security.h 2.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106
  1. /*
  2. * Security server interface.
  3. *
  4. * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
  5. *
  6. */
  7. #ifndef _SELINUX_SECURITY_H_
  8. #define _SELINUX_SECURITY_H_
  9. #include "flask.h"
  10. #define SECSID_NULL 0x00000000 /* unspecified SID */
  11. #define SECSID_WILD 0xffffffff /* wildcard SID */
  12. #define SECCLASS_NULL 0x0000 /* no class */
  13. #define SELINUX_MAGIC 0xf97cff8c
  14. /* Identify specific policy version changes */
  15. #define POLICYDB_VERSION_BASE 15
  16. #define POLICYDB_VERSION_BOOL 16
  17. #define POLICYDB_VERSION_IPV6 17
  18. #define POLICYDB_VERSION_NLCLASS 18
  19. #define POLICYDB_VERSION_VALIDATETRANS 19
  20. #define POLICYDB_VERSION_MLS 19
  21. #define POLICYDB_VERSION_AVTAB 20
  22. #define POLICYDB_VERSION_RANGETRANS 21
  23. /* Range of policy versions we understand*/
  24. #define POLICYDB_VERSION_MIN POLICYDB_VERSION_BASE
  25. #ifdef CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX
  26. #define POLICYDB_VERSION_MAX CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE
  27. #else
  28. #define POLICYDB_VERSION_MAX POLICYDB_VERSION_RANGETRANS
  29. #endif
  30. struct sk_buff;
  31. extern int selinux_enabled;
  32. extern int selinux_mls_enabled;
  33. int security_load_policy(void * data, size_t len);
  34. struct av_decision {
  35. u32 allowed;
  36. u32 decided;
  37. u32 auditallow;
  38. u32 auditdeny;
  39. u32 seqno;
  40. };
  41. int security_compute_av(u32 ssid, u32 tsid,
  42. u16 tclass, u32 requested,
  43. struct av_decision *avd);
  44. int security_transition_sid(u32 ssid, u32 tsid,
  45. u16 tclass, u32 *out_sid);
  46. int security_member_sid(u32 ssid, u32 tsid,
  47. u16 tclass, u32 *out_sid);
  48. int security_change_sid(u32 ssid, u32 tsid,
  49. u16 tclass, u32 *out_sid);
  50. int security_sid_to_context(u32 sid, char **scontext,
  51. u32 *scontext_len);
  52. int security_context_to_sid(char *scontext, u32 scontext_len,
  53. u32 *out_sid);
  54. int security_context_to_sid_default(char *scontext, u32 scontext_len, u32 *out_sid, u32 def_sid);
  55. int security_get_user_sids(u32 callsid, char *username,
  56. u32 **sids, u32 *nel);
  57. int security_port_sid(u16 domain, u16 type, u8 protocol, u16 port,
  58. u32 *out_sid);
  59. int security_netif_sid(char *name, u32 *if_sid,
  60. u32 *msg_sid);
  61. int security_node_sid(u16 domain, void *addr, u32 addrlen,
  62. u32 *out_sid);
  63. void security_skb_extlbl_sid(struct sk_buff *skb, u32 base_sid, u32 *sid);
  64. int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,
  65. u16 tclass);
  66. int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid);
  67. #define SECURITY_FS_USE_XATTR 1 /* use xattr */
  68. #define SECURITY_FS_USE_TRANS 2 /* use transition SIDs, e.g. devpts/tmpfs */
  69. #define SECURITY_FS_USE_TASK 3 /* use task SIDs, e.g. pipefs/sockfs */
  70. #define SECURITY_FS_USE_GENFS 4 /* use the genfs support */
  71. #define SECURITY_FS_USE_NONE 5 /* no labeling support */
  72. #define SECURITY_FS_USE_MNTPOINT 6 /* use mountpoint labeling */
  73. int security_fs_use(const char *fstype, unsigned int *behavior,
  74. u32 *sid);
  75. int security_genfs_sid(const char *fstype, char *name, u16 sclass,
  76. u32 *sid);
  77. #endif /* _SELINUX_SECURITY_H_ */