X-Git-Url: http://ftp.safe.ca/?a=blobdiff_plain;f=security%2Fselinux%2Finclude%2Fobjsec.h;h=3cc45168f674fbe6c98c89f9597398af6778a95a;hb=a6f76f23d297f70e2a6b3ec607f7aeeea9e37e8d;hp=8f5547ad185664595664f6a54a61e0f5642966c5;hpb=d720024e94de4e8b7f10ee83c532926f3ad5d708;p=safe%2Fjmp%2Flinux-2.6 diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h index 8f5547a..3cc4516 100644 --- a/security/selinux/include/objsec.h +++ b/security/selinux/include/objsec.h @@ -4,16 +4,16 @@ * This file contains the SELinux security data structures for kernel objects. * * Author(s): Stephen Smalley, - * Chris Vance, - * Wayne Salamon, - * James Morris + * Chris Vance, + * Wayne Salamon, + * James Morris * * Copyright (C) 2001,2002 Networks Associates Technology, Inc. * Copyright (C) 2003 Red Hat, Inc., James Morris * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2, - * as published by the Free Software Foundation. + * as published by the Free Software Foundation. */ #ifndef _SELINUX_OBJSEC_H_ #define _SELINUX_OBJSEC_H_ @@ -23,85 +23,98 @@ #include #include #include +#include #include "flask.h" #include "avc.h" struct task_security_struct { - struct task_struct *task; /* back pointer to task object */ - u32 osid; /* SID prior to last execve */ - u32 sid; /* current SID */ - u32 exec_sid; /* exec SID */ - u32 create_sid; /* fscreate SID */ - u32 ptrace_sid; /* SID of ptrace parent */ + u32 osid; /* SID prior to last execve */ + u32 sid; /* current SID */ + u32 exec_sid; /* exec SID */ + u32 create_sid; /* fscreate SID */ + u32 keycreate_sid; /* keycreate SID */ + u32 sockcreate_sid; /* fscreate SID */ }; struct inode_security_struct { - struct inode *inode; /* back pointer to inode object */ - struct list_head list; /* list of inode_security_struct */ - u32 task_sid; /* SID of creating task */ - u32 sid; /* SID of this object */ - u16 sclass; /* security class of this object */ - unsigned char initialized; /* initialization flag */ - struct semaphore sem; - unsigned char inherit; /* inherit SID from parent entry */ + struct inode *inode; /* back pointer to inode object */ + struct list_head list; /* list of inode_security_struct */ + u32 task_sid; /* SID of creating task */ + u32 sid; /* SID of this object */ + u16 sclass; /* security class of this object */ + unsigned char initialized; /* initialization flag */ + struct mutex lock; }; struct file_security_struct { - struct file *file; /* back pointer to file object */ - u32 sid; /* SID of open file description */ - u32 fown_sid; /* SID of file owner (for SIGIO) */ + u32 sid; /* SID of open file description */ + u32 fown_sid; /* SID of file owner (for SIGIO) */ + u32 isid; /* SID of inode at the time of file open */ + u32 pseqno; /* Policy seqno at the time of file open */ }; struct superblock_security_struct { - struct super_block *sb; /* back pointer to sb object */ - struct list_head list; /* list of superblock_security_struct */ - u32 sid; /* SID of file system */ + struct super_block *sb; /* back pointer to sb object */ + struct list_head list; /* list of superblock_security_struct */ + u32 sid; /* SID of file system superblock */ u32 def_sid; /* default SID for labeling */ - unsigned int behavior; /* labeling behavior */ - unsigned char initialized; /* initialization flag */ - unsigned char proc; /* proc fs */ - struct semaphore sem; + u32 mntpoint_sid; /* SECURITY_FS_USE_MNTPOINT context for files */ + unsigned int behavior; /* labeling behavior */ + unsigned char initialized; /* initialization flag */ + unsigned char flags; /* which mount options were specified */ + unsigned char proc; /* proc fs */ + struct mutex lock; struct list_head isec_head; spinlock_t isec_lock; }; struct msg_security_struct { - struct msg_msg *msg; /* back pointer */ - u32 sid; /* SID of message */ + u32 sid; /* SID of message */ }; struct ipc_security_struct { - struct kern_ipc_perm *ipc_perm; /* back pointer */ u16 sclass; /* security class of this object */ - u32 sid; /* SID of IPC resource */ + u32 sid; /* SID of IPC resource */ }; -struct bprm_security_struct { - struct linux_binprm *bprm; /* back pointer to bprm object */ - u32 sid; /* SID for transformed process */ - unsigned char set; +struct netif_security_struct { + int ifindex; /* device index */ + u32 sid; /* SID for this interface */ +}; - /* - * unsafe is used to share failure information from bprm_apply_creds() - * to bprm_post_apply_creds(). - */ - char unsafe; +struct netnode_security_struct { + union { + __be32 ipv4; /* IPv4 node address */ + struct in6_addr ipv6; /* IPv6 node address */ + } addr; + u32 sid; /* SID for this node */ + u16 family; /* address family */ }; -struct netif_security_struct { - struct net_device *dev; /* back pointer */ - u32 if_sid; /* SID for this interface */ - u32 msg_sid; /* default SID for messages received on this interface */ +struct netport_security_struct { + u32 sid; /* SID for this node */ + u16 port; /* port number */ + u8 protocol; /* transport protocol */ }; struct sk_security_struct { - struct sock *sk; /* back pointer to sk object */ +#ifdef CONFIG_NETLABEL + enum { /* NetLabel state */ + NLBL_UNSET = 0, + NLBL_REQUIRE, + NLBL_LABELED, + NLBL_REQSKB, + NLBL_CONNLABELED, + } nlbl_state; + struct netlbl_lsm_secattr *nlbl_secattr; /* NetLabel sec attributes */ +#endif + u32 sid; /* SID of this object */ u32 peer_sid; /* SID of peer */ + u16 sclass; /* sock security class */ }; struct key_security_struct { - struct key *obj; /* back pointer */ - u32 sid; /* SID of key */ + u32 sid; /* SID of key */ }; extern unsigned int selinux_checkreqprot;