security.h 108 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761276227632764276527662767276827692770277127722773277427752776277727782779278027812782278327842785278627872788278927902791279227932794279527962797279827992800280128022803280428052806280728082809281028112812281328142815281628172818281928202821282228232824282528262827282828292830283128322833283428352836283728382839284028412842284328442845284628472848284928502851285228532854285528562857285828592860286128622863286428652866286728682869287028712872287328742875287628772878287928802881288228832884288528862887288828892890289128922893289428952896289728982899290029012902290329042905290629072908290929102911291229132914291529162917291829192920292129222923292429252926292729282929293029312932293329342935293629372938293929402941294229432944294529462947294829492950295129522953295429552956295729582959296029612962296329642965296629672968296929702971297229732974297529762977297829792980298129822983298429852986298729882989299029912992299329942995299629972998299930003001300230033004300530063007300830093010301130123013301430153016301730183019302030213022302330243025302630273028302930303031303230333034303530363037303830393040304130423043304430453046304730483049305030513052305330543055305630573058305930603061306230633064306530663067306830693070307130723073307430753076307730783079308030813082308330843085308630873088308930903091309230933094309530963097309830993100310131023103310431053106310731083109311031113112311331143115311631173118311931203121312231233124312531263127312831293130313131323133313431353136313731383139314031413142314331443145314631473148314931503151315231533154315531563157315831593160316131623163316431653166316731683169317031713172317331743175317631773178317931803181318231833184318531863187318831893190319131923193319431953196319731983199320032013202320332043205320632073208320932103211321232133214321532163217321832193220322132223223322432253226322732283229323032313232323332343235323632373238323932403241324232433244324532463247324832493250325132523253325432553256325732583259326032613262326332643265326632673268326932703271327232733274327532763277327832793280328132823283328432853286328732883289329032913292329332943295329632973298329933003301
  1. /*
  2. * Linux Security plug
  3. *
  4. * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
  5. * Copyright (C) 2001 Greg Kroah-Hartman <greg@kroah.com>
  6. * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
  7. * Copyright (C) 2001 James Morris <jmorris@intercode.com.au>
  8. * Copyright (C) 2001 Silicon Graphics, Inc. (Trust Technology Group)
  9. *
  10. * This program is free software; you can redistribute it and/or modify
  11. * it under the terms of the GNU General Public License as published by
  12. * the Free Software Foundation; either version 2 of the License, or
  13. * (at your option) any later version.
  14. *
  15. * Due to this file being licensed under the GPL there is controversy over
  16. * whether this permits you to write a module that #includes this file
  17. * without placing your module under the GPL. Please consult a lawyer for
  18. * advice before doing this.
  19. *
  20. */
  21. #ifndef __LINUX_SECURITY_H
  22. #define __LINUX_SECURITY_H
  23. #include <linux/fs.h>
  24. #include <linux/binfmts.h>
  25. #include <linux/signal.h>
  26. #include <linux/resource.h>
  27. #include <linux/sem.h>
  28. #include <linux/shm.h>
  29. #include <linux/msg.h>
  30. #include <linux/sched.h>
  31. #include <linux/key.h>
  32. #include <linux/xfrm.h>
  33. #include <net/flow.h>
  34. struct ctl_table;
  35. /*
  36. * These functions are in security/capability.c and are used
  37. * as the default capabilities functions
  38. */
  39. extern int cap_capable (struct task_struct *tsk, int cap);
  40. extern int cap_settime (struct timespec *ts, struct timezone *tz);
  41. extern int cap_ptrace (struct task_struct *parent, struct task_struct *child);
  42. extern int cap_capget (struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
  43. extern int cap_capset_check (struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
  44. extern void cap_capset_set (struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
  45. extern int cap_bprm_set_security (struct linux_binprm *bprm);
  46. extern void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe);
  47. extern int cap_bprm_secureexec(struct linux_binprm *bprm);
  48. extern int cap_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags);
  49. extern int cap_inode_removexattr(struct dentry *dentry, char *name);
  50. extern int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid, int flags);
  51. extern void cap_task_reparent_to_init (struct task_struct *p);
  52. extern int cap_syslog (int type);
  53. extern int cap_vm_enough_memory (long pages);
  54. struct msghdr;
  55. struct sk_buff;
  56. struct sock;
  57. struct sockaddr;
  58. struct socket;
  59. struct flowi;
  60. struct dst_entry;
  61. struct xfrm_selector;
  62. struct xfrm_policy;
  63. struct xfrm_state;
  64. struct xfrm_user_sec_ctx;
  65. extern int cap_netlink_send(struct sock *sk, struct sk_buff *skb);
  66. extern int cap_netlink_recv(struct sk_buff *skb, int cap);
  67. /*
  68. * Values used in the task_security_ops calls
  69. */
  70. /* setuid or setgid, id0 == uid or gid */
  71. #define LSM_SETID_ID 1
  72. /* setreuid or setregid, id0 == real, id1 == eff */
  73. #define LSM_SETID_RE 2
  74. /* setresuid or setresgid, id0 == real, id1 == eff, uid2 == saved */
  75. #define LSM_SETID_RES 4
  76. /* setfsuid or setfsgid, id0 == fsuid or fsgid */
  77. #define LSM_SETID_FS 8
  78. /* forward declares to avoid warnings */
  79. struct nfsctl_arg;
  80. struct sched_param;
  81. struct swap_info_struct;
  82. struct request_sock;
  83. /* bprm_apply_creds unsafe reasons */
  84. #define LSM_UNSAFE_SHARE 1
  85. #define LSM_UNSAFE_PTRACE 2
  86. #define LSM_UNSAFE_PTRACE_CAP 4
  87. #ifdef CONFIG_SECURITY
  88. /**
  89. * struct security_operations - main security structure
  90. *
  91. * Security hooks for program execution operations.
  92. *
  93. * @bprm_alloc_security:
  94. * Allocate and attach a security structure to the @bprm->security field.
  95. * The security field is initialized to NULL when the bprm structure is
  96. * allocated.
  97. * @bprm contains the linux_binprm structure to be modified.
  98. * Return 0 if operation was successful.
  99. * @bprm_free_security:
  100. * @bprm contains the linux_binprm structure to be modified.
  101. * Deallocate and clear the @bprm->security field.
  102. * @bprm_apply_creds:
  103. * Compute and set the security attributes of a process being transformed
  104. * by an execve operation based on the old attributes (current->security)
  105. * and the information saved in @bprm->security by the set_security hook.
  106. * Since this hook function (and its caller) are void, this hook can not
  107. * return an error. However, it can leave the security attributes of the
  108. * process unchanged if an access failure occurs at this point.
  109. * bprm_apply_creds is called under task_lock. @unsafe indicates various
  110. * reasons why it may be unsafe to change security state.
  111. * @bprm contains the linux_binprm structure.
  112. * @bprm_post_apply_creds:
  113. * Runs after bprm_apply_creds with the task_lock dropped, so that
  114. * functions which cannot be called safely under the task_lock can
  115. * be used. This hook is a good place to perform state changes on
  116. * the process such as closing open file descriptors to which access
  117. * is no longer granted if the attributes were changed.
  118. * Note that a security module might need to save state between
  119. * bprm_apply_creds and bprm_post_apply_creds to store the decision
  120. * on whether the process may proceed.
  121. * @bprm contains the linux_binprm structure.
  122. * @bprm_set_security:
  123. * Save security information in the bprm->security field, typically based
  124. * on information about the bprm->file, for later use by the apply_creds
  125. * hook. This hook may also optionally check permissions (e.g. for
  126. * transitions between security domains).
  127. * This hook may be called multiple times during a single execve, e.g. for
  128. * interpreters. The hook can tell whether it has already been called by
  129. * checking to see if @bprm->security is non-NULL. If so, then the hook
  130. * may decide either to retain the security information saved earlier or
  131. * to replace it.
  132. * @bprm contains the linux_binprm structure.
  133. * Return 0 if the hook is successful and permission is granted.
  134. * @bprm_check_security:
  135. * This hook mediates the point when a search for a binary handler will
  136. * begin. It allows a check the @bprm->security value which is set in
  137. * the preceding set_security call. The primary difference from
  138. * set_security is that the argv list and envp list are reliably
  139. * available in @bprm. This hook may be called multiple times
  140. * during a single execve; and in each pass set_security is called
  141. * first.
  142. * @bprm contains the linux_binprm structure.
  143. * Return 0 if the hook is successful and permission is granted.
  144. * @bprm_secureexec:
  145. * Return a boolean value (0 or 1) indicating whether a "secure exec"
  146. * is required. The flag is passed in the auxiliary table
  147. * on the initial stack to the ELF interpreter to indicate whether libc
  148. * should enable secure mode.
  149. * @bprm contains the linux_binprm structure.
  150. *
  151. * Security hooks for filesystem operations.
  152. *
  153. * @sb_alloc_security:
  154. * Allocate and attach a security structure to the sb->s_security field.
  155. * The s_security field is initialized to NULL when the structure is
  156. * allocated.
  157. * @sb contains the super_block structure to be modified.
  158. * Return 0 if operation was successful.
  159. * @sb_free_security:
  160. * Deallocate and clear the sb->s_security field.
  161. * @sb contains the super_block structure to be modified.
  162. * @sb_statfs:
  163. * Check permission before obtaining filesystem statistics for the @mnt
  164. * mountpoint.
  165. * @dentry is a handle on the superblock for the filesystem.
  166. * Return 0 if permission is granted.
  167. * @sb_mount:
  168. * Check permission before an object specified by @dev_name is mounted on
  169. * the mount point named by @nd. For an ordinary mount, @dev_name
  170. * identifies a device if the file system type requires a device. For a
  171. * remount (@flags & MS_REMOUNT), @dev_name is irrelevant. For a
  172. * loopback/bind mount (@flags & MS_BIND), @dev_name identifies the
  173. * pathname of the object being mounted.
  174. * @dev_name contains the name for object being mounted.
  175. * @nd contains the nameidata structure for mount point object.
  176. * @type contains the filesystem type.
  177. * @flags contains the mount flags.
  178. * @data contains the filesystem-specific data.
  179. * Return 0 if permission is granted.
  180. * @sb_copy_data:
  181. * Allow mount option data to be copied prior to parsing by the filesystem,
  182. * so that the security module can extract security-specific mount
  183. * options cleanly (a filesystem may modify the data e.g. with strsep()).
  184. * This also allows the original mount data to be stripped of security-
  185. * specific options to avoid having to make filesystems aware of them.
  186. * @type the type of filesystem being mounted.
  187. * @orig the original mount data copied from userspace.
  188. * @copy copied data which will be passed to the security module.
  189. * Returns 0 if the copy was successful.
  190. * @sb_check_sb:
  191. * Check permission before the device with superblock @mnt->sb is mounted
  192. * on the mount point named by @nd.
  193. * @mnt contains the vfsmount for device being mounted.
  194. * @nd contains the nameidata object for the mount point.
  195. * Return 0 if permission is granted.
  196. * @sb_umount:
  197. * Check permission before the @mnt file system is unmounted.
  198. * @mnt contains the mounted file system.
  199. * @flags contains the unmount flags, e.g. MNT_FORCE.
  200. * Return 0 if permission is granted.
  201. * @sb_umount_close:
  202. * Close any files in the @mnt mounted filesystem that are held open by
  203. * the security module. This hook is called during an umount operation
  204. * prior to checking whether the filesystem is still busy.
  205. * @mnt contains the mounted filesystem.
  206. * @sb_umount_busy:
  207. * Handle a failed umount of the @mnt mounted filesystem, e.g. re-opening
  208. * any files that were closed by umount_close. This hook is called during
  209. * an umount operation if the umount fails after a call to the
  210. * umount_close hook.
  211. * @mnt contains the mounted filesystem.
  212. * @sb_post_remount:
  213. * Update the security module's state when a filesystem is remounted.
  214. * This hook is only called if the remount was successful.
  215. * @mnt contains the mounted file system.
  216. * @flags contains the new filesystem flags.
  217. * @data contains the filesystem-specific data.
  218. * @sb_post_mountroot:
  219. * Update the security module's state when the root filesystem is mounted.
  220. * This hook is only called if the mount was successful.
  221. * @sb_post_addmount:
  222. * Update the security module's state when a filesystem is mounted.
  223. * This hook is called any time a mount is successfully grafetd to
  224. * the tree.
  225. * @mnt contains the mounted filesystem.
  226. * @mountpoint_nd contains the nameidata structure for the mount point.
  227. * @sb_pivotroot:
  228. * Check permission before pivoting the root filesystem.
  229. * @old_nd contains the nameidata structure for the new location of the current root (put_old).
  230. * @new_nd contains the nameidata structure for the new root (new_root).
  231. * Return 0 if permission is granted.
  232. * @sb_post_pivotroot:
  233. * Update module state after a successful pivot.
  234. * @old_nd contains the nameidata structure for the old root.
  235. * @new_nd contains the nameidata structure for the new root.
  236. *
  237. * Security hooks for inode operations.
  238. *
  239. * @inode_alloc_security:
  240. * Allocate and attach a security structure to @inode->i_security. The
  241. * i_security field is initialized to NULL when the inode structure is
  242. * allocated.
  243. * @inode contains the inode structure.
  244. * Return 0 if operation was successful.
  245. * @inode_free_security:
  246. * @inode contains the inode structure.
  247. * Deallocate the inode security structure and set @inode->i_security to
  248. * NULL.
  249. * @inode_init_security:
  250. * Obtain the security attribute name suffix and value to set on a newly
  251. * created inode and set up the incore security field for the new inode.
  252. * This hook is called by the fs code as part of the inode creation
  253. * transaction and provides for atomic labeling of the inode, unlike
  254. * the post_create/mkdir/... hooks called by the VFS. The hook function
  255. * is expected to allocate the name and value via kmalloc, with the caller
  256. * being responsible for calling kfree after using them.
  257. * If the security module does not use security attributes or does
  258. * not wish to put a security attribute on this particular inode,
  259. * then it should return -EOPNOTSUPP to skip this processing.
  260. * @inode contains the inode structure of the newly created inode.
  261. * @dir contains the inode structure of the parent directory.
  262. * @name will be set to the allocated name suffix (e.g. selinux).
  263. * @value will be set to the allocated attribute value.
  264. * @len will be set to the length of the value.
  265. * Returns 0 if @name and @value have been successfully set,
  266. * -EOPNOTSUPP if no security attribute is needed, or
  267. * -ENOMEM on memory allocation failure.
  268. * @inode_create:
  269. * Check permission to create a regular file.
  270. * @dir contains inode structure of the parent of the new file.
  271. * @dentry contains the dentry structure for the file to be created.
  272. * @mode contains the file mode of the file to be created.
  273. * Return 0 if permission is granted.
  274. * @inode_link:
  275. * Check permission before creating a new hard link to a file.
  276. * @old_dentry contains the dentry structure for an existing link to the file.
  277. * @dir contains the inode structure of the parent directory of the new link.
  278. * @new_dentry contains the dentry structure for the new link.
  279. * Return 0 if permission is granted.
  280. * @inode_unlink:
  281. * Check the permission to remove a hard link to a file.
  282. * @dir contains the inode structure of parent directory of the file.
  283. * @dentry contains the dentry structure for file to be unlinked.
  284. * Return 0 if permission is granted.
  285. * @inode_symlink:
  286. * Check the permission to create a symbolic link to a file.
  287. * @dir contains the inode structure of parent directory of the symbolic link.
  288. * @dentry contains the dentry structure of the symbolic link.
  289. * @old_name contains the pathname of file.
  290. * Return 0 if permission is granted.
  291. * @inode_mkdir:
  292. * Check permissions to create a new directory in the existing directory
  293. * associated with inode strcture @dir.
  294. * @dir containst the inode structure of parent of the directory to be created.
  295. * @dentry contains the dentry structure of new directory.
  296. * @mode contains the mode of new directory.
