lsm_hook_defs.h 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397
  1. /* SPDX-License-Identifier: GPL-2.0 */
  2. /*
  3. * Linux Security Module Hook declarations.
  4. *
  5. * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
  6. * Copyright (C) 2001 Greg Kroah-Hartman <greg@kroah.com>
  7. * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
  8. * Copyright (C) 2001 James Morris <jmorris@intercode.com.au>
  9. * Copyright (C) 2001 Silicon Graphics, Inc. (Trust Technology Group)
  10. * Copyright (C) 2015 Intel Corporation.
  11. * Copyright (C) 2015 Casey Schaufler <casey@schaufler-ca.com>
  12. * Copyright (C) 2016 Mellanox Techonologies
  13. * Copyright (C) 2020 Google LLC.
  14. */
  15. /*
  16. * The macro LSM_HOOK is used to define the data structures required by
  17. * the LSM framework using the pattern:
  18. *
  19. * LSM_HOOK(<return_type>, <default_value>, <hook_name>, args...)
  20. *
  21. * struct security_hook_heads {
  22. * #define LSM_HOOK(RET, DEFAULT, NAME, ...) struct hlist_head NAME;
  23. * #include <linux/lsm_hook_defs.h>
  24. * #undef LSM_HOOK
  25. * };
  26. */
  27. LSM_HOOK(int, 0, binder_set_context_mgr, const struct cred *mgr)
  28. LSM_HOOK(int, 0, binder_transaction, const struct cred *from,
  29. const struct cred *to)
  30. LSM_HOOK(int, 0, binder_transfer_binder, const struct cred *from,
  31. const struct cred *to)
  32. LSM_HOOK(int, 0, binder_transfer_file, const struct cred *from,
  33. const struct cred *to, struct file *file)
  34. LSM_HOOK(int, 0, ptrace_access_check, struct task_struct *child,
  35. unsigned int mode)
  36. LSM_HOOK(int, 0, ptrace_traceme, struct task_struct *parent)
  37. LSM_HOOK(int, 0, capget, struct task_struct *target, kernel_cap_t *effective,
  38. kernel_cap_t *inheritable, kernel_cap_t *permitted)
  39. LSM_HOOK(int, 0, capset, struct cred *new, const struct cred *old,
  40. const kernel_cap_t *effective, const kernel_cap_t *inheritable,
  41. const kernel_cap_t *permitted)
  42. LSM_HOOK(int, 0, capable, const struct cred *cred, struct user_namespace *ns,
  43. int cap, unsigned int opts)
  44. LSM_HOOK(int, 0, quotactl, int cmds, int type, int id, struct super_block *sb)
  45. LSM_HOOK(int, 0, quota_on, struct dentry *dentry)
  46. LSM_HOOK(int, 0, syslog, int type)
  47. LSM_HOOK(int, 0, settime, const struct timespec64 *ts,
  48. const struct timezone *tz)
  49. LSM_HOOK(int, 0, vm_enough_memory, struct mm_struct *mm, long pages)
  50. LSM_HOOK(int, 0, bprm_creds_for_exec, struct linux_binprm *bprm)
  51. LSM_HOOK(int, 0, bprm_creds_from_file, struct linux_binprm *bprm, struct file *file)
  52. LSM_HOOK(int, 0, bprm_check_security, struct linux_binprm *bprm)
  53. LSM_HOOK(void, LSM_RET_VOID, bprm_committing_creds, struct linux_binprm *bprm)
  54. LSM_HOOK(void, LSM_RET_VOID, bprm_committed_creds, struct linux_binprm *bprm)
  55. LSM_HOOK(int, 0, fs_context_dup, struct fs_context *fc,
  56. struct fs_context *src_sc)
  57. LSM_HOOK(int, -ENOPARAM, fs_context_parse_param, struct fs_context *fc,
  58. struct fs_parameter *param)
  59. LSM_HOOK(int, 0, sb_alloc_security, struct super_block *sb)
