1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * NSA Security-Enhanced Linux (SELinux) security module 4 * 5 * This file contains the SELinux security data structures for kernel objects. 6 * 7 * Author(s): Stephen Smalley, <sds@tycho.nsa.gov> 8 * Chris Vance, <cvance@nai.com> 9 * Wayne Salamon, <wsalamon@nai.com> 10 * James Morris <jmorris@redhat.com> 11 * 12 * Copyright (C) 2001,2002 Networks Associates Technology, Inc. 13 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 14 * Copyright (C) 2016 Mellanox Technologies 15 */ 16 #ifndef _SELINUX_OBJSEC_H_ 17 #define _SELINUX_OBJSEC_H_ 18 19 #include <linux/list.h> 20 #include <linux/sched.h> 21 #include <linux/fs.h> 22 #include <linux/binfmts.h> 23 #include <linux/in.h> 24 #include <linux/spinlock.h> 25 #include <linux/lsm_hooks.h> 26 #include <linux/msg.h> 27 #include <net/net_namespace.h> 28 #include "flask.h" 29 #include "avc.h" 30 31 struct task_security_struct { 32 u32 osid; /* SID prior to last execve */ 33 u32 sid; /* current SID */ 34 u32 exec_sid; /* exec SID */ 35 u32 create_sid; /* fscreate SID */ 36 u32 keycreate_sid; /* keycreate SID */ 37 u32 sockcreate_sid; /* fscreate SID */ 38 } __randomize_layout; 39 40 enum label_initialized { 41 LABEL_INVALID, /* invalid or not initialized */ 42 LABEL_INITIALIZED, /* initialized */ 43 LABEL_PENDING 44 }; 45 46 struct inode_security_struct { 47 struct inode *inode; /* back pointer to inode object */ 48 struct list_head list; /* list of inode_security_struct */ 49 u32 task_sid; /* SID of creating task */ 50 u32 sid; /* SID of this object */ 51 u16 sclass; /* security class of this object */ 52 unsigned char initialized; /* initialization flag */ 53 spinlock_t lock; 54 }; 55 56 struct file_security_struct { 57 u32 sid; /* SID of open file description */ 58 u32 fown_sid; /* SID of file owner (for SIGIO) */ 59 u32 isid; /* SID of inode at the time of file open */ 60 u32 pseqno; /* Policy seqno at the time of file open */ 61 }; 62 63 struct superblock_security_struct { 64 u32 sid; /* SID of file system superblock */ 65 u32 def_sid; /* default SID for labeling */ 66 u32 mntpoint_sid; /* SECURITY_FS_USE_MNTPOINT context for files */ 67 unsigned short behavior; /* labeling behavior */ 68 unsigned short flags; /* which mount options were specified */ 69 struct mutex lock; 70 struct list_head isec_head; 71 spinlock_t isec_lock; 72 }; 73 74 struct msg_security_struct { 75 u32 sid; /* SID of message */ 76 }; 77 78 struct ipc_security_struct { 79 u16 sclass; /* security class of this object */ 80 u32 sid; /* SID of IPC resource */ 81 }; 82 83 struct netif_security_struct { 84 struct net *ns; /* network namespace */ 85 int ifindex; /* device index */ 86 u32 sid; /* SID for this interface */ 87 }; 88 89 struct netnode_security_struct { 90 union { 91 __be32 ipv4; /* IPv4 node address */ 92 struct in6_addr ipv6; /* IPv6 node address */ 93 } addr; 94 u32 sid; /* SID for this node */ 95 u16 family; /* address family */ 96 }; 97 98 struct netport_security_struct { 99 u32 sid; /* SID for this node */ 100 u16 port; /* port number */ 101 u8 protocol; /* transport protocol */ 102 }; 103 104 struct sk_security_struct { 105 #ifdef CONFIG_NETLABEL 106 enum { /* NetLabel state */ 107 NLBL_UNSET = 0, 108 NLBL_REQUIRE, 109 NLBL_LABELED, 110 NLBL_REQSKB, 111 NLBL_CONNLABELED, 112 } nlbl_state; 113 struct netlbl_lsm_secattr *nlbl_secattr; /* NetLabel sec attributes */ 114 #endif 115 u32 sid; /* SID of this object */ 116 u32 peer_sid; /* SID of peer */ 117 u16 sclass; /* sock security class */ 118 enum { /* SCTP association state */ 119 SCTP_ASSOC_UNSET = 0, 120 SCTP_ASSOC_SET, 121 } sctp_assoc_state; 122 }; 123 124 struct tun_security_struct { 125 u32 sid; /* SID for the tun device sockets */ 126 }; 127 128 struct key_security_struct { 129 u32 sid; /* SID of key */ 130 }; 131 132 struct ib_security_struct { 133 u32 sid; /* SID of the queue pair or MAD agent */ 134 }; 135 136 struct pkey_security_struct { 137 u64 subnet_prefix; /* Port subnet prefix */ 138 u16 pkey; /* PKey number */ 139 u32 sid; /* SID of pkey */ 140 }; 141 142 struct bpf_security_struct { 143 u32 sid; /* SID of bpf obj creator */ 144 }; 145 146 struct perf_event_security_struct { 147 u32 sid; /* SID of perf_event obj creator */ 148 }; 149 150 extern struct lsm_blob_sizes selinux_blob_sizes; 151 static inline struct task_security_struct *selinux_cred(const struct cred *cred) 152 { 153 return cred->security + selinux_blob_sizes.lbs_cred; 154 } 155 156 static inline struct file_security_struct *selinux_file(const struct file *file) 157 { 158 return file->f_security + selinux_blob_sizes.lbs_file; 159 } 160 161 static inline struct inode_security_struct *selinux_inode( 162 const struct inode *inode) 163 { 164 if (unlikely(!inode->i_security)) 165 return NULL; 166 return inode->i_security + selinux_blob_sizes.lbs_inode; 167 } 168 169 static inline struct msg_security_struct *selinux_msg_msg( 170 const struct msg_msg *msg_msg) 171 { 172 return msg_msg->security + selinux_blob_sizes.lbs_msg_msg; 173 } 174 175 static inline struct ipc_security_struct *selinux_ipc( 176 const struct kern_ipc_perm *ipc) 177 { 178 return ipc->security + selinux_blob_sizes.lbs_ipc; 179 } 180 181 /* 182 * get the subjective security ID of the current task 183 */ 184 static inline u32 current_sid(void) 185 { 186 const struct task_security_struct *tsec = selinux_cred(current_cred()); 187 188 return tsec->sid; 189 } 190 191 static inline struct superblock_security_struct *selinux_superblock( 192 const struct super_block *superblock) 193 { 194 return superblock->s_security + selinux_blob_sizes.lbs_superblock; 195 } 196 197 #endif /* _SELINUX_OBJSEC_H_ */ 198