  297. * Return 0 if permission is granted.
  298. * @inode_rmdir:
  299. * Check the permission to remove a directory.
  300. * @dir contains the inode structure of parent of the directory to be removed.
  301. * @dentry contains the dentry structure of directory to be removed.
  302. * Return 0 if permission is granted.
  303. * @inode_mknod:
  304. * Check permissions when creating a special file (or a socket or a fifo
  305. * file created via the mknod system call). Note that if mknod operation
  306. * is being done for a regular file, then the create hook will be called
  307. * and not this hook.
  308. * @dir contains the inode structure of parent of the new file.
  309. * @dentry contains the dentry structure of the new file.
  310. * @mode contains the mode of the new file.
  311. * @dev contains the the device number.
  312. * Return 0 if permission is granted.
  313. * @inode_rename:
  314. * Check for permission to rename a file or directory.
  315. * @old_dir contains the inode structure for parent of the old link.
  316. * @old_dentry contains the dentry structure of the old link.
  317. * @new_dir contains the inode structure for parent of the new link.
  318. * @new_dentry contains the dentry structure of the new link.
  319. * Return 0 if permission is granted.
  320. * @inode_readlink:
  321. * Check the permission to read the symbolic link.
  322. * @dentry contains the dentry structure for the file link.
  323. * Return 0 if permission is granted.
  324. * @inode_follow_link:
  325. * Check permission to follow a symbolic link when looking up a pathname.
  326. * @dentry contains the dentry structure for the link.
  327. * @nd contains the nameidata structure for the parent directory.
  328. * Return 0 if permission is granted.
  329. * @inode_permission:
  330. * Check permission before accessing an inode. This hook is called by the
  331. * existing Linux permission function, so a security module can use it to
  332. * provide additional checking for existing Linux permission checks.
  333. * Notice that this hook is called when a file is opened (as well as many
  334. * other operations), whereas the file_security_ops permission hook is
  335. * called when the actual read/write operations are performed.
  336. * @inode contains the inode structure to check.
  337. * @mask contains the permission mask.
  338. * @nd contains the nameidata (may be NULL).
  339. * Return 0 if permission is granted.
  340. * @inode_setattr:
  341. * Check permission before setting file attributes. Note that the kernel
  342. * call to notify_change is performed from several locations, whenever
  343. * file attributes change (such as when a file is truncated, chown/chmod
  344. * operations, transferring disk quotas, etc).
  345. * @dentry contains the dentry structure for the file.
  346. * @attr is the iattr structure containing the new file attributes.
  347. * Return 0 if permission is granted.
  348. * @inode_getattr:
  349. * Check permission before obtaining file attributes.
  350. * @mnt is the vfsmount where the dentry was looked up
  351. * @dentry contains the dentry structure for the file.
  352. * Return 0 if permission is granted.
  353. * @inode_delete:
  354. * @inode contains the inode structure for deleted inode.
  355. * This hook is called when a deleted inode is released (i.e. an inode
  356. * with no hard links has its use count drop to zero). A security module
  357. * can use this hook to release any persistent label associated with the
  358. * inode.
  359. * @inode_setxattr:
  360. * Check permission before setting the extended attributes
  361. * @value identified by @name for @dentry.
  362. * Return 0 if permission is granted.
  363. * @inode_post_setxattr:
  364. * Update inode security field after successful setxattr operation.
  365. * @value identified by @name for @dentry.
  366. * @inode_getxattr:
  367. * Check permission before obtaining the extended attributes
  368. * identified by @name for @dentry.
  369. * Return 0 if permission is granted.
  370. * @inode_listxattr:
  371. * Check permission before obtaining the list of extended attribute
  372. * names for @dentry.
  373. * Return 0 if permission is granted.
  374. * @inode_removexattr:
  375. * Check permission before removing the extended attribute
  376. * identified by @name for @dentry.
  377. * Return 0 if permission is granted.
  378. * @inode_getsecurity:
  379. * Copy the extended attribute representation of the security label
  380. * associated with @name for @inode into @buffer. @buffer may be
  381. * NULL to request the size of the buffer required. @size indicates
  382. * the size of @buffer in bytes. Note that @name is the remainder
  383. * of the attribute name after the security. prefix has been removed.
  384. * @err is the return value from the preceding fs getxattr call,
  385. * and can be used by the security module to determine whether it
  386. * should try and canonicalize the attribute value.
  387. * Return number of bytes used/required on success.
  388. * @inode_setsecurity:
  389. * Set the security label associated with @name for @inode from the
  390. * extended attribute value @value. @size indicates the size of the
  391. * @value in bytes. @flags may be XATTR_CREATE, XATTR_REPLACE, or 0.
  392. * Note that @name is the remainder of the attribute name after the
  393. * security. prefix has been removed.
  394. * Return 0 on success.
  395. * @inode_listsecurity:
  396. * Copy the extended attribute names for the security labels
  397. * associated with @inode into @buffer. The maximum size of @buffer
  398. * is specified by @buffer_size. @buffer may be NULL to request
  399. * the size of the buffer required.
  400. * Returns number of bytes used/required on success.
  401. *
  402. * Security hooks for file operations
  403. *
  404. * @file_permission:
  405. * Check file permissions before accessing an open file. This hook is
  406. * called by various operations that read or write files. A security
  407. * module can use this hook to perform additional checking on these
  408. * operations, e.g. to revalidate permissions on use to support privilege
  409. * bracketing or policy changes. Notice that this hook is used when the
  410. * actual read/write operations are performed, whereas the
  411. * inode_security_ops hook is called when a file is opened (as well as
  412. * many other operations).
  413. * Caveat: Although this hook can be used to revalidate permissions for
  414. * various system call operations that read or write files, it does not
  415. * address the revalidation of permissions for memory-mapped files.
  416. * Security modules must handle this separately if they need such
  417. * revalidation.
  418. * @file contains the file structure being accessed.
  419. * @mask contains the requested permissions.
  420. * Return 0 if permission is granted.
  421. * @file_alloc_security:
  422. * Allocate and attach a security structure to the file->f_security field.
  423. * The security field is initialized to NULL when the structure is first
  424. * created.
  425. * @file contains the file structure to secure.
  426. * Return 0 if the hook is successful and permission is granted.
  427. * @file_free_security:
  428. * Deallocate and free any security structures stored in file->f_security.
  429. * @file contains the file structure being modified.
  430. * @file_ioctl:
  431. * @file contains the file structure.
  432. * @cmd contains the operation to perform.
  433. * @arg contains the operational arguments.
  434. * Check permission for an ioctl operation on @file. Note that @arg can
  435. * sometimes represents a user space pointer; in other cases, it may be a
  436. * simple integer value. When @arg represents a user space pointer, it
  437. * should never be used by the security module.
  438. * Return 0 if permission is granted.
  439. * @file_mmap :
  440. * Check permissions for a mmap operation. The @file may be NULL, e.g.
  441. * if mapping anonymous memory.
  442. * @file contains the file structure for file to map (may be NULL).
  443. * @reqprot contains the protection requested by the application.
  444. * @prot contains the protection that will be applied by the kernel.
  445. * @flags contains the operational flags.
  446. * Return 0 if permission is granted.
  447. * @file_mprotect:
  448. * Check permissions before changing memory access permissions.
  449. * @vma contains the memory region to modify.
  450. * @reqprot contains the protection requested by the application.
  451. * @prot contains the protection that will be applied by the kernel.
  452. * Return 0 if permission is granted.
  453. * @file_lock:
  454. * Check permission before performing file locking operations.
  455. * Note: this hook mediates both flock and fcntl style locks.
  456. * @file contains the file structure.
  457. * @cmd contains the posix-translated lock operation to perform
  458. * (e.g. F_RDLCK, F_WRLCK).
  459. * Return 0 if permission is granted.
  460. * @file_fcntl:
  461. * Check permission before allowing the file operation specified by @cmd
  462. * from being performed on the file @file. Note that @arg can sometimes
  463. * represents a user space pointer; in other cases, it may be a simple
  464. * integer value. When @arg represents a user space pointer, it should
  465. * never be used by the security module.
  466. * @file contains the file structure.
  467. * @cmd contains the operation to be performed.
  468. * @arg contains the operational arguments.
  469. * Return 0 if permission is granted.
  470. * @file_set_fowner:
  471. * Save owner security information (typically from current->security) in
  472. * file->f_security for later use by the send_sigiotask hook.
  473. * @file contains the file structure to update.
  474. * Return 0 on success.
  475. * @file_send_sigiotask:
  476. * Check permission for the file owner @fown to send SIGIO or SIGURG to the
  477. * process @tsk. Note that this hook is sometimes called from interrupt.
  478. * Note that the fown_struct, @fown, is never outside the context of a
  479. * struct file, so the file structure (and associated security information)
  480. * can always be obtained:
  481. * container_of(fown, struct file, f_owner)
  482. * @tsk contains the structure of task receiving signal.
  483. * @fown contains the file owner information.
  484. * @sig is the signal that will be sent. When 0, kernel sends SIGIO.
  485. * Return 0 if permission is granted.
  486. * @file_receive:
  487. * This hook allows security modules to control the ability of a process
  488. * to receive an open file descriptor via socket IPC.
  489. * @file contains the file structure being received.
  490. * Return 0 if permission is granted.
  491. *
  492. * Security hooks for task operations.
  493. *
  494. * @task_create:
  495. * Check permission before creating a child process. See the clone(2)
  496. * manual page for definitions of the @clone_flags.
  497. * @clone_flags contains the flags indicating what should be shared.
  498. * Return 0 if permission is granted.
  499. * @task_alloc_security:
  500. * @p contains the task_struct for child process.
  501. * Allocate and attach a security structure to the p->security field. The
  502. * security field is initialized to NULL when the task structure is
  503. * allocated.
  504. * Return 0 if operation was successful.
  505. * @task_free_security:
  506. * @p contains the task_struct for process.
  507. * Deallocate and clear the p->security field.
  508. * @task_setuid:
  509. * Check permission before setting one or more of the user identity
  510. * attributes of the current process. The @flags parameter indicates
  511. * which of the set*uid system calls invoked this hook and how to
  512. * interpret the @id0, @id1, and @id2 parameters. See the LSM_SETID
  513. * definitions at the beginning of this file for the @flags values and
  514. * their meanings.
  515. * @id0 contains a uid.
  516. * @id1 contains a uid.
  517. * @id2 contains a uid.
  518. * @flags contains one of the LSM_SETID_* values.
  519. * Return 0 if permission is granted.
  520. * @task_post_setuid:
  521. * Update the module's state after setting one or more of the user
  522. * identity attributes of the current process. The @flags parameter
  523. * indicates which of the set*uid system calls invoked this hook. If
  524. * @flags is LSM_SETID_FS, then @old_ruid is the old fs uid and the other
  525. * parameters are not used.
  526. * @old_ruid contains the old real uid (or fs uid if LSM_SETID_FS).
  527. * @old_euid contains the old effective uid (or -1 if LSM_SETID_FS).
  528. * @old_suid contains the old saved uid (or -1 if LSM_SETID_FS).
  529. * @flags contains one of the LSM_SETID_* values.
  530. * Return 0 on success.
  531. * @task_setgid:
  532. * Check permission before setting one or more of the group identity
  533. * attributes of the current process. The @flags parameter indicates
  534. * which of the set*gid system calls invoked this hook and how to
  535. * interpret the @id0, @id1, and @id2 parameters. See the LSM_SETID
  536. * definitions at the beginning of this file for the @flags values and
  537. * their meanings.
  538. * @id0 contains a gid.
  539. * @id1 contains a gid.
  540. * @id2 contains a gid.
  541. * @flags contains one of the LSM_SETID_* values.
  542. * Return 0 if permission is granted.
  543. * @task_setpgid:
  544. * Check permission before setting the process group identifier of the
  545. * process @p to @pgid.
  546. * @p contains the task_struct for process being modified.
  547. * @pgid contains the new pgid.
  548. * Return 0 if permission is granted.
  549. * @task_getpgid:
  550. * Check permission before getting the process group identifier of the
  551. * process @p.
  552. * @p contains the task_struct for the process.
  553. * Return 0 if permission is granted.
  554. * @task_getsid:
  555. * Check permission before getting the session identifier of the process
  556. * @p.
  557. * @p contains the task_struct for the process.
  558. * Return 0 if permission is granted.
  559. * @task_getsecid:
  560. * Retrieve the security identifier of the process @p.
  561. * @p contains the task_struct for the process and place is into @secid.
  562. * @task_setgroups:
  563. * Check permission before setting the supplementary group set of the
  564. * current process.
  565. * @group_info contains the new group information.
  566. * Return 0 if permission is granted.
  567. * @task_setnice:
  568. * Check permission before setting the nice value of @p to @nice.
  569. * @p contains the task_struct of process.
  570. * @nice contains the new nice value.
  571. * Return 0 if permission is granted.
  572. * @task_setioprio
  573. * Check permission before setting the ioprio value of @p to @ioprio.
  574. * @p contains the task_struct of process.
  575. * @ioprio contains the new ioprio value
  576. * Return 0 if permission is granted.
  577. * @task_getioprio
  578. * Check permission before getting the ioprio value of @p.
  579. * @p contains the task_struct of process.
  580. * Return 0 if permission is granted.
  581. * @task_setrlimit:
  582. * Check permission before setting the resource limits of the current
  583. * process for @resource to @new_rlim. The old resource limit values can
  584. * be examined by dereferencing (current->signal->rlim + resource).
  585. * @resource contains the resource whose limit is being set.
  586. * @new_rlim contains the new limits for @resource.
  587. * Return 0 if permission is granted.
  588. * @task_setscheduler:
  589. * Check permission before setting scheduling policy and/or parameters of
  590. * process @p based on @policy and @lp.
  591. * @p contains the task_struct for process.
  592. * @policy contains the scheduling policy.
  593. * @lp contains the scheduling parameters.
  594. * Return 0 if permission is granted.
  595. * @task_getscheduler:
  596. * Check permission before obtaining scheduling information for process
  597. * @p.
  598. * @p contains the task_struct for process.
  599. * Return 0 if permission is granted.
  600. * @task_movememory
  601. * Check permission before moving memory owned by process @p.
  602. * @p contains the task_struct for process.
  603. * Return 0 if permission is granted.
  604. * @task_kill:
  605. * Check permission before sending signal @sig to @p. @info can be NULL,
  606. * the constant 1, or a pointer to a siginfo structure. If @info is 1 or
  607. * SI_FROMKERNEL(info) is true, then the signal should be viewed as coming
  608. * from the kernel and should typically be permitted.
  609. * SIGIO signals are handled separately by the send_sigiotask hook in
  610. * file_security_ops.
  611. * @p contains the task_struct for process.
  612. * @info contains the signal information.
  613. * @sig contains the signal value.
  614. * @secid contains the sid of the process where the signal originated
  615. * Return 0 if permission is granted.
  616. * @task_wait:
  617. * Check permission before allowing a process to reap a child process @p
  618. * and collect its status information.
  619. * @p contains the task_struct for process.
  620. * Return 0 if permission is granted.
  621. * @task_prctl:
  622. * Check permission before performing a process control operation on the
  623. * current process.
  624. * @option contains the operation.
  625. * @arg2 contains a argument.
  626. * @arg3 contains a argument.
  627. * @arg4 contains a argument.
  628. * @arg5 contains a argument.
  629. * Return 0 if permission is granted.
  630. * @task_reparent_to_init:
  631. * Set the security attributes in @p->security for a kernel thread that
  632. * is being reparented to the init task.
  633. * @p contains the task_struct for the kernel thread.
  634. * @task_to_inode:
  635. * Set the security attributes for an inode based on an associated task's
  636. * security attributes, e.g. for /proc/pid inodes.
  637. * @p contains the task_struct for the task.
  638. * @inode contains the inode structure for the inode.
  639. *
  640. * Security hooks for Netlink messaging.
