lsm.h 1.7 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273
  1. /* SPDX-License-Identifier: GPL-2.0 */
  2. /*
  3. * SafeSetID Linux Security Module
  4. *
  5. * Author: Micah Morton <mortonm@chromium.org>
  6. *
  7. * Copyright (C) 2018 The Chromium OS Authors.
  8. *
  9. * This program is free software; you can redistribute it and/or modify
  10. * it under the terms of the GNU General Public License version 2, as
  11. * published by the Free Software Foundation.
  12. *
  13. */
  14. #ifndef _SAFESETID_H
  15. #define _SAFESETID_H
  16. #include <linux/types.h>
  17. #include <linux/uidgid.h>
  18. #include <linux/hashtable.h>
  19. /* Flag indicating whether initialization completed */
  20. extern int safesetid_initialized;
  21. enum sid_policy_type {
  22. SIDPOL_DEFAULT, /* source ID is unaffected by policy */
  23. SIDPOL_CONSTRAINED, /* source ID is affected by policy */
  24. SIDPOL_ALLOWED /* target ID explicitly allowed */
  25. };
  26. typedef union {
  27. kuid_t uid;
  28. kgid_t gid;
  29. } kid_t;
  30. enum setid_type {
  31. UID,
  32. GID
  33. };
  34. /*
  35. * Hash table entry to store safesetid policy signifying that 'src_id'
  36. * can set*id to 'dst_id'.
  37. */
  38. struct setid_rule {
  39. struct hlist_node next;
  40. kid_t src_id;
  41. kid_t dst_id;
  42. /* Flag to signal if rule is for UID's or GID's */
  43. enum setid_type type;
  44. };
  45. #define SETID_HASH_BITS 8 /* 256 buckets in hash table */
  46. /* Extension of INVALID_UID/INVALID_GID for kid_t type */
  47. #define INVALID_ID (kid_t){.uid = INVALID_UID}
  48. struct setid_ruleset {
  49. DECLARE_HASHTABLE(rules, SETID_HASH_BITS);
  50. char *policy_str;
  51. struct rcu_head rcu;
  52. //Flag to signal if ruleset is for UID's or GID's
  53. enum setid_type type;
  54. };
  55. enum sid_policy_type _setid_policy_lookup(struct setid_ruleset *policy,
  56. kid_t src, kid_t dst);
  57. extern struct setid_ruleset __rcu *safesetid_setuid_rules;
  58. extern struct setid_ruleset __rcu *safesetid_setgid_rules;
  59. #endif /* _SAFESETID_H */