSPaul Moore }; 1275dbbaf2dSPaul Moore 128d720024eSMichael LeMay struct key_security_struct { 129d720024eSMichael LeMay u32 sid; /* SID of key */ 130d720024eSMichael LeMay }; 131d720024eSMichael LeMay 1321da177e4SLinus Torvalds extern unsigned int selinux_checkreqprot; 1331da177e4SLinus Torvalds 1341da177e4SLinus Torvalds #endif /* _SELINUX_OBJSEC_H_ */ 135