  641. *
  642. * @netlink_send:
  643. * Save security information for a netlink message so that permission
  644. * checking can be performed when the message is processed. The security
  645. * information can be saved using the eff_cap field of the
  646. * netlink_skb_parms structure. Also may be used to provide fine
  647. * grained control over message transmission.
  648. * @sk associated sock of task sending the message.,
  649. * @skb contains the sk_buff structure for the netlink message.
  650. * Return 0 if the information was successfully saved and message
  651. * is allowed to be transmitted.
  652. * @netlink_recv:
  653. * Check permission before processing the received netlink message in
  654. * @skb.
  655. * @skb contains the sk_buff structure for the netlink message.
  656. * @cap indicates the capability required
  657. * Return 0 if permission is granted.
  658. *
  659. * Security hooks for Unix domain networking.
  660. *
  661. * @unix_stream_connect:
  662. * Check permissions before establishing a Unix domain stream connection
  663. * between @sock and @other.
  664. * @sock contains the socket structure.
  665. * @other contains the peer socket structure.
  666. * Return 0 if permission is granted.
  667. * @unix_may_send:
  668. * Check permissions before connecting or sending datagrams from @sock to
  669. * @other.
  670. * @sock contains the socket structure.
  671. * @sock contains the peer socket structure.
  672. * Return 0 if permission is granted.
  673. *
  674. * The @unix_stream_connect and @unix_may_send hooks were necessary because
  675. * Linux provides an alternative to the conventional file name space for Unix
  676. * domain sockets. Whereas binding and connecting to sockets in the file name
  677. * space is mediated by the typical file permissions (and caught by the mknod
  678. * and permission hooks in inode_security_ops), binding and connecting to
  679. * sockets in the abstract name space is completely unmediated. Sufficient
  680. * control of Unix domain sockets in the abstract name space isn't possible
  681. * using only the socket layer hooks, since we need to know the actual target
  682. * socket, which is not looked up until we are inside the af_unix code.
  683. *
  684. * Security hooks for socket operations.
  685. *
  686. * @socket_create:
  687. * Check permissions prior to creating a new socket.
  688. * @family contains the requested protocol family.
  689. * @type contains the requested communications type.
  690. * @protocol contains the requested protocol.
  691. * @kern set to 1 if a kernel socket.
  692. * Return 0 if permission is granted.
  693. * @socket_post_create:
  694. * This hook allows a module to update or allocate a per-socket security
  695. * structure. Note that the security field was not added directly to the
  696. * socket structure, but rather, the socket security information is stored
  697. * in the associated inode. Typically, the inode alloc_security hook will
  698. * allocate and and attach security information to
  699. * sock->inode->i_security. This hook may be used to update the
  700. * sock->inode->i_security field with additional information that wasn't
  701. * available when the inode was allocated.
  702. * @sock contains the newly created socket structure.
  703. * @family contains the requested protocol family.
  704. * @type contains the requested communications type.
  705. * @protocol contains the requested protocol.
  706. * @kern set to 1 if a kernel socket.
  707. * @socket_bind:
  708. * Check permission before socket protocol layer bind operation is
  709. * performed and the socket @sock is bound to the address specified in the
  710. * @address parameter.
  711. * @sock contains the socket structure.
  712. * @address contains the address to bind to.
  713. * @addrlen contains the length of address.
  714. * Return 0 if permission is granted.
  715. * @socket_connect:
  716. * Check permission before socket protocol layer connect operation
  717. * attempts to connect socket @sock to a remote address, @address.
  718. * @sock contains the socket structure.
  719. * @address contains the address of remote endpoint.
  720. * @addrlen contains the length of address.
  721. * Return 0 if permission is granted.
  722. * @socket_listen:
  723. * Check permission before socket protocol layer listen operation.
  724. * @sock contains the socket structure.
  725. * @backlog contains the maximum length for the pending connection queue.
  726. * Return 0 if permission is granted.
  727. * @socket_accept:
  728. * Check permission before accepting a new connection. Note that the new
  729. * socket, @newsock, has been created and some information copied to it,
  730. * but the accept operation has not actually been performed.
  731. * @sock contains the listening socket structure.
  732. * @newsock contains the newly created server socket for connection.
  733. * Return 0 if permission is granted.
  734. * @socket_post_accept:
  735. * This hook allows a security module to copy security
  736. * information into the newly created socket's inode.
  737. * @sock contains the listening socket structure.
  738. * @newsock contains the newly created server socket for connection.
  739. * @socket_sendmsg:
  740. * Check permission before transmitting a message to another socket.
  741. * @sock contains the socket structure.
  742. * @msg contains the message to be transmitted.
  743. * @size contains the size of message.
  744. * Return 0 if permission is granted.
  745. * @socket_recvmsg:
  746. * Check permission before receiving a message from a socket.
  747. * @sock contains the socket structure.
  748. * @msg contains the message structure.
  749. * @size contains the size of message structure.
  750. * @flags contains the operational flags.
  751. * Return 0 if permission is granted.
  752. * @socket_getsockname:
  753. * Check permission before the local address (name) of the socket object
  754. * @sock is retrieved.
  755. * @sock contains the socket structure.
  756. * Return 0 if permission is granted.
  757. * @socket_getpeername:
  758. * Check permission before the remote address (name) of a socket object
  759. * @sock is retrieved.
  760. * @sock contains the socket structure.
  761. * Return 0 if permission is granted.
  762. * @socket_getsockopt:
  763. * Check permissions before retrieving the options associated with socket
  764. * @sock.
  765. * @sock contains the socket structure.
  766. * @level contains the protocol level to retrieve option from.
  767. * @optname contains the name of option to retrieve.
  768. * Return 0 if permission is granted.
  769. * @socket_setsockopt:
  770. * Check permissions before setting the options associated with socket
  771. * @sock.
  772. * @sock contains the socket structure.
  773. * @level contains the protocol level to set options for.
  774. * @optname contains the name of the option to set.
  775. * Return 0 if permission is granted.
  776. * @socket_shutdown:
  777. * Checks permission before all or part of a connection on the socket
  778. * @sock is shut down.
  779. * @sock contains the socket structure.
  780. * @how contains the flag indicating how future sends and receives are handled.
  781. * Return 0 if permission is granted.
  782. * @socket_sock_rcv_skb:
  783. * Check permissions on incoming network packets. This hook is distinct
  784. * from Netfilter's IP input hooks since it is the first time that the
  785. * incoming sk_buff @skb has been associated with a particular socket, @sk.
  786. * @sk contains the sock (not socket) associated with the incoming sk_buff.
  787. * @skb contains the incoming network data.
  788. * @socket_getpeersec:
  789. * This hook allows the security module to provide peer socket security
  790. * state to userspace via getsockopt SO_GETPEERSEC.
  791. * @sock is the local socket.
  792. * @optval userspace memory where the security state is to be copied.
  793. * @optlen userspace int where the module should copy the actual length
  794. * of the security state.
  795. * @len as input is the maximum length to copy to userspace provided
  796. * by the caller.
  797. * Return 0 if all is well, otherwise, typical getsockopt return
  798. * values.
  799. * @sk_alloc_security:
  800. * Allocate and attach a security structure to the sk->sk_security field,
  801. * which is used to copy security attributes between local stream sockets.
  802. * @sk_free_security:
  803. * Deallocate security structure.
  804. * @sk_clone_security:
  805. * Clone/copy security structure.
  806. * @sk_getsecid:
  807. * Retrieve the LSM-specific secid for the sock to enable caching of network
  808. * authorizations.
  809. * @sock_graft:
  810. * Sets the socket's isec sid to the sock's sid.
  811. * @inet_conn_request:
  812. * Sets the openreq's sid to socket's sid with MLS portion taken from peer sid.
  813. * @inet_csk_clone:
  814. * Sets the new child socket's sid to the openreq sid.
  815. * @inet_conn_established:
  816. * Sets the connection's peersid to the secmark on skb.
  817. * @req_classify_flow:
  818. * Sets the flow's sid to the openreq sid.
  819. *
  820. * Security hooks for XFRM operations.
  821. *
  822. * @xfrm_policy_alloc_security:
  823. * @xp contains the xfrm_policy being added to Security Policy Database
  824. * used by the XFRM system.
  825. * @sec_ctx contains the security context information being provided by
  826. * the user-level policy update program (e.g., setkey).
  827. * Allocate a security structure to the xp->security field; the security
  828. * field is initialized to NULL when the xfrm_policy is allocated.
  829. * Return 0 if operation was successful (memory to allocate, legal context)
  830. * @xfrm_policy_clone_security:
  831. * @old contains an existing xfrm_policy in the SPD.
  832. * @new contains a new xfrm_policy being cloned from old.
  833. * Allocate a security structure to the new->security field
  834. * that contains the information from the old->security field.
  835. * Return 0 if operation was successful (memory to allocate).
  836. * @xfrm_policy_free_security:
  837. * @xp contains the xfrm_policy
  838. * Deallocate xp->security.
  839. * @xfrm_policy_delete_security:
  840. * @xp contains the xfrm_policy.
  841. * Authorize deletion of xp->security.
  842. * @xfrm_state_alloc_security:
  843. * @x contains the xfrm_state being added to the Security Association
  844. * Database by the XFRM system.
  845. * @sec_ctx contains the security context information being provided by
  846. * the user-level SA generation program (e.g., setkey or racoon).
  847. * @secid contains the secid from which to take the mls portion of the context.
  848. * Allocate a security structure to the x->security field; the security
  849. * field is initialized to NULL when the xfrm_state is allocated. Set the
  850. * context to correspond to either sec_ctx or polsec, with the mls portion
  851. * taken from secid in the latter case.
  852. * Return 0 if operation was successful (memory to allocate, legal context).
  853. * @xfrm_state_free_security:
  854. * @x contains the xfrm_state.
  855. * Deallocate x->security.
  856. * @xfrm_state_delete_security:
  857. * @x contains the xfrm_state.
  858. * Authorize deletion of x->security.
  859. * @xfrm_policy_lookup:
  860. * @xp contains the xfrm_policy for which the access control is being
  861. * checked.
  862. * @fl_secid contains the flow security label that is used to authorize
  863. * access to the policy xp.
  864. * @dir contains the direction of the flow (input or output).
  865. * Check permission when a flow selects a xfrm_policy for processing
  866. * XFRMs on a packet. The hook is called when selecting either a
  867. * per-socket policy or a generic xfrm policy.
  868. * Return 0 if permission is granted, -ESRCH otherwise, or -errno
  869. * on other errors.
  870. * @xfrm_state_pol_flow_match:
  871. * @x contains the state to match.
  872. * @xp contains the policy to check for a match.
  873. * @fl contains the flow to check for a match.
  874. * Return 1 if there is a match.
  875. * @xfrm_decode_session:
  876. * @skb points to skb to decode.
  877. * @secid points to the flow key secid to set.
  878. * @ckall says if all xfrms used should be checked for same secid.
  879. * Return 0 if ckall is zero or all xfrms used have the same secid.
  880. *
  881. * Security hooks affecting all Key Management operations
  882. *
  883. * @key_alloc:
  884. * Permit allocation of a key and assign security data. Note that key does
  885. * not have a serial number assigned at this point.
  886. * @key points to the key.
  887. * @flags is the allocation flags
  888. * Return 0 if permission is granted, -ve error otherwise.
  889. * @key_free:
  890. * Notification of destruction; free security data.
  891. * @key points to the key.
  892. * No return value.
  893. * @key_permission:
  894. * See whether a specific operational right is granted to a process on a
  895. * key.
  896. * @key_ref refers to the key (key pointer + possession attribute bit).
  897. * @context points to the process to provide the context against which to
  898. * evaluate the security data on the key.
  899. * @perm describes the combination of permissions required of this key.
  900. * Return 1 if permission granted, 0 if permission denied and -ve it the
  901. * normal permissions model should be effected.
  902. *
  903. * Security hooks affecting all System V IPC operations.
  904. *
  905. * @ipc_permission:
  906. * Check permissions for access to IPC
  907. * @ipcp contains the kernel IPC permission structure
  908. * @flag contains the desired (requested) permission set
  909. * Return 0 if permission is granted.
  910. *
  911. * Security hooks for individual messages held in System V IPC message queues
  912. * @msg_msg_alloc_security:
  913. * Allocate and attach a security structure to the msg->security field.
  914. * The security field is initialized to NULL when the structure is first
  915. * created.
  916. * @msg contains the message structure to be modified.
  917. * Return 0 if operation was successful and permission is granted.
  918. * @msg_msg_free_security:
  919. * Deallocate the security structure for this message.
  920. * @msg contains the message structure to be modified.
  921. *
  922. * Security hooks for System V IPC Message Queues
  923. *
  924. * @msg_queue_alloc_security:
  925. * Allocate and attach a security structure to the
  926. * msq->q_perm.security field. The security field is initialized to
  927. * NULL when the structure is first created.
  928. * @msq contains the message queue structure to be modified.
  929. * Return 0 if operation was successful and permission is granted.
  930. * @msg_queue_free_security:
  931. * Deallocate security structure for this message queue.
  932. * @msq contains the message queue structure to be modified.
  933. * @msg_queue_associate:
  934. * Check permission when a message queue is requested through the
  935. * msgget system call. This hook is only called when returning the
  936. * message queue identifier for an existing message queue, not when a
  937. * new message queue is created.
  938. * @msq contains the message queue to act upon.
  939. * @msqflg contains the operation control flags.
  940. * Return 0 if permission is granted.
  941. * @msg_queue_msgctl:
  942. * Check permission when a message control operation specified by @cmd
  943. * is to be performed on the message queue @msq.
  944. * The @msq may be NULL, e.g. for IPC_INFO or MSG_INFO.
  945. * @msq contains the message queue to act upon. May be NULL.
  946. * @cmd contains the operation to be performed.
  947. * Return 0 if permission is granted.
  948. * @msg_queue_msgsnd:
  949. * Check permission before a message, @msg, is enqueued on the message
  950. * queue, @msq.
  951. * @msq contains the message queue to send message to.
  952. * @msg contains the message to be enqueued.
  953. * @msqflg contains operational flags.
  954. * Return 0 if permission is granted.
  955. * @msg_queue_msgrcv:
  956. * Check permission before a message, @msg, is removed from the message
  957. * queue, @msq. The @target task structure contains a pointer to the
  958. * process that will be receiving the message (not equal to the current
  959. * process when inline receives are being performed).
  960. * @msq contains the message queue to retrieve message from.
  961. * @msg contains the message destination.
  962. * @target contains the task structure for recipient process.
  963. * @type contains the type of message requested.
  964. * @mode contains the operational flags.
  965. * Return 0 if permission is granted.
  966. *
  967. * Security hooks for System V Shared Memory Segments
  968. *
  969. * @shm_alloc_security:
  970. * Allocate and attach a security structure to the shp->shm_perm.security
  971. * field. The security field is initialized to NULL when the structure is
  972. * first created.
  973. * @shp contains the shared memory structure to be modified.
  974. * Return 0 if operation was successful and permission is granted.
  975. * @shm_free_security:
  976. * Deallocate the security struct for this memory segment.
  977. * @shp contains the shared memory structure to be modified.
  978. * @shm_associate:
  979. * Check permission when a shared memory region is requested through the
  980. * shmget system call. This hook is only called when returning the shared
  981. * memory region identifier for an existing region, not when a new shared
  982. * memory region is created.
  983. * @shp contains the shared memory structure to be modified.
  984. * @shmflg contains the operation control flags.
  985. * Return 0 if permission is granted.
  986. * @shm_shmctl:
  987. * Check permission when a shared memory control operation specified by
  988. * @cmd is to be performed on the shared memory region @shp.
  989. * The @shp may be NULL, e.g. for IPC_INFO or SHM_INFO.
  990. * @shp contains shared memory structure to be modified.
  991. * @cmd contains the operation to be performed.
  992. * Return 0 if permission is granted.
