1aeca4e2cSMicah Morton /* SPDX-License-Identifier: GPL-2.0 */ 2aeca4e2cSMicah Morton /* 3aeca4e2cSMicah Morton * SafeSetID Linux Security Module 4aeca4e2cSMicah Morton * 5aeca4e2cSMicah Morton * Author: Micah Morton <mortonm@chromium.org> 6aeca4e2cSMicah Morton * 7aeca4e2cSMicah Morton * Copyright (C) 2018 The Chromium OS Authors. 8aeca4e2cSMicah Morton * 9aeca4e2cSMicah Morton * This program is free software; you can redistribute it and/or modify 10aeca4e2cSMicah Morton * it under the terms of the GNU General Public License version 2, as 11aeca4e2cSMicah Morton * published by the Free Software Foundation. 12aeca4e2cSMicah Morton * 13aeca4e2cSMicah Morton */ 14aeca4e2cSMicah Morton #ifndef _SAFESETID_H 15aeca4e2cSMicah Morton #define _SAFESETID_H 16aeca4e2cSMicah Morton 17aeca4e2cSMicah Morton #include <linux/types.h> 181cd02a27SJann Horn #include <linux/uidgid.h> 191cd02a27SJann Horn #include <linux/hashtable.h> 20aeca4e2cSMicah Morton 21aeca4e2cSMicah Morton /* Flag indicating whether initialization completed */ 22*1b8b7192SAustin Kim extern int safesetid_initialized __initdata; 23aeca4e2cSMicah Morton 241cd02a27SJann Horn enum sid_policy_type { 251cd02a27SJann Horn SIDPOL_DEFAULT, /* source ID is unaffected by policy */ 261cd02a27SJann Horn SIDPOL_CONSTRAINED, /* source ID is affected by policy */ 271cd02a27SJann Horn SIDPOL_ALLOWED /* target ID explicitly allowed */ 281cd02a27SJann Horn }; 291cd02a27SJann Horn 305294bac9SThomas Cedeno typedef union { 315294bac9SThomas Cedeno kuid_t uid; 325294bac9SThomas Cedeno kgid_t gid; 335294bac9SThomas Cedeno } kid_t; 345294bac9SThomas Cedeno 355294bac9SThomas Cedeno enum setid_type { 365294bac9SThomas Cedeno UID, 375294bac9SThomas Cedeno GID 385294bac9SThomas Cedeno }; 395294bac9SThomas Cedeno 401cd02a27SJann Horn /* 415294bac9SThomas Cedeno * Hash table entry to store safesetid policy signifying that 'src_id' 425294bac9SThomas Cedeno * can set*id to 'dst_id'. 431cd02a27SJann Horn */ 445294bac9SThomas Cedeno struct setid_rule { 451cd02a27SJann Horn struct hlist_node next; 465294bac9SThomas Cedeno kid_t src_id; 475294bac9SThomas Cedeno kid_t dst_id; 485294bac9SThomas Cedeno 495294bac9SThomas Cedeno /* Flag to signal if rule is for UID's or GID's */ 505294bac9SThomas Cedeno enum setid_type type; 511cd02a27SJann Horn }; 521cd02a27SJann Horn 5303638e62SJann Horn #define SETID_HASH_BITS 8 /* 256 buckets in hash table */ 54aeca4e2cSMicah Morton 555294bac9SThomas Cedeno /* Extension of INVALID_UID/INVALID_GID for kid_t type */ 565294bac9SThomas Cedeno #define INVALID_ID (kid_t){.uid = INVALID_UID} 575294bac9SThomas Cedeno 585294bac9SThomas Cedeno struct setid_ruleset { 5903638e62SJann Horn DECLARE_HASHTABLE(rules, SETID_HASH_BITS); 60fbd9acb2SJann Horn char *policy_str; 6103638e62SJann Horn struct rcu_head rcu; 625294bac9SThomas Cedeno 635294bac9SThomas Cedeno //Flag to signal if ruleset is for UID's or GID's 645294bac9SThomas Cedeno enum setid_type type; 6503638e62SJann Horn }; 6603638e62SJann Horn 675294bac9SThomas Cedeno enum sid_policy_type _setid_policy_lookup(struct setid_ruleset *policy, 685294bac9SThomas Cedeno kid_t src, kid_t dst); 6903638e62SJann Horn 705294bac9SThomas Cedeno extern struct setid_ruleset __rcu *safesetid_setuid_rules; 715294bac9SThomas Cedeno extern struct setid_ruleset __rcu *safesetid_setgid_rules; 72aeca4e2cSMicah Morton 73aeca4e2cSMicah Morton #endif /* _SAFESETID_H */ 74