security/safesetid/lsm.h

   1 /* SPDX-License-Identifier: GPL-2.0 */
   2 /*
   3  * SafeSetID Linux Security Module
   4  *
   5  * Author: Micah Morton <mortonm@chromium.org>
   6  *
   7  * Copyright (C) 2018 The Chromium OS Authors.
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License version 2, as
  11  * published by the Free Software Foundation.
  12  *
  13  */
  14 #ifndef _SAFESETID_H
  15 #define _SAFESETID_H
  16
  17 #include <linux/types.h>
  18 #include <linux/uidgid.h>
  19 #include <linux/hashtable.h>
  20
  21 /* Flag indicating whether initialization completed */
  22 extern int safesetid_initialized;
  23
  24 enum sid_policy_type {
  25         SIDPOL_DEFAULT, /* source ID is unaffected by policy */
  26         SIDPOL_CONSTRAINED, /* source ID is affected by policy */
  27         SIDPOL_ALLOWED /* target ID explicitly allowed */
  28 };
  29
  30 typedef union {
  31         kuid_t uid;
  32         kgid_t gid;
  33 } kid_t;
  34
  35 enum setid_type {
  36         UID,
  37         GID
  38 };
  39
  40 /*
  41  * Hash table entry to store safesetid policy signifying that 'src_id'
  42  * can set*id to 'dst_id'.
  43  */
  44 struct setid_rule {
  45         struct hlist_node next;
  46         kid_t src_id;
  47         kid_t dst_id;
  48
  49         /* Flag to signal if rule is for UID's or GID's */
  50         enum setid_type type;
  51 };
  52
  53 #define SETID_HASH_BITS 8 /* 256 buckets in hash table */
  54
  55 /* Extension of INVALID_UID/INVALID_GID for kid_t type */
  56 #define INVALID_ID (kid_t){.uid = INVALID_UID}
  57
  58 struct setid_ruleset {
  59         DECLARE_HASHTABLE(rules, SETID_HASH_BITS);
  60         char *policy_str;
  61         struct rcu_head rcu;
  62
  63         //Flag to signal if ruleset is for UID's or GID's
  64         enum setid_type type;
  65 };
  66
  67 enum sid_policy_type _setid_policy_lookup(struct setid_ruleset *policy,
  68                 kid_t src, kid_t dst);
  69
  70 extern struct setid_ruleset __rcu *safesetid_setuid_rules;
  71 extern struct setid_ruleset __rcu *safesetid_setgid_rules;
  72
  73 #endif /* _SAFESETID_H */