  993. * @shm_shmat:
  994. * Check permissions prior to allowing the shmat system call to attach the
  995. * shared memory segment @shp to the data segment of the calling process.
  996. * The attaching address is specified by @shmaddr.
  997. * @shp contains the shared memory structure to be modified.
  998. * @shmaddr contains the address to attach memory region to.
  999. * @shmflg contains the operational flags.
  1000. * Return 0 if permission is granted.
  1001. *
  1002. * Security hooks for System V Semaphores
  1003. *
  1004. * @sem_alloc_security:
  1005. * Allocate and attach a security structure to the sma->sem_perm.security
  1006. * field. The security field is initialized to NULL when the structure is
  1007. * first created.
  1008. * @sma contains the semaphore structure
  1009. * Return 0 if operation was successful and permission is granted.
  1010. * @sem_free_security:
  1011. * deallocate security struct for this semaphore
  1012. * @sma contains the semaphore structure.
  1013. * @sem_associate:
  1014. * Check permission when a semaphore is requested through the semget
  1015. * system call. This hook is only called when returning the semaphore
  1016. * identifier for an existing semaphore, not when a new one must be
  1017. * created.
  1018. * @sma contains the semaphore structure.
  1019. * @semflg contains the operation control flags.
  1020. * Return 0 if permission is granted.
  1021. * @sem_semctl:
  1022. * Check permission when a semaphore operation specified by @cmd is to be
  1023. * performed on the semaphore @sma. The @sma may be NULL, e.g. for
  1024. * IPC_INFO or SEM_INFO.
  1025. * @sma contains the semaphore structure. May be NULL.
  1026. * @cmd contains the operation to be performed.
  1027. * Return 0 if permission is granted.
  1028. * @sem_semop
  1029. * Check permissions before performing operations on members of the
  1030. * semaphore set @sma. If the @alter flag is nonzero, the semaphore set
  1031. * may be modified.
  1032. * @sma contains the semaphore structure.
  1033. * @sops contains the operations to perform.
  1034. * @nsops contains the number of operations to perform.
  1035. * @alter contains the flag indicating whether changes are to be made.
  1036. * Return 0 if permission is granted.
  1037. *
  1038. * @ptrace:
  1039. * Check permission before allowing the @parent process to trace the
  1040. * @child process.
  1041. * Security modules may also want to perform a process tracing check
  1042. * during an execve in the set_security or apply_creds hooks of
  1043. * binprm_security_ops if the process is being traced and its security
  1044. * attributes would be changed by the execve.
  1045. * @parent contains the task_struct structure for parent process.
  1046. * @child contains the task_struct structure for child process.
  1047. * Return 0 if permission is granted.
  1048. * @capget:
  1049. * Get the @effective, @inheritable, and @permitted capability sets for
  1050. * the @target process. The hook may also perform permission checking to
  1051. * determine if the current process is allowed to see the capability sets
  1052. * of the @target process.
  1053. * @target contains the task_struct structure for target process.
  1054. * @effective contains the effective capability set.
  1055. * @inheritable contains the inheritable capability set.
  1056. * @permitted contains the permitted capability set.
  1057. * Return 0 if the capability sets were successfully obtained.
  1058. * @capset_check:
  1059. * Check permission before setting the @effective, @inheritable, and
  1060. * @permitted capability sets for the @target process.
  1061. * Caveat: @target is also set to current if a set of processes is
  1062. * specified (i.e. all processes other than current and init or a
  1063. * particular process group). Hence, the capset_set hook may need to
  1064. * revalidate permission to the actual target process.
  1065. * @target contains the task_struct structure for target process.
  1066. * @effective contains the effective capability set.
  1067. * @inheritable contains the inheritable capability set.
  1068. * @permitted contains the permitted capability set.
  1069. * Return 0 if permission is granted.
  1070. * @capset_set:
  1071. * Set the @effective, @inheritable, and @permitted capability sets for
  1072. * the @target process. Since capset_check cannot always check permission
  1073. * to the real @target process, this hook may also perform permission
  1074. * checking to determine if the current process is allowed to set the
  1075. * capability sets of the @target process. However, this hook has no way
  1076. * of returning an error due to the structure of the sys_capset code.
  1077. * @target contains the task_struct structure for target process.
  1078. * @effective contains the effective capability set.
  1079. * @inheritable contains the inheritable capability set.
  1080. * @permitted contains the permitted capability set.
  1081. * @capable:
  1082. * Check whether the @tsk process has the @cap capability.
  1083. * @tsk contains the task_struct for the process.
  1084. * @cap contains the capability <include/linux/capability.h>.
  1085. * Return 0 if the capability is granted for @tsk.
  1086. * @acct:
  1087. * Check permission before enabling or disabling process accounting. If
  1088. * accounting is being enabled, then @file refers to the open file used to
  1089. * store accounting records. If accounting is being disabled, then @file
  1090. * is NULL.
  1091. * @file contains the file structure for the accounting file (may be NULL).
  1092. * Return 0 if permission is granted.
  1093. * @sysctl:
  1094. * Check permission before accessing the @table sysctl variable in the
  1095. * manner specified by @op.
  1096. * @table contains the ctl_table structure for the sysctl variable.
  1097. * @op contains the operation (001 = search, 002 = write, 004 = read).
  1098. * Return 0 if permission is granted.
  1099. * @syslog:
  1100. * Check permission before accessing the kernel message ring or changing
  1101. * logging to the console.
  1102. * See the syslog(2) manual page for an explanation of the @type values.
  1103. * @type contains the type of action.
  1104. * Return 0 if permission is granted.
  1105. * @settime:
  1106. * Check permission to change the system time.
  1107. * struct timespec and timezone are defined in include/linux/time.h
  1108. * @ts contains new time
  1109. * @tz contains new timezone
  1110. * Return 0 if permission is granted.
  1111. * @vm_enough_memory:
  1112. * Check permissions for allocating a new virtual mapping.
  1113. * @pages contains the number of pages.
  1114. * Return 0 if permission is granted.
  1115. *
  1116. * @register_security:
  1117. * allow module stacking.
  1118. * @name contains the name of the security module being stacked.
  1119. * @ops contains a pointer to the struct security_operations of the module to stack.
  1120. * @unregister_security:
  1121. * remove a stacked module.
  1122. * @name contains the name of the security module being unstacked.
  1123. * @ops contains a pointer to the struct security_operations of the module to unstack.
  1124. *
  1125. * @secid_to_secctx:
  1126. * Convert secid to security context.
  1127. * @secid contains the security ID.
  1128. * @secdata contains the pointer that stores the converted security context.
  1129. *
  1130. * @release_secctx:
  1131. * Release the security context.
  1132. * @secdata contains the security context.
  1133. * @seclen contains the length of the security context.
  1134. *
  1135. * This is the main security structure.
  1136. */
  1137. struct security_operations {
  1138. int (*ptrace) (struct task_struct * parent, struct task_struct * child);
  1139. int (*capget) (struct task_struct * target,
  1140. kernel_cap_t * effective,
  1141. kernel_cap_t * inheritable, kernel_cap_t * permitted);
  1142. int (*capset_check) (struct task_struct * target,
  1143. kernel_cap_t * effective,
  1144. kernel_cap_t * inheritable,
  1145. kernel_cap_t * permitted);
  1146. void (*capset_set) (struct task_struct * target,
  1147. kernel_cap_t * effective,
  1148. kernel_cap_t * inheritable,
  1149. kernel_cap_t * permitted);
  1150. int (*capable) (struct task_struct * tsk, int cap);
  1151. int (*acct) (struct file * file);
  1152. int (*sysctl) (struct ctl_table * table, int op);
  1153. int (*quotactl) (int cmds, int type, int id, struct super_block * sb);
  1154. int (*quota_on) (struct dentry * dentry);
  1155. int (*syslog) (int type);
  1156. int (*settime) (struct timespec *ts, struct timezone *tz);
  1157. int (*vm_enough_memory) (long pages);
  1158. int (*bprm_alloc_security) (struct linux_binprm * bprm);
  1159. void (*bprm_free_security) (struct linux_binprm * bprm);
  1160. void (*bprm_apply_creds) (struct linux_binprm * bprm, int unsafe);
  1161. void (*bprm_post_apply_creds) (struct linux_binprm * bprm);
  1162. int (*bprm_set_security) (struct linux_binprm * bprm);
  1163. int (*bprm_check_security) (struct linux_binprm * bprm);
  1164. int (*bprm_secureexec) (struct linux_binprm * bprm);
  1165. int (*sb_alloc_security) (struct super_block * sb);
  1166. void (*sb_free_security) (struct super_block * sb);
  1167. int (*sb_copy_data)(struct file_system_type *type,
  1168. void *orig, void *copy);
  1169. int (*sb_kern_mount) (struct super_block *sb, void *data);
  1170. int (*sb_statfs) (struct dentry *dentry);
  1171. int (*sb_mount) (char *dev_name, struct nameidata * nd,
  1172. char *type, unsigned long flags, void *data);
  1173. int (*sb_check_sb) (struct vfsmount * mnt, struct nameidata * nd);
  1174. int (*sb_umount) (struct vfsmount * mnt, int flags);
  1175. void (*sb_umount_close) (struct vfsmount * mnt);
  1176. void (*sb_umount_busy) (struct vfsmount * mnt);
  1177. void (*sb_post_remount) (struct vfsmount * mnt,
  1178. unsigned long flags, void *data);
  1179. void (*sb_post_mountroot) (void);
  1180. void (*sb_post_addmount) (struct vfsmount * mnt,
  1181. struct nameidata * mountpoint_nd);
  1182. int (*sb_pivotroot) (struct nameidata * old_nd,
  1183. struct nameidata * new_nd);
  1184. void (*sb_post_pivotroot) (struct nameidata * old_nd,
  1185. struct nameidata * new_nd);
  1186. int (*inode_alloc_security) (struct inode *inode);
  1187. void (*inode_free_security) (struct inode *inode);
  1188. int (*inode_init_security) (struct inode *inode, struct inode *dir,
  1189. char **name, void **value, size_t *len);
  1190. int (*inode_create) (struct inode *dir,
  1191. struct dentry *dentry, int mode);
  1192. int (*inode_link) (struct dentry *old_dentry,
  1193. struct inode *dir, struct dentry *new_dentry);
  1194. int (*inode_unlink) (struct inode *dir, struct dentry *dentry);
  1195. int (*inode_symlink) (struct inode *dir,
  1196. struct dentry *dentry, const char *old_name);
  1197. int (*inode_mkdir) (struct inode *dir, struct dentry *dentry, int mode);
  1198. int (*inode_rmdir) (struct inode *dir, struct dentry *dentry);
  1199. int (*inode_mknod) (struct inode *dir, struct dentry *dentry,
  1200. int mode, dev_t dev);
  1201. int (*inode_rename) (struct inode *old_dir, struct dentry *old_dentry,
  1202. struct inode *new_dir, struct dentry *new_dentry);
  1203. int (*inode_readlink) (struct dentry *dentry);
  1204. int (*inode_follow_link) (struct dentry *dentry, struct nameidata *nd);
  1205. int (*inode_permission) (struct inode *inode, int mask, struct nameidata *nd);
  1206. int (*inode_setattr) (struct dentry *dentry, struct iattr *attr);
  1207. int (*inode_getattr) (struct vfsmount *mnt, struct dentry *dentry);
  1208. void (*inode_delete) (struct inode *inode);
  1209. int (*inode_setxattr) (struct dentry *dentry, char *name, void *value,
  1210. size_t size, int flags);
  1211. void (*inode_post_setxattr) (struct dentry *dentry, char *name, void *value,
  1212. size_t size, int flags);
  1213. int (*inode_getxattr) (struct dentry *dentry, char *name);
  1214. int (*inode_listxattr) (struct dentry *dentry);
  1215. int (*inode_removexattr) (struct dentry *dentry, char *name);
  1216. const char *(*inode_xattr_getsuffix) (void);
  1217. int (*inode_getsecurity)(const struct inode *inode, const char *name, void *buffer, size_t size, int err);
  1218. int (*inode_setsecurity)(struct inode *inode, const char *name, const void *value, size_t size, int flags);
  1219. int (*inode_listsecurity)(struct inode *inode, char *buffer, size_t buffer_size);
  1220. int (*file_permission) (struct file * file, int mask);
  1221. int (*file_alloc_security) (struct file * file);
  1222. void (*file_free_security) (struct file * file);
  1223. int (*file_ioctl) (struct file * file, unsigned int cmd,
  1224. unsigned long arg);
  1225. int (*file_mmap) (struct file * file,
  1226. unsigned long reqprot,
  1227. unsigned long prot, unsigned long flags);
  1228. int (*file_mprotect) (struct vm_area_struct * vma,
  1229. unsigned long reqprot,
  1230. unsigned long prot);
  1231. int (*file_lock) (struct file * file, unsigned int cmd);
  1232. int (*file_fcntl) (struct file * file, unsigned int cmd,
  1233. unsigned long arg);
  1234. int (*file_set_fowner) (struct file * file);
  1235. int (*file_send_sigiotask) (struct task_struct * tsk,
  1236. struct fown_struct * fown, int sig);
  1237. int (*file_receive) (struct file * file);
  1238. int (*task_create) (unsigned long clone_flags);
  1239. int (*task_alloc_security) (struct task_struct * p);
  1240. void (*task_free_security) (struct task_struct * p);
  1241. int (*task_setuid) (uid_t id0, uid_t id1, uid_t id2, int flags);
  1242. int (*task_post_setuid) (uid_t old_ruid /* or fsuid */ ,
  1243. uid_t old_euid, uid_t old_suid, int flags);
  1244. int (*task_setgid) (gid_t id0, gid_t id1, gid_t id2, int flags);
  1245. int (*task_setpgid) (struct task_struct * p, pid_t pgid);
  1246. int (*task_getpgid) (struct task_struct * p);
  1247. int (*task_getsid) (struct task_struct * p);
  1248. void (*task_getsecid) (struct task_struct * p, u32 * secid);
  1249. int (*task_setgroups) (struct group_info *group_info);
  1250. int (*task_setnice) (struct task_struct * p, int nice);
  1251. int (*task_setioprio) (struct task_struct * p, int ioprio);
  1252. int (*task_getioprio) (struct task_struct * p);
  1253. int (*task_setrlimit) (unsigned int resource, struct rlimit * new_rlim);
  1254. int (*task_setscheduler) (struct task_struct * p, int policy,
  1255. struct sched_param * lp);
  1256. int (*task_getscheduler) (struct task_struct * p);
  1257. int (*task_movememory) (struct task_struct * p);
  1258. int (*task_kill) (struct task_struct * p,
  1259. struct siginfo * info, int sig, u32 secid);
  1260. int (*task_wait) (struct task_struct * p);
