Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* |
2 | * NSA Security-Enhanced Linux (SELinux) security module | |
3 | * | |
4 | * This file contains the SELinux security data structures for kernel objects. | |
5 | * | |
6 | * Author(s): Stephen Smalley, <sds@epoch.ncsc.mil> | |
7 | * Chris Vance, <cvance@nai.com> | |
8 | * Wayne Salamon, <wsalamon@nai.com> | |
9 | * James Morris <jmorris@redhat.com> | |
10 | * | |
11 | * Copyright (C) 2001,2002 Networks Associates Technology, Inc. | |
12 | * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> | |
13 | * | |
14 | * This program is free software; you can redistribute it and/or modify | |
15 | * it under the terms of the GNU General Public License version 2, | |
16 | * as published by the Free Software Foundation. | |
17 | */ | |
18 | #ifndef _SELINUX_OBJSEC_H_ | |
19 | #define _SELINUX_OBJSEC_H_ | |
20 | ||
21 | #include <linux/list.h> | |
22 | #include <linux/sched.h> | |
23 | #include <linux/fs.h> | |
24 | #include <linux/binfmts.h> | |
25 | #include <linux/in.h> | |
9f2ad665 | 26 | #include <linux/spinlock.h> |
1da177e4 LT |
27 | #include "flask.h" |
28 | #include "avc.h" | |
29 | ||
30 | struct task_security_struct { | |
1da177e4 LT |
31 | struct task_struct *task; /* back pointer to task object */ |
32 | u32 osid; /* SID prior to last execve */ | |
33 | u32 sid; /* current SID */ | |
34 | u32 exec_sid; /* exec SID */ | |
35 | u32 create_sid; /* fscreate SID */ | |
4eb582cf | 36 | u32 keycreate_sid; /* keycreate SID */ |
42c3e03e | 37 | u32 sockcreate_sid; /* fscreate SID */ |
1da177e4 LT |
38 | u32 ptrace_sid; /* SID of ptrace parent */ |
39 | }; | |
40 | ||
41 | struct inode_security_struct { | |
1da177e4 LT |
42 | struct inode *inode; /* back pointer to inode object */ |
43 | struct list_head list; /* list of inode_security_struct */ | |
44 | u32 task_sid; /* SID of creating task */ | |
45 | u32 sid; /* SID of this object */ | |
46 | u16 sclass; /* security class of this object */ | |
47 | unsigned char initialized; /* initialization flag */ | |
23970741 | 48 | struct mutex lock; |
1da177e4 LT |
49 | unsigned char inherit; /* inherit SID from parent entry */ |
50 | }; | |
51 | ||
52 | struct file_security_struct { | |
1da177e4 LT |
53 | struct file *file; /* back pointer to file object */ |
54 | u32 sid; /* SID of open file description */ | |
55 | u32 fown_sid; /* SID of file owner (for SIGIO) */ | |
788e7dd4 YN |
56 | u32 isid; /* SID of inode at the time of file open */ |
57 | u32 pseqno; /* Policy seqno at the time of file open */ | |
1da177e4 LT |
58 | }; |
59 | ||
60 | struct superblock_security_struct { | |
1da177e4 LT |
61 | struct super_block *sb; /* back pointer to sb object */ |
62 | struct list_head list; /* list of superblock_security_struct */ | |
c312feb2 | 63 | u32 sid; /* SID of file system superblock */ |
1da177e4 | 64 | u32 def_sid; /* default SID for labeling */ |
c312feb2 | 65 | u32 mntpoint_sid; /* SECURITY_FS_USE_MNTPOINT context for files */ |
1da177e4 LT |
66 | unsigned int behavior; /* labeling behavior */ |
67 | unsigned char initialized; /* initialization flag */ | |
68 | unsigned char proc; /* proc fs */ | |
bc7e982b | 69 | struct mutex lock; |
1da177e4 LT |
70 | struct list_head isec_head; |
71 | spinlock_t isec_lock; | |
72 | }; | |
73 | ||
74 | struct msg_security_struct { | |
1da177e4 LT |
75 | struct msg_msg *msg; /* back pointer */ |
76 | u32 sid; /* SID of message */ | |
77 | }; | |
78 | ||
79 | struct ipc_security_struct { | |
1da177e4 LT |
80 | struct kern_ipc_perm *ipc_perm; /* back pointer */ |
81 | u16 sclass; /* security class of this object */ | |
82 | u32 sid; /* SID of IPC resource */ | |
83 | }; | |
84 | ||
85 | struct bprm_security_struct { | |
1da177e4 LT |
86 | struct linux_binprm *bprm; /* back pointer to bprm object */ |
87 | u32 sid; /* SID for transformed process */ | |
88 | unsigned char set; | |
89 | ||
90 | /* | |
91 | * unsafe is used to share failure information from bprm_apply_creds() | |
92 | * to bprm_post_apply_creds(). | |
93 | */ | |
94 | char unsafe; | |
95 | }; | |
96 | ||
97 | struct netif_security_struct { | |
98 | struct net_device *dev; /* back pointer */ | |
99 | u32 if_sid; /* SID for this interface */ | |
100 | u32 msg_sid; /* default SID for messages received on this interface */ | |
101 | }; | |
102 | ||
103 | struct sk_security_struct { | |
1da177e4 | 104 | struct sock *sk; /* back pointer to sk object */ |
892c141e | 105 | u32 sid; /* SID of this object */ |
1da177e4 | 106 | u32 peer_sid; /* SID of peer */ |
7420ed23 VY |
107 | #ifdef CONFIG_NETLABEL |
108 | u16 sclass; /* sock security class */ | |
109 | enum { /* NetLabel state */ | |
110 | NLBL_UNSET = 0, | |
111 | NLBL_REQUIRE, | |
112 | NLBL_LABELED, | |
113 | } nlbl_state; | |
9f2ad665 | 114 | spinlock_t nlbl_lock; /* protects nlbl_state */ |
7420ed23 | 115 | #endif |
1da177e4 LT |
116 | }; |
117 | ||
d720024e ML |
118 | struct key_security_struct { |
119 | struct key *obj; /* back pointer */ | |
120 | u32 sid; /* SID of key */ | |
121 | }; | |
122 | ||
1da177e4 LT |
123 | extern unsigned int selinux_checkreqprot; |
124 | ||
125 | #endif /* _SELINUX_OBJSEC_H_ */ |