[linux-block.git] / security / selinux / include / objsec.h

/*
 *  NSA Security-Enhanced Linux (SELinux) security module
 *
 *  This file contains the SELinux security data structures for kernel objects.
 *
 *  Author(s):  Stephen Smalley, <sds@epoch.ncsc.mil>
 *              Chris Vance, <cvance@nai.com>
 *              Wayne Salamon, <wsalamon@nai.com>
 *              James Morris <jmorris@redhat.com>
 *
 *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
 *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
 *
 *	This program is free software; you can redistribute it and/or modify
 *	it under the terms of the GNU General Public License version 2,
 *      as published by the Free Software Foundation.
 */
#ifndef _SELINUX_OBJSEC_H_
#define _SELINUX_OBJSEC_H_

#include <linux/list.h>
#include <linux/sched.h>
#include <linux/fs.h>
#include <linux/binfmts.h>
#include <linux/in.h>
#include <linux/spinlock.h>
#include "flask.h"
#include "avc.h"

struct task_security_struct {
	struct task_struct *task;      /* back pointer to task object */
	u32 osid;            /* SID prior to last execve */
	u32 sid;             /* current SID */
	u32 exec_sid;        /* exec SID */
	u32 create_sid;      /* fscreate SID */
	u32 keycreate_sid;   /* keycreate SID */
	u32 sockcreate_sid;  /* fscreate SID */
	u32 ptrace_sid;      /* SID of ptrace parent */
};

struct inode_security_struct {
        struct inode *inode;           /* back pointer to inode object */
	struct list_head list;         /* list of inode_security_struct */
	u32 task_sid;        /* SID of creating task */
	u32 sid;             /* SID of this object */
	u16 sclass;       /* security class of this object */
	unsigned char initialized;     /* initialization flag */
	struct mutex lock;
	unsigned char inherit;         /* inherit SID from parent entry */
};

struct file_security_struct {
	struct file *file;              /* back pointer to file object */
	u32 sid;              /* SID of open file description */
	u32 fown_sid;         /* SID of file owner (for SIGIO) */
	u32 isid;             /* SID of inode at the time of file open */
	u32 pseqno;           /* Policy seqno at the time of file open */
};

struct superblock_security_struct {
	struct super_block *sb;         /* back pointer to sb object */
	struct list_head list;          /* list of superblock_security_struct */
	u32 sid;			/* SID of file system superblock */
	u32 def_sid;			/* default SID for labeling */
	u32 mntpoint_sid;		/* SECURITY_FS_USE_MNTPOINT context for files */
	unsigned int behavior;          /* labeling behavior */
	unsigned char initialized;      /* initialization flag */
	unsigned char proc;             /* proc fs */
	struct mutex lock;
	struct list_head isec_head;
	spinlock_t isec_lock;
};

struct msg_security_struct {
	struct msg_msg *msg;		/* back pointer */
	u32 sid;              /* SID of message */
};

struct ipc_security_struct {
	struct kern_ipc_perm *ipc_perm; /* back pointer */
	u16 sclass;	/* security class of this object */
	u32 sid;              /* SID of IPC resource */
};

struct bprm_security_struct {
	struct linux_binprm *bprm;     /* back pointer to bprm object */
	u32 sid;                       /* SID for transformed process */
	unsigned char set;

	/*
	 * unsafe is used to share failure information from bprm_apply_creds()
	 * to bprm_post_apply_creds().
	 */
	char unsafe;
};

struct netif_security_struct {
	struct net_device *dev;		/* back pointer */
	u32 if_sid;			/* SID for this interface */
	u32 msg_sid;			/* default SID for messages received on this interface */
};

struct sk_security_struct {
	struct sock *sk;		/* back pointer to sk object */
	u32 sid;			/* SID of this object */
	u32 peer_sid;			/* SID of peer */
#ifdef CONFIG_NETLABEL
	u16 sclass;			/* sock security class */
	enum {				/* NetLabel state */
		NLBL_UNSET = 0,
		NLBL_REQUIRE,
		NLBL_LABELED,
	} nlbl_state;
	spinlock_t nlbl_lock;		/* protects nlbl_state */
#endif
};

struct key_security_struct {
	struct key *obj; /* back pointer */
	u32 sid;         /* SID of key */
};

extern unsigned int selinux_checkreqprot;