  1261. int (*task_prctl) (int option, unsigned long arg2,
  1262. unsigned long arg3, unsigned long arg4,
  1263. unsigned long arg5);
  1264. void (*task_reparent_to_init) (struct task_struct * p);
  1265. void (*task_to_inode)(struct task_struct *p, struct inode *inode);
  1266. int (*ipc_permission) (struct kern_ipc_perm * ipcp, short flag);
  1267. int (*msg_msg_alloc_security) (struct msg_msg * msg);
  1268. void (*msg_msg_free_security) (struct msg_msg * msg);
  1269. int (*msg_queue_alloc_security) (struct msg_queue * msq);
  1270. void (*msg_queue_free_security) (struct msg_queue * msq);
  1271. int (*msg_queue_associate) (struct msg_queue * msq, int msqflg);
  1272. int (*msg_queue_msgctl) (struct msg_queue * msq, int cmd);
  1273. int (*msg_queue_msgsnd) (struct msg_queue * msq,
  1274. struct msg_msg * msg, int msqflg);
  1275. int (*msg_queue_msgrcv) (struct msg_queue * msq,
  1276. struct msg_msg * msg,
  1277. struct task_struct * target,
  1278. long type, int mode);
  1279. int (*shm_alloc_security) (struct shmid_kernel * shp);
  1280. void (*shm_free_security) (struct shmid_kernel * shp);
  1281. int (*shm_associate) (struct shmid_kernel * shp, int shmflg);
  1282. int (*shm_shmctl) (struct shmid_kernel * shp, int cmd);
  1283. int (*shm_shmat) (struct shmid_kernel * shp,
  1284. char __user *shmaddr, int shmflg);
  1285. int (*sem_alloc_security) (struct sem_array * sma);
  1286. void (*sem_free_security) (struct sem_array * sma);
  1287. int (*sem_associate) (struct sem_array * sma, int semflg);
  1288. int (*sem_semctl) (struct sem_array * sma, int cmd);
  1289. int (*sem_semop) (struct sem_array * sma,
  1290. struct sembuf * sops, unsigned nsops, int alter);
  1291. int (*netlink_send) (struct sock * sk, struct sk_buff * skb);
  1292. int (*netlink_recv) (struct sk_buff * skb, int cap);
  1293. /* allow module stacking */
  1294. int (*register_security) (const char *name,
  1295. struct security_operations *ops);
  1296. int (*unregister_security) (const char *name,
  1297. struct security_operations *ops);
  1298. void (*d_instantiate) (struct dentry *dentry, struct inode *inode);
  1299. int (*getprocattr)(struct task_struct *p, char *name, char **value);
  1300. int (*setprocattr)(struct task_struct *p, char *name, void *value, size_t size);
  1301. int (*secid_to_secctx)(u32 secid, char **secdata, u32 *seclen);
  1302. void (*release_secctx)(char *secdata, u32 seclen);
  1303. #ifdef CONFIG_SECURITY_NETWORK
  1304. int (*unix_stream_connect) (struct socket * sock,
  1305. struct socket * other, struct sock * newsk);
  1306. int (*unix_may_send) (struct socket * sock, struct socket * other);
  1307. int (*socket_create) (int family, int type, int protocol, int kern);
  1308. int (*socket_post_create) (struct socket * sock, int family,
  1309. int type, int protocol, int kern);
  1310. int (*socket_bind) (struct socket * sock,
  1311. struct sockaddr * address, int addrlen);
  1312. int (*socket_connect) (struct socket * sock,
  1313. struct sockaddr * address, int addrlen);
  1314. int (*socket_listen) (struct socket * sock, int backlog);
  1315. int (*socket_accept) (struct socket * sock, struct socket * newsock);
  1316. void (*socket_post_accept) (struct socket * sock,
  1317. struct socket * newsock);
  1318. int (*socket_sendmsg) (struct socket * sock,
  1319. struct msghdr * msg, int size);
  1320. int (*socket_recvmsg) (struct socket * sock,
  1321. struct msghdr * msg, int size, int flags);
  1322. int (*socket_getsockname) (struct socket * sock);
  1323. int (*socket_getpeername) (struct socket * sock);
  1324. int (*socket_getsockopt) (struct socket * sock, int level, int optname);
  1325. int (*socket_setsockopt) (struct socket * sock, int level, int optname);
  1326. int (*socket_shutdown) (struct socket * sock, int how);
  1327. int (*socket_sock_rcv_skb) (struct sock * sk, struct sk_buff * skb);
  1328. int (*socket_getpeersec_stream) (struct socket *sock, char __user *optval, int __user *optlen, unsigned len);
  1329. int (*socket_getpeersec_dgram) (struct socket *sock, struct sk_buff *skb, u32 *secid);
  1330. int (*sk_alloc_security) (struct sock *sk, int family, gfp_t priority);
  1331. void (*sk_free_security) (struct sock *sk);
  1332. void (*sk_clone_security) (const struct sock *sk, struct sock *newsk);
  1333. void (*sk_getsecid) (struct sock *sk, u32 *secid);
  1334. void (*sock_graft)(struct sock* sk, struct socket *parent);
  1335. int (*inet_conn_request)(struct sock *sk, struct sk_buff *skb,
  1336. struct request_sock *req);
  1337. void (*inet_csk_clone)(struct sock *newsk, const struct request_sock *req);
  1338. void (*inet_conn_established)(struct sock *sk, struct sk_buff *skb);
  1339. void (*req_classify_flow)(const struct request_sock *req, struct flowi *fl);
  1340. #endif /* CONFIG_SECURITY_NETWORK */
  1341. #ifdef CONFIG_SECURITY_NETWORK_XFRM
  1342. int (*xfrm_policy_alloc_security) (struct xfrm_policy *xp,
  1343. struct xfrm_user_sec_ctx *sec_ctx);
  1344. int (*xfrm_policy_clone_security) (struct xfrm_policy *old, struct xfrm_policy *new);
  1345. void (*xfrm_policy_free_security) (struct xfrm_policy *xp);
  1346. int (*xfrm_policy_delete_security) (struct xfrm_policy *xp);
  1347. int (*xfrm_state_alloc_security) (struct xfrm_state *x,
  1348. struct xfrm_user_sec_ctx *sec_ctx,
  1349. u32 secid);
  1350. void (*xfrm_state_free_security) (struct xfrm_state *x);
  1351. int (*xfrm_state_delete_security) (struct xfrm_state *x);
  1352. int (*xfrm_policy_lookup)(struct xfrm_policy *xp, u32 fl_secid, u8 dir);
  1353. int (*xfrm_state_pol_flow_match)(struct xfrm_state *x,
  1354. struct xfrm_policy *xp, struct flowi *fl);
  1355. int (*xfrm_decode_session)(struct sk_buff *skb, u32 *secid, int ckall);
  1356. #endif /* CONFIG_SECURITY_NETWORK_XFRM */
  1357. /* key management security hooks */
  1358. #ifdef CONFIG_KEYS
  1359. int (*key_alloc)(struct key *key, struct task_struct *tsk, unsigned long flags);
  1360. void (*key_free)(struct key *key);
  1361. int (*key_permission)(key_ref_t key_ref,
  1362. struct task_struct *context,
  1363. key_perm_t perm);
  1364. #endif /* CONFIG_KEYS */
  1365. };
  1366. /* global variables */
  1367. extern struct security_operations *security_ops;
  1368. /* inline stuff */
  1369. static inline int security_ptrace (struct task_struct * parent, struct task_struct * child)
  1370. {
  1371. return security_ops->ptrace (parent, child);
  1372. }
  1373. static inline int security_capget (struct task_struct *target,
  1374. kernel_cap_t *effective,
  1375. kernel_cap_t *inheritable,
  1376. kernel_cap_t *permitted)
  1377. {
  1378. return security_ops->capget (target, effective, inheritable, permitted);
  1379. }
  1380. static inline int security_capset_check (struct task_struct *target,
  1381. kernel_cap_t *effective,
  1382. kernel_cap_t *inheritable,
  1383. kernel_cap_t *permitted)
  1384. {
  1385. return security_ops->capset_check (target, effective, inheritable, permitted);
  1386. }
  1387. static inline void security_capset_set (struct task_struct *target,
  1388. kernel_cap_t *effective,
  1389. kernel_cap_t *inheritable,
  1390. kernel_cap_t *permitted)
  1391. {
  1392. security_ops->capset_set (target, effective, inheritable, permitted);
  1393. }
  1394. static inline int security_capable(struct task_struct *tsk, int cap)
  1395. {
  1396. return security_ops->capable(tsk, cap);
  1397. }
  1398. static inline int security_acct (struct file *file)
  1399. {
  1400. return security_ops->acct (file);
  1401. }
  1402. static inline int security_sysctl(struct ctl_table *table, int op)
  1403. {
  1404. return security_ops->sysctl(table, op);
  1405. }
  1406. static inline int security_quotactl (int cmds, int type, int id,
  1407. struct super_block *sb)
  1408. {
  1409. return security_ops->quotactl (cmds, type, id, sb);
  1410. }
  1411. static inline int security_quota_on (struct dentry * dentry)
  1412. {
  1413. return security_ops->quota_on (dentry);
  1414. }
  1415. static inline int security_syslog(int type)
  1416. {
  1417. return security_ops->syslog(type);
  1418. }
  1419. static inline int security_settime(struct timespec *ts, struct timezone *tz)
  1420. {
  1421. return security_ops->settime(ts, tz);
  1422. }
  1423. static inline int security_vm_enough_memory(long pages)
  1424. {
  1425. return security_ops->vm_enough_memory(pages);
  1426. }
  1427. static inline int security_bprm_alloc (struct linux_binprm *bprm)
  1428. {
  1429. return security_ops->bprm_alloc_security (bprm);
  1430. }
  1431. static inline void security_bprm_free (struct linux_binprm *bprm)
  1432. {
  1433. security_ops->bprm_free_security (bprm);
  1434. }
  1435. static inline void security_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
  1436. {
  1437. security_ops->bprm_apply_creds (bprm, unsafe);
  1438. }
  1439. static inline void security_bprm_post_apply_creds (struct linux_binprm *bprm)
  1440. {
  1441. security_ops->bprm_post_apply_creds (bprm);
  1442. }
  1443. static inline int security_bprm_set (struct linux_binprm *bprm)
  1444. {
  1445. return security_ops->bprm_set_security (bprm);
  1446. }
  1447. static inline int security_bprm_check (struct linux_binprm *bprm)
  1448. {
  1449. return security_ops->bprm_check_security (bprm);
  1450. }
  1451. static inline int security_bprm_secureexec (struct linux_binprm *bprm)
  1452. {
  1453. return security_ops->bprm_secureexec (bprm);
  1454. }
  1455. static inline int security_sb_alloc (struct super_block *sb)
  1456. {
  1457. return security_ops->sb_alloc_security (sb);
  1458. }
  1459. static inline void security_sb_free (struct super_block *sb)
  1460. {
  1461. security_ops->sb_free_security (sb);
  1462. }
  1463. static inline int security_sb_copy_data (struct file_system_type *type,
  1464. void *orig, void *copy)
  1465. {
  1466. return security_ops->sb_copy_data (type, orig, copy);
  1467. }
  1468. static inline int security_sb_kern_mount (struct super_block *sb, void *data)
  1469. {
  1470. return security_ops->sb_kern_mount (sb, data);
  1471. }
  1472. static inline int security_sb_statfs (struct dentry *dentry)
  1473. {
  1474. return security_ops->sb_statfs (dentry);
  1475. }
  1476. static inline int security_sb_mount (char *dev_name, struct nameidata *nd,
  1477. char *type, unsigned long flags,
  1478. void *data)
  1479. {
  1480. return security_ops->sb_mount (dev_name, nd, type, flags, data);
  1481. }
  1482. static inline int security_sb_check_sb (struct vfsmount *mnt,
  1483. struct nameidata *nd)
  1484. {
  1485. return security_ops->sb_check_sb (mnt, nd);
  1486. }
  1487. static inline int security_sb_umount (struct vfsmount *mnt, int flags)
  1488. {
  1489. return security_ops->sb_umount (mnt, flags);
  1490. }
  1491. static inline void security_sb_umount_close (struct vfsmount *mnt)
  1492. {
  1493. security_ops->sb_umount_close (mnt);
  1494. }
  1495. static inline void security_sb_umount_busy (struct vfsmount *mnt)
  1496. {
  1497. security_ops->sb_umount_busy (mnt);
  1498. }
  1499. static inline void security_sb_post_remount (struct vfsmount *mnt,
  1500. unsigned long flags, void *data)
  1501. {
  1502. security_ops->sb_post_remount (mnt, flags, data);
  1503. }
  1504. static inline void security_sb_post_mountroot (void)
  1505. {
  1506. security_ops->sb_post_mountroot ();
  1507. }
  1508. static inline void security_sb_post_addmount (struct vfsmount *mnt,
  1509. struct nameidata *mountpoint_nd)
  1510. {
  1511. security_ops->sb_post_addmount (mnt, mountpoint_nd);
  1512. }
  1513. static inline int security_sb_pivotroot (struct nameidata *old_nd,
  1514. struct nameidata *new_nd)
  1515. {
  1516. return security_ops->sb_pivotroot (old_nd, new_nd);
  1517. }
  1518. static inline void security_sb_post_pivotroot (struct nameidata *old_nd,
  1519. struct nameidata *new_nd)
  1520. {
  1521. security_ops->sb_post_pivotroot (old_nd, new_nd);
  1522. }
  1523. static inline int security_inode_alloc (struct inode *inode)
  1524. {
  1525. inode->i_security = NULL;
  1526. return security_ops->inode_alloc_security (inode);
  1527. }
  1528. static inline void security_inode_free (struct inode *inode)
  1529. {
  1530. security_ops->inode_free_security (inode);
  1531. }
  1532. static inline int security_inode_init_security (struct inode *inode,
  1533. struct inode *dir,
  1534. char **name,
  1535. void **value,
  1536. size_t *len)
  1537. {
  1538. if (unlikely (IS_PRIVATE (inode)))
  1539. return -EOPNOTSUPP;
  1540. return security_ops->inode_init_security (inode, dir, name, value, len);
  1541. }
  1542. static inline int security_inode_create (struct inode *dir,
  1543. struct dentry *dentry,
  1544. int mode)
  1545. {
  1546. if (unlikely (IS_PRIVATE (dir)))
  1547. return 0;
  1548. return security_ops->inode_create (dir, dentry, mode);
  1549. }
  1550. static inline int security_inode_link (struct dentry *old_dentry,
  1551. struct inode *dir,
  1552. struct dentry *new_dentry)
  1553. {
  1554. if (unlikely (IS_PRIVATE (old_dentry->d_inode)))
  1555. return 0;
  1556. return security_ops->inode_link (old_dentry, dir, new_dentry);
  1557. }
  1558. static inline int security_inode_unlink (struct inode *dir,
  1559. struct dentry *dentry)
  1560. {
  1561. if (unlikely (IS_PRIVATE (dentry->d_inode)))
  1562. return 0;
  1563. return security_ops->inode_unlink (dir, dentry);
  1564. }
  1565. static inline int security_inode_symlink (struct inode *dir,
  1566. struct dentry *dentry,
  1567. const char *old_name)
  1568. {
  1569. if (unlikely (IS_PRIVATE (dir)))
  1570. return 0;
  1571. return security_ops->inode_symlink (dir, dentry, old_name);
  1572. }
  1573. static inline int security_inode_mkdir (struct inode *dir,
  1574. struct dentry *dentry,
  1575. int mode)
  1576. {
  1577. if (unlikely (IS_PRIVATE (dir)))
  1578. return 0;
  1579. return security_ops->inode_mkdir (dir, dentry, mode);
  1580. }
  1581. static inline int security_inode_rmdir (struct inode *dir,
  1582. struct dentry *dentry)
  1583. {
  1584. if (unlikely (IS_PRIVATE (dentry->d_inode)))
  1585. return 0;
  1586. return security_ops->inode_rmdir (dir, dentry);
  1587. }
  1588. static inline int security_inode_mknod (struct inode *dir,
  1589. struct dentry *dentry,
  1590. int mode, dev_t dev)
  1591. {
  1592. if (unlikely (IS_PRIVATE (dir)))
  1593. return 0;
  1594. return security_ops->inode_mknod (dir, dentry, mode, dev);
  1595. }
  1596. static inline int security_inode_rename (struct inode *old_dir,
  1597. struct dentry *old_dentry,
  1598. struct inode *new_dir,
  1599. struct dentry *new_dentry)
  1600. {
  1601. if (unlikely (IS_PRIVATE (old_dentry->d_inode) ||
  1602. (new_dentry->d_inode && IS_PRIVATE (new_dentry->d_inode))))
  1603. return 0;
