1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3  *  NSA Security-Enhanced Linux (SELinux) security module
4  *
5  *  This file contains the SELinux security data structures for kernel objects.
6  *
7  *  Author(s):  Stephen Smalley, <sds@tycho.nsa.gov>
8  *		Chris Vance, <cvance@nai.com>
9  *		Wayne Salamon, <wsalamon@nai.com>
10  *		James Morris <jmorris@redhat.com>
11  *
12  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
13  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
14  *  Copyright (C) 2016 Mellanox Technologies
15  */
16 #ifndef _SELINUX_OBJSEC_H_
17 #define _SELINUX_OBJSEC_H_
18 
19 #include <linux/list.h>
20 #include <linux/sched.h>
21 #include <linux/fs.h>
22 #include <linux/binfmts.h>
23 #include <linux/in.h>
24 #include <linux/spinlock.h>
25 #include <linux/lsm_hooks.h>
26 #include <linux/msg.h>
27 #include <net/net_namespace.h>
28 #include "flask.h"
29 #include "avc.h"
30 
31 struct task_security_struct {
32 	u32 osid;		/* SID prior to last execve */
33 	u32 sid;		/* current SID */
34 	u32 exec_sid;		/* exec SID */
35 	u32 create_sid;		/* fscreate SID */
36 	u32 keycreate_sid;	/* keycreate SID */
37 	u32 sockcreate_sid;	/* fscreate SID */
38 } __randomize_layout;
39 
40 enum label_initialized {
41 	LABEL_INVALID,		/* invalid or not initialized */
42 	LABEL_INITIALIZED,	/* initialized */
43 	LABEL_PENDING
44 };
45 
46 struct inode_security_struct {
47 	struct inode *inode;	/* back pointer to inode object */
48 	struct list_head list;	/* list of inode_security_struct */
49 	u32 task_sid;		/* SID of creating task */
50 	u32 sid;		/* SID of this object */
51 	u16 sclass;		/* security class of this object */
52 	unsigned char initialized;	/* initialization flag */
53 	spinlock_t lock;
54 };
55 
56 struct file_security_struct {
57 	u32 sid;		/* SID of open file description */
58 	u32 fown_sid;		/* SID of file owner (for SIGIO) */
59 	u32 isid;		/* SID of inode at the time of file open */
60 	u32 pseqno;		/* Policy seqno at the time of file open */
61 };
62 
63 struct superblock_security_struct {
64 	u32 sid;			/* SID of file system superblock */
65 	u32 def_sid;			/* default SID for labeling */
66 	u32 mntpoint_sid;		/* SECURITY_FS_USE_MNTPOINT context for files */
67 	unsigned short behavior;	/* labeling behavior */
68 	unsigned short flags;		/* which mount options were specified */
69 	struct mutex lock;
70 	struct list_head isec_head;
71 	spinlock_t isec_lock;
72 };
73 
74 struct msg_security_struct {
75 	u32 sid;	/* SID of message */
76 };
77 
78 struct ipc_security_struct {
79 	u16 sclass;	/* security class of this object */
80 	u32 sid;	/* SID of IPC resource */
81 };
82 
83 struct netif_security_struct {
84 	struct net *ns;			/* network namespace */
85 	int ifindex;			/* device index */
86 	u32 sid;			/* SID for this interface */
87 };
88 
89 struct netnode_security_struct {
90 	union {
91 		__be32 ipv4;		/* IPv4 node address */
92 		struct in6_addr ipv6;	/* IPv6 node address */
93 	} addr;
94 	u32 sid;			/* SID for this node */
95 	u16 family;			/* address family */
96 };
97 
98 struct netport_security_struct {
99 	u32 sid;			/* SID for this node */
100 	u16 port;			/* port number */
101 	u8 protocol;			/* transport protocol */
102 };
103 
104 struct sk_security_struct {
105 #ifdef CONFIG_NETLABEL
106 	enum {				/* NetLabel state */
107 		NLBL_UNSET = 0,
108 		NLBL_REQUIRE,
109 		NLBL_LABELED,
110 		NLBL_REQSKB,
111 		NLBL_CONNLABELED,
112 	} nlbl_state;
113 	struct netlbl_lsm_secattr *nlbl_secattr; /* NetLabel sec attributes */
114 #endif
115 	u32 sid;			/* SID of this object */
116 	u32 peer_sid;			/* SID of peer */
117 	u16 sclass;			/* sock security class */
118 	enum {				/* SCTP association state */
119 		SCTP_ASSOC_UNSET = 0,
120 		SCTP_ASSOC_SET,
121 	} sctp_assoc_state;
122 };
123 
124 struct tun_security_struct {
125 	u32 sid;			/* SID for the tun device sockets */
126 };
127 
128 struct key_security_struct {
129 	u32 sid;	/* SID of key */
130 };
131 
132 struct ib_security_struct {
133 	u32 sid;        /* SID of the queue pair or MAD agent */
134 };
135 
136 struct pkey_security_struct {
137 	u64	subnet_prefix; /* Port subnet prefix */
138 	u16	pkey;	/* PKey number */
139 	u32	sid;	/* SID of pkey */
140 };
141 
142 struct bpf_security_struct {
143 	u32 sid;  /* SID of bpf obj creator */
144 };
145 
146 struct perf_event_security_struct {
147 	u32 sid;  /* SID of perf_event obj creator */
148 };
149 
150 extern struct lsm_blob_sizes selinux_blob_sizes;
selinux_cred(const struct cred * cred)151 static inline struct task_security_struct *selinux_cred(const struct cred *cred)
152 {
153 	return cred->security + selinux_blob_sizes.lbs_cred;
154 }
155 
selinux_file(const struct file * file)156 static inline struct file_security_struct *selinux_file(const struct file *file)
157 {
158 	return file->f_security + selinux_blob_sizes.lbs_file;
159 }
160 
selinux_inode(const struct inode * inode)161 static inline struct inode_security_struct *selinux_inode(
162 						const struct inode *inode)
163 {
164 	if (unlikely(!inode->i_security))
165 		return NULL;
166 	return inode->i_security + selinux_blob_sizes.lbs_inode;
167 }
168 
selinux_msg_msg(const struct msg_msg * msg_msg)169 static inline struct msg_security_struct *selinux_msg_msg(
170 						const struct msg_msg *msg_msg)
171 {
172 	return msg_msg->security + selinux_blob_sizes.lbs_msg_msg;
173 }
174 
selinux_ipc(const struct kern_ipc_perm * ipc)175 static inline struct ipc_security_struct *selinux_ipc(
176 						const struct kern_ipc_perm *ipc)
177 {
178 	return ipc->security + selinux_blob_sizes.lbs_ipc;
179 }
180 
181 /*
182  * get the subjective security ID of the current task
183  */
current_sid(void)184 static inline u32 current_sid(void)
185 {
186 	const struct task_security_struct *tsec = selinux_cred(current_cred());
187 
188 	return tsec->sid;
189 }
190 
selinux_superblock(const struct super_block * superblock)191 static inline struct superblock_security_struct *selinux_superblock(
192 					const struct super_block *superblock)
193 {
194 	return superblock->s_security + selinux_blob_sizes.lbs_superblock;
195 }
196 
197 #endif /* _SELINUX_OBJSEC_H_ */
198