#endif /* _SELINUX_OBJSEC_H_ */
Commit	Line	Data
	1	/*
	2	* NSA Security-Enhanced Linux (SELinux) security module
	3	*
	4	* This file contains the SELinux security data structures for kernel objects.
	5	*
	6	* Author(s): Stephen Smalley, <sds@epoch.ncsc.mil>
	7	* Chris Vance, <cvance@nai.com>
	8	* Wayne Salamon, <wsalamon@nai.com>
	9	* James Morris <jmorris@redhat.com>
	10	*
	11	* Copyright (C) 2001,2002 Networks Associates Technology, Inc.
	12	* Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
	13	*
	14	* This program is free software; you can redistribute it and/or modify
	15	* it under the terms of the GNU General Public License version 2,
	16	* as published by the Free Software Foundation.
	17	*/
	18	#ifndef _SELINUX_OBJSEC_H_
	19	#define _SELINUX_OBJSEC_H_
	20
	21	#include <linux/list.h>
	22	#include <linux/sched.h>
	23	#include <linux/fs.h>
	24	#include <linux/binfmts.h>
	25	#include <linux/in.h>
	26	#include <linux/spinlock.h>
	27	#include "flask.h"
	28	#include "avc.h"
	29
	30	struct task_security_struct {
	31	struct task_struct task; / back pointer to task object */
	32	u32 osid; /* SID prior to last execve */
	33	u32 sid; /* current SID */
	34	u32 exec_sid; /* exec SID */
	35	u32 create_sid; /* fscreate SID */
	36	u32 keycreate_sid; /* keycreate SID */
	37	u32 sockcreate_sid; /* fscreate SID */
	38	u32 ptrace_sid; /* SID of ptrace parent */
	39	};
	40
	41	struct inode_security_struct {
	42	struct inode inode; / back pointer to inode object */
	43	struct list_head list; /* list of inode_security_struct */
	44	u32 task_sid; /* SID of creating task */
	45	u32 sid; /* SID of this object */
	46	u16 sclass; /* security class of this object */
	47	unsigned char initialized; /* initialization flag */
	48	struct mutex lock;
	49	unsigned char inherit; /* inherit SID from parent entry */
	50	};
	51
	52	struct file_security_struct {
	53	struct file file; / back pointer to file object */
	54	u32 sid; /* SID of open file description */
	55	u32 fown_sid; /* SID of file owner (for SIGIO) */
	56	u32 isid; /* SID of inode at the time of file open */
	57	u32 pseqno; /* Policy seqno at the time of file open */
	58	};
	59
	60	struct superblock_security_struct {
	61	struct super_block sb; / back pointer to sb object */
	62	struct list_head list; /* list of superblock_security_struct */
	63	u32 sid; /* SID of file system superblock */
	64	u32 def_sid; /* default SID for labeling */
	65	u32 mntpoint_sid; /* SECURITY_FS_USE_MNTPOINT context for files */
	66	unsigned int behavior; /* labeling behavior */
	67	unsigned char initialized; /* initialization flag */
	68	unsigned char proc; /* proc fs */
	69	struct mutex lock;
	70	struct list_head isec_head;
	71	spinlock_t isec_lock;
	72	};
	73
	74	struct msg_security_struct {
	75	struct msg_msg msg; / back pointer */
	76	u32 sid; /* SID of message */
	77	};
	78
	79	struct ipc_security_struct {
	80	struct kern_ipc_perm ipc_perm; / back pointer */
	81	u16 sclass; /* security class of this object */
	82	u32 sid; /* SID of IPC resource */
	83	};
	84
	85	struct bprm_security_struct {
	86	struct linux_binprm bprm; / back pointer to bprm object */
	87	u32 sid; /* SID for transformed process */
	88	unsigned char set;
	89
	90	/*
	91	* unsafe is used to share failure information from bprm_apply_creds()
	92	* to bprm_post_apply_creds().
	93	*/
	94	char unsafe;
	95	};
	96
	97	struct netif_security_struct {
	98	struct net_device dev; / back pointer */
	99	u32 if_sid; /* SID for this interface */
	100	u32 msg_sid; /* default SID for messages received on this interface */
	101	};
	102
	103	struct sk_security_struct {
	104	struct sock sk; / back pointer to sk object */
	105	u32 sid; /* SID of this object */
	106	u32 peer_sid; /* SID of peer */
	107	#ifdef CONFIG_NETLABEL
	108	u16 sclass; /* sock security class */
	109	enum { /* NetLabel state */
	110	NLBL_UNSET = 0,
	111	NLBL_REQUIRE,
	112	NLBL_LABELED,
	113	} nlbl_state;
	114	spinlock_t nlbl_lock; /* protects nlbl_state */
	115	#endif
	116	};
	117
	118	struct key_security_struct {
	119	struct key obj; / back pointer */
	120	u32 sid; /* SID of key */
	121	};
	122
	123	extern unsigned int selinux_checkreqprot;
	124
	125	#endif /* _SELINUX_OBJSEC_H_ */