  1604. return security_ops->inode_rename (old_dir, old_dentry,
  1605. new_dir, new_dentry);
  1606. }
  1607. static inline int security_inode_readlink (struct dentry *dentry)
  1608. {
  1609. if (unlikely (IS_PRIVATE (dentry->d_inode)))
  1610. return 0;
  1611. return security_ops->inode_readlink (dentry);
  1612. }
  1613. static inline int security_inode_follow_link (struct dentry *dentry,
  1614. struct nameidata *nd)
  1615. {
  1616. if (unlikely (IS_PRIVATE (dentry->d_inode)))
  1617. return 0;
  1618. return security_ops->inode_follow_link (dentry, nd);
  1619. }
  1620. static inline int security_inode_permission (struct inode *inode, int mask,
  1621. struct nameidata *nd)
  1622. {
  1623. if (unlikely (IS_PRIVATE (inode)))
  1624. return 0;
  1625. return security_ops->inode_permission (inode, mask, nd);
  1626. }
  1627. static inline int security_inode_setattr (struct dentry *dentry,
  1628. struct iattr *attr)
  1629. {
  1630. if (unlikely (IS_PRIVATE (dentry->d_inode)))
  1631. return 0;
  1632. return security_ops->inode_setattr (dentry, attr);
  1633. }
  1634. static inline int security_inode_getattr (struct vfsmount *mnt,
  1635. struct dentry *dentry)
  1636. {
  1637. if (unlikely (IS_PRIVATE (dentry->d_inode)))
  1638. return 0;
  1639. return security_ops->inode_getattr (mnt, dentry);
  1640. }
  1641. static inline void security_inode_delete (struct inode *inode)
  1642. {
  1643. if (unlikely (IS_PRIVATE (inode)))
  1644. return;
  1645. security_ops->inode_delete (inode);
  1646. }
  1647. static inline int security_inode_setxattr (struct dentry *dentry, char *name,
  1648. void *value, size_t size, int flags)
  1649. {
  1650. if (unlikely (IS_PRIVATE (dentry->d_inode)))
  1651. return 0;
  1652. return security_ops->inode_setxattr (dentry, name, value, size, flags);
  1653. }
  1654. static inline void security_inode_post_setxattr (struct dentry *dentry, char *name,
  1655. void *value, size_t size, int flags)
  1656. {
  1657. if (unlikely (IS_PRIVATE (dentry->d_inode)))
  1658. return;
  1659. security_ops->inode_post_setxattr (dentry, name, value, size, flags);
  1660. }
  1661. static inline int security_inode_getxattr (struct dentry *dentry, char *name)
  1662. {
  1663. if (unlikely (IS_PRIVATE (dentry->d_inode)))
  1664. return 0;
  1665. return security_ops->inode_getxattr (dentry, name);
  1666. }
  1667. static inline int security_inode_listxattr (struct dentry *dentry)
  1668. {
  1669. if (unlikely (IS_PRIVATE (dentry->d_inode)))
  1670. return 0;
  1671. return security_ops->inode_listxattr (dentry);
  1672. }
  1673. static inline int security_inode_removexattr (struct dentry *dentry, char *name)
  1674. {
  1675. if (unlikely (IS_PRIVATE (dentry->d_inode)))
  1676. return 0;
  1677. return security_ops->inode_removexattr (dentry, name);
  1678. }
  1679. static inline const char *security_inode_xattr_getsuffix(void)
  1680. {
  1681. return security_ops->inode_xattr_getsuffix();
  1682. }
  1683. static inline int security_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
  1684. {
  1685. if (unlikely (IS_PRIVATE (inode)))
  1686. return 0;
  1687. return security_ops->inode_getsecurity(inode, name, buffer, size, err);
  1688. }
  1689. static inline int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
  1690. {
  1691. if (unlikely (IS_PRIVATE (inode)))
  1692. return 0;
  1693. return security_ops->inode_setsecurity(inode, name, value, size, flags);
  1694. }
  1695. static inline int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
  1696. {
  1697. if (unlikely (IS_PRIVATE (inode)))
  1698. return 0;
  1699. return security_ops->inode_listsecurity(inode, buffer, buffer_size);
  1700. }
  1701. static inline int security_file_permission (struct file *file, int mask)
  1702. {
  1703. return security_ops->file_permission (file, mask);
  1704. }
  1705. static inline int security_file_alloc (struct file *file)
  1706. {
  1707. return security_ops->file_alloc_security (file);
  1708. }
  1709. static inline void security_file_free (struct file *file)
  1710. {
  1711. security_ops->file_free_security (file);
  1712. }
  1713. static inline int security_file_ioctl (struct file *file, unsigned int cmd,
  1714. unsigned long arg)
  1715. {
  1716. return security_ops->file_ioctl (file, cmd, arg);
  1717. }
  1718. static inline int security_file_mmap (struct file *file, unsigned long reqprot,
  1719. unsigned long prot,
  1720. unsigned long flags)
  1721. {
  1722. return security_ops->file_mmap (file, reqprot, prot, flags);
  1723. }
  1724. static inline int security_file_mprotect (struct vm_area_struct *vma,
  1725. unsigned long reqprot,
  1726. unsigned long prot)
  1727. {
  1728. return security_ops->file_mprotect (vma, reqprot, prot);
  1729. }
  1730. static inline int security_file_lock (struct file *file, unsigned int cmd)
  1731. {
  1732. return security_ops->file_lock (file, cmd);
  1733. }
  1734. static inline int security_file_fcntl (struct file *file, unsigned int cmd,
  1735. unsigned long arg)
  1736. {
  1737. return security_ops->file_fcntl (file, cmd, arg);
  1738. }
  1739. static inline int security_file_set_fowner (struct file *file)
  1740. {
  1741. return security_ops->file_set_fowner (file);
  1742. }
  1743. static inline int security_file_send_sigiotask (struct task_struct *tsk,
  1744. struct fown_struct *fown,
  1745. int sig)
  1746. {
  1747. return security_ops->file_send_sigiotask (tsk, fown, sig);
  1748. }
  1749. static inline int security_file_receive (struct file *file)
  1750. {
  1751. return security_ops->file_receive (file);
  1752. }
  1753. static inline int security_task_create (unsigned long clone_flags)
  1754. {
  1755. return security_ops->task_create (clone_flags);
  1756. }
  1757. static inline int security_task_alloc (struct task_struct *p)
  1758. {
  1759. return security_ops->task_alloc_security (p);
  1760. }
  1761. static inline void security_task_free (struct task_struct *p)
  1762. {
  1763. security_ops->task_free_security (p);
  1764. }
  1765. static inline int security_task_setuid (uid_t id0, uid_t id1, uid_t id2,
  1766. int flags)
  1767. {
  1768. return security_ops->task_setuid (id0, id1, id2, flags);
  1769. }
  1770. static inline int security_task_post_setuid (uid_t old_ruid, uid_t old_euid,
  1771. uid_t old_suid, int flags)
  1772. {
  1773. return security_ops->task_post_setuid (old_ruid, old_euid, old_suid, flags);
  1774. }
  1775. static inline int security_task_setgid (gid_t id0, gid_t id1, gid_t id2,
  1776. int flags)
  1777. {
  1778. return security_ops->task_setgid (id0, id1, id2, flags);
  1779. }
  1780. static inline int security_task_setpgid (struct task_struct *p, pid_t pgid)
  1781. {
  1782. return security_ops->task_setpgid (p, pgid);
  1783. }
  1784. static inline int security_task_getpgid (struct task_struct *p)
  1785. {
  1786. return security_ops->task_getpgid (p);
  1787. }
  1788. static inline int security_task_getsid (struct task_struct *p)
  1789. {
  1790. return security_ops->task_getsid (p);
  1791. }
  1792. static inline void security_task_getsecid (struct task_struct *p, u32 *secid)
  1793. {
  1794. security_ops->task_getsecid (p, secid);
  1795. }
  1796. static inline int security_task_setgroups (struct group_info *group_info)
  1797. {
  1798. return security_ops->task_setgroups (group_info);
  1799. }
  1800. static inline int security_task_setnice (struct task_struct *p, int nice)
  1801. {
  1802. return security_ops->task_setnice (p, nice);
  1803. }
  1804. static inline int security_task_setioprio (struct task_struct *p, int ioprio)
  1805. {
  1806. return security_ops->task_setioprio (p, ioprio);
  1807. }
  1808. static inline int security_task_getioprio (struct task_struct *p)
  1809. {
  1810. return security_ops->task_getioprio (p);
  1811. }
  1812. static inline int security_task_setrlimit (unsigned int resource,
  1813. struct rlimit *new_rlim)
  1814. {
  1815. return security_ops->task_setrlimit (resource, new_rlim);
  1816. }
  1817. static inline int security_task_setscheduler (struct task_struct *p,
  1818. int policy,
  1819. struct sched_param *lp)
  1820. {
  1821. return security_ops->task_setscheduler (p, policy, lp);
  1822. }
  1823. static inline int security_task_getscheduler (struct task_struct *p)
  1824. {
  1825. return security_ops->task_getscheduler (p);
  1826. }
  1827. static inline int security_task_movememory (struct task_struct *p)
  1828. {
  1829. return security_ops->task_movememory (p);
  1830. }
  1831. static inline int security_task_kill (struct task_struct *p,
  1832. struct siginfo *info, int sig,
  1833. u32 secid)
  1834. {
  1835. return security_ops->task_kill (p, info, sig, secid);
  1836. }
  1837. static inline int security_task_wait (struct task_struct *p)
  1838. {
  1839. return security_ops->task_wait (p);
  1840. }
  1841. static inline int security_task_prctl (int option, unsigned long arg2,
  1842. unsigned long arg3,
  1843. unsigned long arg4,
  1844. unsigned long arg5)
  1845. {
  1846. return security_ops->task_prctl (option, arg2, arg3, arg4, arg5);
  1847. }
  1848. static inline void security_task_reparent_to_init (struct task_struct *p)
  1849. {
  1850. security_ops->task_reparent_to_init (p);
  1851. }
  1852. static inline void security_task_to_inode(struct task_struct *p, struct inode *inode)
  1853. {
  1854. security_ops->task_to_inode(p, inode);
  1855. }
  1856. static inline int security_ipc_permission (struct kern_ipc_perm *ipcp,
  1857. short flag)
  1858. {
  1859. return security_ops->ipc_permission (ipcp, flag);
  1860. }
  1861. static inline int security_msg_msg_alloc (struct msg_msg * msg)
  1862. {
  1863. return security_ops->msg_msg_alloc_security (msg);
  1864. }
  1865. static inline void security_msg_msg_free (struct msg_msg * msg)
  1866. {
  1867. security_ops->msg_msg_free_security(msg);
  1868. }
  1869. static inline int security_msg_queue_alloc (struct msg_queue *msq)
  1870. {
  1871. return security_ops->msg_queue_alloc_security (msq);
  1872. }
  1873. static inline void security_msg_queue_free (struct msg_queue *msq)
  1874. {
  1875. security_ops->msg_queue_free_security (msq);
  1876. }
  1877. static inline int security_msg_queue_associate (struct msg_queue * msq,
  1878. int msqflg)
  1879. {
  1880. return security_ops->msg_queue_associate (msq, msqflg);
  1881. }
  1882. static inline int security_msg_queue_msgctl (struct msg_queue * msq, int cmd)
  1883. {
  1884. return security_ops->msg_queue_msgctl (msq, cmd);
  1885. }
  1886. static inline int security_msg_queue_msgsnd (struct msg_queue * msq,
  1887. struct msg_msg * msg, int msqflg)
  1888. {
  1889. return security_ops->msg_queue_msgsnd (msq, msg, msqflg);
  1890. }
  1891. static inline int security_msg_queue_msgrcv (struct msg_queue * msq,
  1892. struct msg_msg * msg,
  1893. struct task_struct * target,
  1894. long type, int mode)
  1895. {
  1896. return security_ops->msg_queue_msgrcv (msq, msg, target, type, mode);
  1897. }
  1898. static inline int security_shm_alloc (struct shmid_kernel *shp)
  1899. {
  1900. return security_ops->shm_alloc_security (shp);
  1901. }
  1902. static inline void security_shm_free (struct shmid_kernel *shp)
  1903. {
  1904. security_ops->shm_free_security (shp);
  1905. }
  1906. static inline int security_shm_associate (struct shmid_kernel * shp,
  1907. int shmflg)
  1908. {
  1909. return security_ops->shm_associate(shp, shmflg);
  1910. }
  1911. static inline int security_shm_shmctl (struct shmid_kernel * shp, int cmd)
  1912. {
  1913. return security_ops->shm_shmctl (shp, cmd);
  1914. }
  1915. static inline int security_shm_shmat (struct shmid_kernel * shp,
  1916. char __user *shmaddr, int shmflg)
  1917. {
  1918. return security_ops->shm_shmat(shp, shmaddr, shmflg);
  1919. }
  1920. static inline int security_sem_alloc (struct sem_array *sma)
  1921. {
  1922. return security_ops->sem_alloc_security (sma);
  1923. }
  1924. static inline void security_sem_free (struct sem_array *sma)
  1925. {
  1926. security_ops->sem_free_security (sma);
  1927. }
  1928. static inline int security_sem_associate (struct sem_array * sma, int semflg)
  1929. {
  1930. return security_ops->sem_associate (sma, semflg);
  1931. }
  1932. static inline int security_sem_semctl (struct sem_array * sma, int cmd)
  1933. {
  1934. return security_ops->sem_semctl(sma, cmd);
  1935. }
  1936. static inline int security_sem_semop (struct sem_array * sma,
  1937. struct sembuf * sops, unsigned nsops,
  1938. int alter)
  1939. {
  1940. return security_ops->sem_semop(sma, sops, nsops, alter);
  1941. }
  1942. static inline void security_d_instantiate (struct dentry *dentry, struct inode *inode)
  1943. {
  1944. if (unlikely (inode && IS_PRIVATE (inode)))
  1945. return;
  1946. security_ops->d_instantiate (dentry, inode);
  1947. }
  1948. static inline int security_getprocattr(struct task_struct *p, char *name, char **value)
  1949. {
  1950. return security_ops->getprocattr(p, name, value);
  1951. }
  1952. static inline int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size)
  1953. {
  1954. return security_ops->setprocattr(p, name, value, size);
  1955. }
  1956. static inline int security_netlink_send(struct sock *sk, struct sk_buff * skb)
  1957. {
  1958. return security_ops->netlink_send(sk, skb);
  1959. }
  1960. static inline int security_netlink_recv(struct sk_buff * skb, int cap)
  1961. {
  1962. return security_ops->netlink_recv(skb, cap);
  1963. }
  1964. static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
  1965. {
  1966. return security_ops->secid_to_secctx(secid, secdata, seclen);
  1967. }
  1968. static inline void security_release_secctx(char *secdata, u32 seclen)
  1969. {
  1970. return security_ops->release_secctx(secdata, seclen);
  1971. }
  1972. /* prototypes */
  1973. extern int security_init (void);
  1974. extern int register_security (struct security_operations *ops);
  1975. extern int unregister_security (struct security_operations *ops);
  1976. extern int mod_reg_security (const char *name, struct security_operations *ops);
  1977. extern int mod_unreg_security (const char *name, struct security_operations *ops);
  1978. extern struct dentry *securityfs_create_file(const char *name, mode_t mode,
  1979. struct dentry *parent, void *data,
  1980. const struct file_operations *fops);
  1981. extern struct dentry *securityfs_create_dir(const char *name, struct dentry *parent);
  1982. extern void securityfs_remove(struct dentry *dentry);
  1983. #else /* CONFIG_SECURITY */
  1984. /*
  1985. * This is the default capabilities functionality. Most of these functions
  1986. * are just stubbed out, but a few must call the proper capable code.
