selinux.h 5.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194
  1. /*
  2. * SELinux services exported to the rest of the kernel.
  3. *
  4. * Author: James Morris <jmorris@redhat.com>
  5. *
  6. * Copyright (C) 2005 Red Hat, Inc., James Morris <jmorris@redhat.com>
  7. * Copyright (C) 2006 Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
  8. * Copyright (C) 2006 IBM Corporation, Timothy R. Chavez <tinytim@us.ibm.com>
  9. *
  10. * This program is free software; you can redistribute it and/or modify
  11. * it under the terms of the GNU General Public License version 2,
  12. * as published by the Free Software Foundation.
  13. */
  14. #ifndef _LINUX_SELINUX_H
  15. #define _LINUX_SELINUX_H
  16. struct selinux_audit_rule;
  17. struct audit_context;
  18. struct inode;
  19. struct kern_ipc_perm;
  20. #ifdef CONFIG_SECURITY_SELINUX
  21. /**
  22. * selinux_audit_rule_init - alloc/init an selinux audit rule structure.
  23. * @field: the field this rule refers to
  24. * @op: the operater the rule uses
  25. * @rulestr: the text "target" of the rule
  26. * @rule: pointer to the new rule structure returned via this
  27. *
  28. * Returns 0 if successful, -errno if not. On success, the rule structure
  29. * will be allocated internally. The caller must free this structure with
  30. * selinux_audit_rule_free() after use.
  31. */
  32. int selinux_audit_rule_init(u32 field, u32 op, char *rulestr,
  33. struct selinux_audit_rule **rule);
  34. /**
  35. * selinux_audit_rule_free - free an selinux audit rule structure.
  36. * @rule: pointer to the audit rule to be freed
  37. *
  38. * This will free all memory associated with the given rule.
  39. * If @rule is NULL, no operation is performed.
  40. */
  41. void selinux_audit_rule_free(struct selinux_audit_rule *rule);
  42. /**
  43. * selinux_audit_rule_match - determine if a context ID matches a rule.
  44. * @sid: the context ID to check
  45. * @field: the field this rule refers to
  46. * @op: the operater the rule uses
  47. * @rule: pointer to the audit rule to check against
  48. * @actx: the audit context (can be NULL) associated with the check
  49. *
  50. * Returns 1 if the context id matches the rule, 0 if it does not, and
  51. * -errno on failure.
  52. */
  53. int selinux_audit_rule_match(u32 sid, u32 field, u32 op,
  54. struct selinux_audit_rule *rule,
  55. struct audit_context *actx);
  56. /**
  57. * selinux_audit_set_callback - set the callback for policy reloads.
  58. * @callback: the function to call when the policy is reloaded
  59. *
  60. * This sets the function callback function that will update the rules
  61. * upon policy reloads. This callback should rebuild all existing rules
  62. * using selinux_audit_rule_init().
  63. */
  64. void selinux_audit_set_callback(int (*callback)(void));
  65. /**
  66. * selinux_sid_to_string - map a security context ID to a string
  67. * @sid: security context ID to be converted.
  68. * @ctx: address of context string to be returned
  69. * @ctxlen: length of returned context string.
  70. *
  71. * Returns 0 if successful, -errno if not. On success, the context
  72. * string will be allocated internally, and the caller must call
  73. * kfree() on it after use.
  74. */
  75. int selinux_sid_to_string(u32 sid, char **ctx, u32 *ctxlen);
  76. /**
  77. * selinux_get_inode_sid - get the inode's security context ID
  78. * @inode: inode structure to get the sid from.
  79. * @sid: pointer to security context ID to be filled in.
  80. *
  81. * Returns nothing
  82. */
  83. void selinux_get_inode_sid(const struct inode *inode, u32 *sid);
  84. /**
  85. * selinux_get_ipc_sid - get the ipc security context ID
  86. * @ipcp: ipc structure to get the sid from.
  87. * @sid: pointer to security context ID to be filled in.
  88. *
  89. * Returns nothing
  90. */
  91. void selinux_get_ipc_sid(const struct kern_ipc_perm *ipcp, u32 *sid);
  92. /**
  93. * selinux_get_task_sid - return the SID of task
  94. * @tsk: the task whose SID will be returned
  95. * @sid: pointer to security context ID to be filled in.
  96. *
  97. * Returns nothing
  98. */
  99. void selinux_get_task_sid(struct task_struct *tsk, u32 *sid);
  100. /**
  101. * selinux_string_to_sid - map a security context string to a security ID
  102. * @str: the security context string to be mapped
  103. * @sid: ID value returned via this.
  104. *
  105. * Returns 0 if successful, with the SID stored in sid. A value
  106. * of zero for sid indicates no SID could be determined (but no error
  107. * occurred).
  108. */
  109. int selinux_string_to_sid(char *str, u32 *sid);
  110. /**
  111. * selinux_relabel_packet_permission - check permission to relabel a packet
  112. * @sid: ID value to be applied to network packet (via SECMARK, most likely)
  113. *
  114. * Returns 0 if the current task is allowed to label packets with the
  115. * supplied security ID. Note that it is implicit that the packet is always
  116. * being relabeled from the default unlabled value, and that the access
  117. * control decision is made in the AVC.
  118. */
  119. int selinux_relabel_packet_permission(u32 sid);
  120. #else
  121. static inline int selinux_audit_rule_init(u32 field, u32 op,
  122. char *rulestr,
  123. struct selinux_audit_rule **rule)
  124. {
  125. return -ENOTSUPP;
  126. }
  127. static inline void selinux_audit_rule_free(struct selinux_audit_rule *rule)
  128. {
  129. return;
  130. }
  131. static inline int selinux_audit_rule_match(u32 sid, u32 field, u32 op,
  132. struct selinux_audit_rule *rule,
  133. struct audit_context *actx)
  134. {
  135. return 0;
  136. }
  137. static inline void selinux_audit_set_callback(int (*callback)(void))
  138. {
  139. return;
  140. }
  141. static inline int selinux_sid_to_string(u32 sid, char **ctx, u32 *ctxlen)
  142. {
  143. *ctx = NULL;
  144. *ctxlen = 0;
  145. return 0;
  146. }
  147. static inline void selinux_get_inode_sid(const struct inode *inode, u32 *sid)
  148. {
  149. *sid = 0;
  150. }
  151. static inline void selinux_get_ipc_sid(const struct kern_ipc_perm *ipcp, u32 *sid)
  152. {
  153. *sid = 0;
  154. }
  155. static inline void selinux_get_task_sid(struct task_struct *tsk, u32 *sid)
  156. {
  157. *sid = 0;
  158. }
  159. static inline int selinux_string_to_sid(const char *str, u32 *sid)
  160. {
  161. *sid = 0;
  162. return 0;
  163. }
  164. static inline int selinux_relabel_packet_permission(u32 sid)
  165. {
  166. return 0;
  167. }
  168. #endif /* CONFIG_SECURITY_SELINUX */
  169. #endif /* _LINUX_SELINUX_H */