starnix_core/security/
mod.rs

1// Copyright 2024 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5//! This module provides types and hook APIs supporting Linux Security Modules
6//! functionality in Starnix.  LSM provides a generic set of hooks, and opaque
7//! types, used to decouple the rest of the kernel from the details of any
8//! specific security enforcement subsystem (e.g. SELinux, POSIX.1e, etc).
9//!
10//! Although this module is hard-wired to the SELinux implementation, callers
11//! should treat the types as opaque; hook implementations necessarily have access
12//! to kernel structures, but not the other way around.
13
14use selinux::{SecurityId, SecurityServer};
15use std::sync::Arc;
16
17/// SELinux implementations called by the LSM hooks.
18mod selinux_hooks;
19pub use selinux_hooks::audit::Auditable;
20
21/// Common capabilities hook implementations called by the LSM hooks.
22mod common_cap;
23
24/// YAMA hook implementations used to restirct ptrace access.
25pub mod yama;
26
27/// Linux Security Modules hooks for use within the Starnix kernel.
28mod hooks;
29pub use hooks::*;
30
31/// Audit logging to be used from different kernel components
32mod audit;
33pub use audit::*;
34
35/// Opaque structure encapsulating security subsystem state for the whole system.
36pub struct KernelState {
37    state: Option<selinux_hooks::KernelState>,
38}
39
40impl KernelState {
41    pub fn access_denial_count(&self) -> u64 {
42        self.state.as_ref().map_or(0u64, |state| state.access_denial_count())
43    }
44}
45
46/// Opaque structure holding security state for an [`crate::vfs::FsNode`].
47#[derive(Debug, Default)]
48pub struct FsNodeState {
49    selinux: selinux_hooks::FsNodeState,
50    common_cap: common_cap::FsNodeState,
51}
52
53/// Opaque structure holding security state for a [`crate::vfs::socket::Socket`].
54#[derive(Debug, Default)]
55pub struct SocketState {
56    state: selinux_hooks::SocketState,
57}
58
59/// Opaque structure holding security state for a [`crate::vfs::FileObject`].
60#[derive(Debug)]
61pub struct FileObjectState {
62    state: selinux_hooks::FileObjectState,
63}
64
65/// Opaque structure holding security state for a [`crate::vfs::FileSystem`].
66#[derive(Debug)]
67pub struct FileSystemState {
68    state: selinux_hooks::FileSystemState,
69}
70
71/// Opaque structure holding security state for a bpf [`ebpf_api::maps::Map`].
72#[derive(Debug)]
73pub struct BpfMapState {
74    state: selinux_hooks::BpfMapState,
75}
76
77/// Opaque structure holding security state for a bpf [`crate::bpf::program::Program`].
78#[derive(Debug)]
79pub struct BpfProgState {
80    state: selinux_hooks::BpfProgState,
81}
82
83/// Opaque structure holding security state for a PerfEventFileState.
84#[derive(Debug)]
85pub struct PerfEventState {
86    state: selinux_hooks::PerfEventState,
87}
88
89/// Opaque structure holding security state for a current task.
90#[derive(Default, Debug)]
91pub struct CurrentTaskState {
92    pub state: selinux_hooks::CurrentTaskState,
93}
starnix_core/security/mod.rs

starnix_core/security/
mod.rs