  1987. */
  1988. static inline int security_init(void)
  1989. {
  1990. return 0;
  1991. }
  1992. static inline int security_ptrace (struct task_struct *parent, struct task_struct * child)
  1993. {
  1994. return cap_ptrace (parent, child);
  1995. }
  1996. static inline int security_capget (struct task_struct *target,
  1997. kernel_cap_t *effective,
  1998. kernel_cap_t *inheritable,
  1999. kernel_cap_t *permitted)
  2000. {
  2001. return cap_capget (target, effective, inheritable, permitted);
  2002. }
  2003. static inline int security_capset_check (struct task_struct *target,
  2004. kernel_cap_t *effective,
  2005. kernel_cap_t *inheritable,
  2006. kernel_cap_t *permitted)
  2007. {
  2008. return cap_capset_check (target, effective, inheritable, permitted);
  2009. }
  2010. static inline void security_capset_set (struct task_struct *target,
  2011. kernel_cap_t *effective,
  2012. kernel_cap_t *inheritable,
  2013. kernel_cap_t *permitted)
  2014. {
  2015. cap_capset_set (target, effective, inheritable, permitted);
  2016. }
  2017. static inline int security_capable(struct task_struct *tsk, int cap)
  2018. {
  2019. return cap_capable(tsk, cap);
  2020. }
  2021. static inline int security_acct (struct file *file)
  2022. {
  2023. return 0;
  2024. }
  2025. static inline int security_sysctl(struct ctl_table *table, int op)
  2026. {
  2027. return 0;
  2028. }
  2029. static inline int security_quotactl (int cmds, int type, int id,
  2030. struct super_block * sb)
  2031. {
  2032. return 0;
  2033. }
  2034. static inline int security_quota_on (struct dentry * dentry)
  2035. {
  2036. return 0;
  2037. }
  2038. static inline int security_syslog(int type)
  2039. {
  2040. return cap_syslog(type);
  2041. }
  2042. static inline int security_settime(struct timespec *ts, struct timezone *tz)
  2043. {
  2044. return cap_settime(ts, tz);
  2045. }
  2046. static inline int security_vm_enough_memory(long pages)
  2047. {
  2048. return cap_vm_enough_memory(pages);
  2049. }
  2050. static inline int security_bprm_alloc (struct linux_binprm *bprm)
  2051. {
  2052. return 0;
  2053. }
  2054. static inline void security_bprm_free (struct linux_binprm *bprm)
  2055. { }
  2056. static inline void security_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
  2057. {
  2058. cap_bprm_apply_creds (bprm, unsafe);
  2059. }
  2060. static inline void security_bprm_post_apply_creds (struct linux_binprm *bprm)
  2061. {
  2062. return;
  2063. }
  2064. static inline int security_bprm_set (struct linux_binprm *bprm)
  2065. {
  2066. return cap_bprm_set_security (bprm);
  2067. }
  2068. static inline int security_bprm_check (struct linux_binprm *bprm)
  2069. {
  2070. return 0;
  2071. }
  2072. static inline int security_bprm_secureexec (struct linux_binprm *bprm)
  2073. {
  2074. return cap_bprm_secureexec(bprm);
  2075. }
  2076. static inline int security_sb_alloc (struct super_block *sb)
  2077. {
  2078. return 0;
  2079. }
  2080. static inline void security_sb_free (struct super_block *sb)
  2081. { }
  2082. static inline int security_sb_copy_data (struct file_system_type *type,
  2083. void *orig, void *copy)
  2084. {
  2085. return 0;
  2086. }
  2087. static inline int security_sb_kern_mount (struct super_block *sb, void *data)
  2088. {
  2089. return 0;
  2090. }
  2091. static inline int security_sb_statfs (struct dentry *dentry)
  2092. {
  2093. return 0;
  2094. }
  2095. static inline int security_sb_mount (char *dev_name, struct nameidata *nd,
  2096. char *type, unsigned long flags,
  2097. void *data)
  2098. {
  2099. return 0;
  2100. }
  2101. static inline int security_sb_check_sb (struct vfsmount *mnt,
  2102. struct nameidata *nd)
  2103. {
  2104. return 0;
  2105. }
  2106. static inline int security_sb_umount (struct vfsmount *mnt, int flags)
  2107. {
  2108. return 0;
  2109. }
  2110. static inline void security_sb_umount_close (struct vfsmount *mnt)
  2111. { }
  2112. static inline void security_sb_umount_busy (struct vfsmount *mnt)
  2113. { }
  2114. static inline void security_sb_post_remount (struct vfsmount *mnt,
  2115. unsigned long flags, void *data)
  2116. { }
  2117. static inline void security_sb_post_mountroot (void)
  2118. { }
  2119. static inline void security_sb_post_addmount (struct vfsmount *mnt,
  2120. struct nameidata *mountpoint_nd)
  2121. { }
  2122. static inline int security_sb_pivotroot (struct nameidata *old_nd,
  2123. struct nameidata *new_nd)
  2124. {
  2125. return 0;
  2126. }
  2127. static inline void security_sb_post_pivotroot (struct nameidata *old_nd,
  2128. struct nameidata *new_nd)
  2129. { }
  2130. static inline int security_inode_alloc (struct inode *inode)
  2131. {
  2132. return 0;
  2133. }
  2134. static inline void security_inode_free (struct inode *inode)
  2135. { }
  2136. static inline int security_inode_init_security (struct inode *inode,
  2137. struct inode *dir,
  2138. char **name,
  2139. void **value,
  2140. size_t *len)
  2141. {
  2142. return -EOPNOTSUPP;
  2143. }
  2144. static inline int security_inode_create (struct inode *dir,
  2145. struct dentry *dentry,
  2146. int mode)
  2147. {
  2148. return 0;
  2149. }
  2150. static inline int security_inode_link (struct dentry *old_dentry,
  2151. struct inode *dir,
  2152. struct dentry *new_dentry)
  2153. {
  2154. return 0;
  2155. }
  2156. static inline int security_inode_unlink (struct inode *dir,
  2157. struct dentry *dentry)
  2158. {
  2159. return 0;
  2160. }
  2161. static inline int security_inode_symlink (struct inode *dir,
  2162. struct dentry *dentry,
  2163. const char *old_name)
  2164. {
  2165. return 0;
  2166. }
  2167. static inline int security_inode_mkdir (struct inode *dir,
  2168. struct dentry *dentry,
  2169. int mode)
  2170. {
  2171. return 0;
  2172. }
  2173. static inline int security_inode_rmdir (struct inode *dir,
  2174. struct dentry *dentry)
  2175. {
  2176. return 0;
  2177. }
  2178. static inline int security_inode_mknod (struct inode *dir,
  2179. struct dentry *dentry,
  2180. int mode, dev_t dev)
  2181. {
  2182. return 0;
  2183. }
  2184. static inline int security_inode_rename (struct inode *old_dir,
  2185. struct dentry *old_dentry,
  2186. struct inode *new_dir,
  2187. struct dentry *new_dentry)
  2188. {
  2189. return 0;
  2190. }
  2191. static inline int security_inode_readlink (struct dentry *dentry)
  2192. {
  2193. return 0;
  2194. }
  2195. static inline int security_inode_follow_link (struct dentry *dentry,
  2196. struct nameidata *nd)
  2197. {
  2198. return 0;
  2199. }
  2200. static inline int security_inode_permission (struct inode *inode, int mask,
  2201. struct nameidata *nd)
  2202. {
  2203. return 0;
  2204. }
  2205. static inline int security_inode_setattr (struct dentry *dentry,
  2206. struct iattr *attr)
  2207. {
  2208. return 0;
  2209. }
  2210. static inline int security_inode_getattr (struct vfsmount *mnt,
  2211. struct dentry *dentry)
  2212. {
  2213. return 0;
  2214. }
  2215. static inline void security_inode_delete (struct inode *inode)
  2216. { }
  2217. static inline int security_inode_setxattr (struct dentry *dentry, char *name,
  2218. void *value, size_t size, int flags)
  2219. {
  2220. return cap_inode_setxattr(dentry, name, value, size, flags);
  2221. }
  2222. static inline void security_inode_post_setxattr (struct dentry *dentry, char *name,
  2223. void *value, size_t size, int flags)
  2224. { }
  2225. static inline int security_inode_getxattr (struct dentry *dentry, char *name)
  2226. {
  2227. return 0;
  2228. }
  2229. static inline int security_inode_listxattr (struct dentry *dentry)
  2230. {
  2231. return 0;
  2232. }
  2233. static inline int security_inode_removexattr (struct dentry *dentry, char *name)
  2234. {
  2235. return cap_inode_removexattr(dentry, name);
  2236. }
  2237. static inline const char *security_inode_xattr_getsuffix (void)
  2238. {
  2239. return NULL ;
  2240. }
  2241. static inline int security_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
  2242. {
  2243. return -EOPNOTSUPP;
  2244. }
  2245. static inline int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
  2246. {
  2247. return -EOPNOTSUPP;
  2248. }
  2249. static inline int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
  2250. {
  2251. return 0;
  2252. }
  2253. static inline int security_file_permission (struct file *file, int mask)
  2254. {
  2255. return 0;
  2256. }
  2257. static inline int security_file_alloc (struct file *file)
  2258. {
  2259. return 0;
  2260. }
  2261. static inline void security_file_free (struct file *file)
  2262. { }
  2263. static inline int security_file_ioctl (struct file *file, unsigned int cmd,
  2264. unsigned long arg)
  2265. {
  2266. return 0;
  2267. }
  2268. static inline int security_file_mmap (struct file *file, unsigned long reqprot,
  2269. unsigned long prot,
  2270. unsigned long flags)
  2271. {
  2272. return 0;
  2273. }
  2274. static inline int security_file_mprotect (struct vm_area_struct *vma,
  2275. unsigned long reqprot,
  2276. unsigned long prot)
  2277. {
  2278. return 0;
  2279. }
  2280. static inline int security_file_lock (struct file *file, unsigned int cmd)
  2281. {
  2282. return 0;
  2283. }
  2284. static inline int security_file_fcntl (struct file *file, unsigned int cmd,
  2285. unsigned long arg)
  2286. {
  2287. return 0;
  2288. }
  2289. static inline int security_file_set_fowner (struct file *file)
  2290. {
  2291. return 0;
  2292. }
  2293. static inline int security_file_send_sigiotask (struct task_struct *tsk,
  2294. struct fown_struct *fown,
  2295. int sig)
  2296. {
  2297. return 0;
  2298. }
  2299. static inline int security_file_receive (struct file *file)
  2300. {
  2301. return 0;
  2302. }
  2303. static inline int security_task_create (unsigned long clone_flags)
  2304. {
  2305. return 0;
  2306. }
  2307. static inline int security_task_alloc (struct task_struct *p)
  2308. {
  2309. return 0;
  2310. }
  2311. static inline void security_task_free (struct task_struct *p)
  2312. { }
  2313. static inline int security_task_setuid (uid_t id0, uid_t id1, uid_t id2,
  2314. int flags)
  2315. {
  2316. return 0;
  2317. }
  2318. static inline int security_task_post_setuid (uid_t old_ruid, uid_t old_euid,
  2319. uid_t old_suid, int flags)
  2320. {
  2321. return cap_task_post_setuid (old_ruid, old_euid, old_suid, flags);
  2322. }
  2323. static inline int security_task_setgid (gid_t id0, gid_t id1, gid_t id2,
  2324. int flags)
  2325. {
  2326. return 0;
  2327. }
  2328. static inline int security_task_setpgid (struct task_struct *p, pid_t pgid)
  2329. {
  2330. return 0;
  2331. }
  2332. static inline int security_task_getpgid (struct task_struct *p)
  2333. {
  2334. return 0;
  2335. }
  2336. static inline int security_task_getsid (struct task_struct *p)
  2337. {
  2338. return 0;
  2339. }
  2340. static inline void security_task_getsecid (struct task_struct *p, u32 *secid)
  2341. { }
  2342. static inline int security_task_setgroups (struct group_info *group_info)
  2343. {
  2344. return 0;
  2345. }
  2346. static inline int security_task_setnice (struct task_struct *p, int nice)
  2347. {
  2348. return 0;
  2349. }
  2350. static inline int security_task_setioprio (struct task_struct *p, int ioprio)
  2351. {
  2352. return 0;
  2353. }
  2354. static inline int security_task_getioprio (struct task_struct *p)
  2355. {
  2356. return 0;
  2357. }
  2358. static inline int security_task_setrlimit (unsigned int resource,
  2359. struct rlimit *new_rlim)
  2360. {
  2361. return 0;
  2362. }
  2363. static inline int security_task_setscheduler (struct task_struct *p,
  2364. int policy,
  2365. struct sched_param *lp)
  2366. {
  2367. return 0;
  2368. }
  2369. static inline int security_task_getscheduler (struct task_struct *p)
  2370. {
  2371. return 0;
  2372. }
  2373. static inline int security_task_movememory (struct task_struct *p)
  2374. {
  2375. return 0;
  2376. }
  2377. static inline int security_task_kill (struct task_struct *p,
  2378. struct siginfo *info, int sig,
  2379. u32 secid)
  2380. {
  2381. return 0;
  2382. }
  2383. static inline int security_task_wait (struct task_struct *p)
  2384. {
  2385. return 0;
  2386. }
  2387. static inline int security_task_prctl (int option, unsigned long arg2,
  2388. unsigned long arg3,
  2389. unsigned long arg4,
  2390. unsigned long arg5)
  2391. {
  2392. return 0;
  2393. }
  2394. static inline void security_task_reparent_to_init (struct task_struct *p)
  2395. {
  2396. cap_task_reparent_to_init (p);
  2397. }
  2398. static inline void security_task_to_inode(struct task_struct *p, struct inode *inode)
  2399. { }
  2400. static inline int security_ipc_permission (struct kern_ipc_perm *ipcp,
  2401. short flag)
  2402. {
  2403. return 0;
  2404. }
  2405. static inline int security_msg_msg_alloc (struct msg_msg * msg)
  2406. {
  2407. return 0;
  2408. }
  2409. static inline void security_msg_msg_free (struct msg_msg * msg)
  2410. { }
  2411. static inline int security_msg_queue_alloc (struct msg_queue *msq)
  2412. {
  2413. return 0;
  2414. }
  2415. static inline void security_msg_queue_free (struct msg_queue *msq)
  2416. { }
  2417. static inline int security_msg_queue_associate (struct msg_queue * msq,
  2418. int msqflg)
  2419. {
  2420. return 0;
  2421. }
  2422. static inline int security_msg_queue_msgctl (struct msg_queue * msq, int cmd)
  2423. {
  2424. return 0;
  2425. }
  2426. static inline int security_msg_queue_msgsnd (struct msg_queue * msq,
  2427. struct msg_msg * msg, int msqflg)
  2428. {
  2429. return 0;
  2430. }
  2431. static inline int security_msg_queue_msgrcv (struct msg_queue * msq,
  2432. struct msg_msg * msg,
  2433. struct task_struct * target,
  2434. long type, int mode)
  2435. {
  2436. return 0;
  2437. }
  2438. static inline int security_shm_alloc (struct shmid_kernel *shp)
  2439. {
  2440. return 0;
  2441. }
  2442. static inline void security_shm_free (struct shmid_kernel *shp)
  2443. { }
  2444. static inline int security_shm_associate (struct shmid_kernel * shp,
  2445. int shmflg)
  2446. {
  2447. return 0;
  2448. }
  2449. static inline int security_shm_shmctl (struct shmid_kernel * shp, int cmd)
  2450. {
  2451. return 0;
  2452. }
  2453. static inline int security_shm_shmat (struct shmid_kernel * shp,
  2454. char __user *shmaddr, int shmflg)
  2455. {
  2456. return 0;
  2457. }
  2458. static inline int security_sem_alloc (struct sem_array *sma)
  2459. {
  2460. return 0;
  2461. }
  2462. static inline void security_sem_free (struct sem_array *sma)
  2463. { }
  2464. static inline int security_sem_associate (struct sem_array * sma, int semflg)
  2465. {
  2466. return 0;
  2467. }
  2468. static inline int security_sem_semctl (struct sem_array * sma, int cmd)
  2469. {
  2470. return 0;
  2471. }
  2472. static inline int security_sem_semop (struct sem_array * sma,
  2473. struct sembuf * sops, unsigned nsops,
  2474. int alter)
  2475. {
  2476. return 0;
  2477. }
  2478. static inline void security_d_instantiate (struct dentry *dentry, struct inode *inode)
  2479. { }
  2480. static inline int security_getprocattr(struct task_struct *p, char *name, char **value)
  2481. {
  2482. return -EINVAL;
  2483. }
  2484. static inline int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size)
  2485. {
  2486. return -EINVAL;
  2487. }
  2488. static inline int security_netlink_send (struct sock *sk, struct sk_buff *skb)
  2489. {
  2490. return cap_netlink_send (sk, skb);
  2491. }
  2492. static inline int security_netlink_recv (struct sk_buff *skb, int cap)
  2493. {
  2494. return cap_netlink_recv (skb, cap);
  2495. }
  2496. static inline struct dentry *securityfs_create_dir(const char *name,
  2497. struct dentry *parent)
  2498. {
  2499. return ERR_PTR(-ENODEV);
  2500. }
  2501. static inline struct dentry *securityfs_create_file(const char *name,
  2502. mode_t mode,
  2503. struct dentry *parent,
  2504. void *data,
  2505. struct file_operations *fops)
  2506. {
  2507. return ERR_PTR(-ENODEV);
  2508. }
  2509. static inline void securityfs_remove(struct dentry *dentry)
  2510. {
  2511. }
  2512. static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
  2513. {
  2514. return -EOPNOTSUPP;
  2515. }
  2516. static inline void security_release_secctx(char *secdata, u32 seclen)
  2517. {
  2518. }
  2519. #endif /* CONFIG_SECURITY */
  2520. #ifdef CONFIG_SECURITY_NETWORK
  2521. static inline int security_unix_stream_connect(struct socket * sock,
  2522. struct socket * other,
  2523. struct sock * newsk)
  2524. {
  2525. return security_ops->unix_stream_connect(sock, other, newsk);
  2526. }
  2527. static inline int security_unix_may_send(struct socket * sock,
  2528. struct socket * other)
  2529. {
  2530. return security_ops->unix_may_send(sock, other);
  2531. }
  2532. static inline int security_socket_create (int family, int type,
  2533. int protocol, int kern)
  2534. {
  2535. return security_ops->socket_create(family, type, protocol, kern);
  2536. }
  2537. static inline int security_socket_post_create(struct socket * sock,
  2538. int family,
  2539. int type,
  2540. int protocol, int kern)
  2541. {
  2542. return security_ops->socket_post_create(sock, family, type,
  2543. protocol, kern);
  2544. }
  2545. static inline int security_socket_bind(struct socket * sock,
  2546. struct sockaddr * address,
  2547. int addrlen)
  2548. {
  2549. return security_ops->socket_bind(sock, address, addrlen);
  2550. }
  2551. static inline int security_socket_connect(struct socket * sock,
  2552. struct sockaddr * address,
  2553. int addrlen)
  2554. {
  2555. return security_ops->socket_connect(sock, address, addrlen);
  2556. }
  2557. static inline int security_socket_listen(struct socket * sock, int backlog)
  2558. {
  2559. return security_ops->socket_listen(sock, backlog);
  2560. }
  2561. static inline int security_socket_accept(struct socket * sock,
  2562. struct socket * newsock)
  2563. {
  2564. return security_ops->socket_accept(sock, newsock);
  2565. }
  2566. static inline void security_socket_post_accept(struct socket * sock,
  2567. struct socket * newsock)
  2568. {
  2569. security_ops->socket_post_accept(sock, newsock);
  2570. }
  2571. static inline int security_socket_sendmsg(struct socket * sock,
  2572. struct msghdr * msg, int size)
  2573. {
  2574. return security_ops->socket_sendmsg(sock, msg, size);
  2575. }
  2576. static inline int security_socket_recvmsg(struct socket * sock,
  2577. struct msghdr * msg, int size,
  2578. int flags)
  2579. {
  2580. return security_ops->socket_recvmsg(sock, msg, size, flags);
  2581. }
  2582. static inline int security_socket_getsockname(struct socket * sock)
  2583. {
  2584. return security_ops->socket_getsockname(sock);
  2585. }
  2586. static inline int security_socket_getpeername(struct socket * sock)
  2587. {
  2588. return security_ops->socket_getpeername(sock);
  2589. }
  2590. static inline int security_socket_getsockopt(struct socket * sock,
  2591. int level, int optname)
  2592. {
  2593. return security_ops->socket_getsockopt(sock, level, optname);
  2594. }
  2595. static inline int security_socket_setsockopt(struct socket * sock,
  2596. int level, int optname)
  2597. {
  2598. return security_ops->socket_setsockopt(sock, level, optname);
  2599. }
  2600. static inline int security_socket_shutdown(struct socket * sock, int how)
  2601. {
  2602. return security_ops->socket_shutdown(sock, how);
  2603. }
  2604. static inline int security_sock_rcv_skb (struct sock * sk,
  2605. struct sk_buff * skb)
  2606. {
  2607. return security_ops->socket_sock_rcv_skb (sk, skb);
  2608. }
  2609. static inline int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
  2610. int __user *optlen, unsigned len)
  2611. {
  2612. return security_ops->socket_getpeersec_stream(sock, optval, optlen, len);
  2613. }
  2614. static inline int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
  2615. {
  2616. return security_ops->socket_getpeersec_dgram(sock, skb, secid);
  2617. }
  2618. static inline int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
  2619. {
  2620. return security_ops->sk_alloc_security(sk, family, priority);
  2621. }
  2622. static inline void security_sk_free(struct sock *sk)
  2623. {
  2624. return security_ops->sk_free_security(sk);
  2625. }
  2626. static inline void security_sk_clone(const struct sock *sk, struct sock *newsk)
  2627. {
  2628. return security_ops->sk_clone_security(sk, newsk);
  2629. }
  2630. static inline void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
  2631. {
  2632. security_ops->sk_getsecid(sk, &fl->secid);
  2633. }
  2634. static inline void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
  2635. {
  2636. security_ops->req_classify_flow(req, fl);
  2637. }
  2638. static inline void security_sock_graft(struct sock* sk, struct socket *parent)
  2639. {
  2640. security_ops->sock_graft(sk, parent);
  2641. }
  2642. static inline int security_inet_conn_request(struct sock *sk,
  2643. struct sk_buff *skb, struct request_sock *req)
  2644. {
  2645. return security_ops->inet_conn_request(sk, skb, req);
  2646. }
  2647. static inline void security_inet_csk_clone(struct sock *newsk,
  2648. const struct request_sock *req)
  2649. {
  2650. security_ops->inet_csk_clone(newsk, req);
  2651. }
  2652. static inline void security_inet_conn_established(struct sock *sk,
  2653. struct sk_buff *skb)
  2654. {
  2655. security_ops->inet_conn_established(sk, skb);
  2656. }
  2657. #else /* CONFIG_SECURITY_NETWORK */
  2658. static inline int security_unix_stream_connect(struct socket * sock,
  2659. struct socket * other,
  2660. struct sock * newsk)
  2661. {
  2662. return 0;
  2663. }
  2664. static inline int security_unix_may_send(struct socket * sock,
  2665. struct socket * other)
  2666. {
  2667. return 0;
  2668. }
  2669. static inline int security_socket_create (int family, int type,
  2670. int protocol, int kern)
  2671. {
  2672. return 0;
  2673. }
  2674. static inline int security_socket_post_create(struct socket * sock,
  2675. int family,
  2676. int type,
  2677. int protocol, int kern)
  2678. {
  2679. return 0;
  2680. }
  2681. static inline int security_socket_bind(struct socket * sock,
  2682. struct sockaddr * address,
  2683. int addrlen)
  2684. {
  2685. return 0;
  2686. }
  2687. static inline int security_socket_connect(struct socket * sock,
  2688. struct sockaddr * address,
  2689. int addrlen)
  2690. {
  2691. return 0;
  2692. }
  2693. static inline int security_socket_listen(struct socket * sock, int backlog)
  2694. {
  2695. return 0;
  2696. }
  2697. static inline int security_socket_accept(struct socket * sock,
  2698. struct socket * newsock)
  2699. {
  2700. return 0;
  2701. }
  2702. static inline void security_socket_post_accept(struct socket * sock,
  2703. struct socket * newsock)
  2704. {
  2705. }
  2706. static inline int security_socket_sendmsg(struct socket * sock,
  2707. struct msghdr * msg, int size)
  2708. {
  2709. return 0;
  2710. }
  2711. static inline int security_socket_recvmsg(struct socket * sock,
  2712. struct msghdr * msg, int size,
  2713. int flags)
  2714. {
  2715. return 0;
  2716. }
  2717. static inline int security_socket_getsockname(struct socket * sock)
  2718. {
  2719. return 0;
  2720. }
  2721. static inline int security_socket_getpeername(struct socket * sock)
  2722. {
  2723. return 0;
  2724. }
  2725. static inline int security_socket_getsockopt(struct socket * sock,
  2726. int level, int optname)
  2727. {
  2728. return 0;
  2729. }
  2730. static inline int security_socket_setsockopt(struct socket * sock,
  2731. int level, int optname)
  2732. {
  2733. return 0;
  2734. }
  2735. static inline int security_socket_shutdown(struct socket * sock, int how)
  2736. {
  2737. return 0;
  2738. }
  2739. static inline int security_sock_rcv_skb (struct sock * sk,
  2740. struct sk_buff * skb)
  2741. {
  2742. return 0;
  2743. }
  2744. static inline int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
  2745. int __user *optlen, unsigned len)
  2746. {
  2747. return -ENOPROTOOPT;
  2748. }
  2749. static inline int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
  2750. {
  2751. return -ENOPROTOOPT;
  2752. }
  2753. static inline int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
  2754. {
  2755. return 0;
  2756. }
  2757. static inline void security_sk_free(struct sock *sk)
  2758. {
  2759. }
  2760. static inline void security_sk_clone(const struct sock *sk, struct sock *newsk)
  2761. {
  2762. }
  2763. static inline void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
  2764. {
  2765. }
  2766. static inline void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
  2767. {
  2768. }
  2769. static inline void security_sock_graft(struct sock* sk, struct socket *parent)
  2770. {
  2771. }
  2772. static inline int security_inet_conn_request(struct sock *sk,
  2773. struct sk_buff *skb, struct request_sock *req)
  2774. {
  2775. return 0;
  2776. }
  2777. static inline void security_inet_csk_clone(struct sock *newsk,
  2778. const struct request_sock *req)
  2779. {
  2780. }
  2781. static inline void security_inet_conn_established(struct sock *sk,
  2782. struct sk_buff *skb)
  2783. {
  2784. }
  2785. #endif /* CONFIG_SECURITY_NETWORK */
  2786. #ifdef CONFIG_SECURITY_NETWORK_XFRM
  2787. static inline int security_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm_user_sec_ctx *sec_ctx)
  2788. {
  2789. return security_ops->xfrm_policy_alloc_security(xp, sec_ctx);
  2790. }
  2791. static inline int security_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new)
  2792. {
  2793. return security_ops->xfrm_policy_clone_security(old, new);
  2794. }
  2795. static inline void security_xfrm_policy_free(struct xfrm_policy *xp)
  2796. {
  2797. security_ops->xfrm_policy_free_security(xp);
  2798. }
  2799. static inline int security_xfrm_policy_delete(struct xfrm_policy *xp)
  2800. {
  2801. return security_ops->xfrm_policy_delete_security(xp);
  2802. }
  2803. static inline int security_xfrm_state_alloc(struct xfrm_state *x,
  2804. struct xfrm_user_sec_ctx *sec_ctx)
  2805. {
  2806. return security_ops->xfrm_state_alloc_security(x, sec_ctx, 0);
  2807. }
  2808. static inline int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
  2809. struct xfrm_sec_ctx *polsec, u32 secid)
  2810. {
  2811. if (!polsec)
  2812. return 0;
  2813. /*
  2814. * We want the context to be taken from secid which is usually
  2815. * from the sock.
  2816. */
  2817. return security_ops->xfrm_state_alloc_security(x, NULL, secid);
  2818. }
  2819. static inline int security_xfrm_state_delete(struct xfrm_state *x)
  2820. {
  2821. return security_ops->xfrm_state_delete_security(x);
  2822. }
  2823. static inline void security_xfrm_state_free(struct xfrm_state *x)
  2824. {
  2825. security_ops->xfrm_state_free_security(x);
  2826. }
  2827. static inline int security_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir)
  2828. {
  2829. return security_ops->xfrm_policy_lookup(xp, fl_secid, dir);
  2830. }
  2831. static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
  2832. struct xfrm_policy *xp, struct flowi *fl)
  2833. {
  2834. return security_ops->xfrm_state_pol_flow_match(x, xp, fl);
  2835. }
  2836. static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
  2837. {
  2838. return security_ops->xfrm_decode_session(skb, secid, 1);
  2839. }
  2840. static inline void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)
  2841. {
  2842. int rc = security_ops->xfrm_decode_session(skb, &fl->secid, 0);
  2843. BUG_ON(rc);
  2844. }
  2845. #else /* CONFIG_SECURITY_NETWORK_XFRM */
  2846. static inline int security_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm_user_sec_ctx *sec_ctx)
  2847. {
  2848. return 0;
  2849. }
  2850. static inline int security_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new)
  2851. {
  2852. return 0;
  2853. }
  2854. static inline void security_xfrm_policy_free(struct xfrm_policy *xp)
  2855. {
  2856. }
  2857. static inline int security_xfrm_policy_delete(struct xfrm_policy *xp)
  2858. {
  2859. return 0;
  2860. }
  2861. static inline int security_xfrm_state_alloc(struct xfrm_state *x,
  2862. struct xfrm_user_sec_ctx *sec_ctx)
  2863. {
  2864. return 0;
  2865. }
  2866. static inline int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
  2867. struct xfrm_sec_ctx *polsec, u32 secid)
  2868. {
  2869. return 0;
  2870. }
  2871. static inline void security_xfrm_state_free(struct xfrm_state *x)
  2872. {
  2873. }
  2874. static inline int security_xfrm_state_delete(struct xfrm_state *x)
  2875. {
  2876. return 0;
  2877. }
  2878. static inline int security_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir)
  2879. {
  2880. return 0;
  2881. }
  2882. static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
  2883. struct xfrm_policy *xp, struct flowi *fl)
  2884. {
  2885. return 1;
  2886. }
  2887. static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
  2888. {
  2889. return 0;
  2890. }
  2891. static inline void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)
  2892. {
  2893. }
  2894. #endif /* CONFIG_SECURITY_NETWORK_XFRM */
  2895. #ifdef CONFIG_KEYS
  2896. #ifdef CONFIG_SECURITY
  2897. static inline int security_key_alloc(struct key *key,
  2898. struct task_struct *tsk,
  2899. unsigned long flags)
  2900. {
  2901. return security_ops->key_alloc(key, tsk, flags);
  2902. }
  2903. static inline void security_key_free(struct key *key)
  2904. {
  2905. security_ops->key_free(key);
  2906. }
  2907. static inline int security_key_permission(key_ref_t key_ref,
  2908. struct task_struct *context,
  2909. key_perm_t perm)
  2910. {
  2911. return security_ops->key_permission(key_ref, context, perm);
  2912. }
  2913. #else
  2914. static inline int security_key_alloc(struct key *key,
  2915. struct task_struct *tsk,
  2916. unsigned long flags)
  2917. {
  2918. return 0;
  2919. }
  2920. static inline void security_key_free(struct key *key)
  2921. {
  2922. }
  2923. static inline int security_key_permission(key_ref_t key_ref,
  2924. struct task_struct *context,
  2925. key_perm_t perm)
  2926. {
  2927. return 0;
  2928. }
  2929. #endif
  2930. #endif /* CONFIG_KEYS */
  2931. #endif /* ! __LINUX_SECURITY_H */