  60. LSM_HOOK(void, LSM_RET_VOID, sb_free_security, struct super_block *sb)
  61. LSM_HOOK(void, LSM_RET_VOID, sb_free_mnt_opts, void *mnt_opts)
  62. LSM_HOOK(int, 0, sb_eat_lsm_opts, char *orig, void **mnt_opts)
  63. LSM_HOOK(int, 0, sb_remount, struct super_block *sb, void *mnt_opts)
  64. LSM_HOOK(int, 0, sb_kern_mount, struct super_block *sb)
  65. LSM_HOOK(int, 0, sb_show_options, struct seq_file *m, struct super_block *sb)
  66. LSM_HOOK(int, 0, sb_statfs, struct dentry *dentry)
  67. LSM_HOOK(int, 0, sb_mount, const char *dev_name, const struct path *path,
  68. const char *type, unsigned long flags, void *data)
  69. LSM_HOOK(int, 0, sb_umount, struct vfsmount *mnt, int flags)
  70. LSM_HOOK(int, 0, sb_pivotroot, const struct path *old_path,
  71. const struct path *new_path)
  72. LSM_HOOK(int, 0, sb_set_mnt_opts, struct super_block *sb, void *mnt_opts,
  73. unsigned long kern_flags, unsigned long *set_kern_flags)
  74. LSM_HOOK(int, 0, sb_clone_mnt_opts, const struct super_block *oldsb,
  75. struct super_block *newsb, unsigned long kern_flags,
  76. unsigned long *set_kern_flags)
  77. LSM_HOOK(int, 0, sb_add_mnt_opt, const char *option, const char *val,
  78. int len, void **mnt_opts)
  79. LSM_HOOK(int, 0, move_mount, const struct path *from_path,
  80. const struct path *to_path)
  81. LSM_HOOK(int, 0, dentry_init_security, struct dentry *dentry,
  82. int mode, const struct qstr *name, void **ctx, u32 *ctxlen)
  83. LSM_HOOK(int, 0, dentry_create_files_as, struct dentry *dentry, int mode,
  84. struct qstr *name, const struct cred *old, struct cred *new)
  85. #ifdef CONFIG_SECURITY_PATH
  86. LSM_HOOK(int, 0, path_unlink, const struct path *dir, struct dentry *dentry)
  87. LSM_HOOK(int, 0, path_mkdir, const struct path *dir, struct dentry *dentry,
  88. umode_t mode)
  89. LSM_HOOK(int, 0, path_rmdir, const struct path *dir, struct dentry *dentry)
  90. LSM_HOOK(int, 0, path_mknod, const struct path *dir, struct dentry *dentry,
  91. umode_t mode, unsigned int dev)
  92. LSM_HOOK(int, 0, path_truncate, const struct path *path)
  93. LSM_HOOK(int, 0, path_symlink, const struct path *dir, struct dentry *dentry,
  94. const char *old_name)
  95. LSM_HOOK(int, 0, path_link, struct dentry *old_dentry,
  96. const struct path *new_dir, struct dentry *new_dentry)
  97. LSM_HOOK(int, 0, path_rename, const struct path *old_dir,
  98. struct dentry *old_dentry, const struct path *new_dir,
  99. struct dentry *new_dentry)
  100. LSM_HOOK(int, 0, path_chmod, const struct path *path, umode_t mode)
  101. LSM_HOOK(int, 0, path_chown, const struct path *path, kuid_t uid, kgid_t gid)
  102. LSM_HOOK(int, 0, path_chroot, const struct path *path)
  103. #endif /* CONFIG_SECURITY_PATH */
  104. /* Needed for inode based security check */
  105. LSM_HOOK(int, 0, path_notify, const struct path *path, u64 mask,
  106. unsigned int obj_type)
  107. LSM_HOOK(int, 0, inode_alloc_security, struct inode *inode)
  108. LSM_HOOK(void, LSM_RET_VOID, inode_free_security, struct inode *inode)
  109. LSM_HOOK(int, 0, inode_init_security, struct inode *inode,
  110. struct inode *dir, const struct qstr *qstr, const char **name,
  111. void **value, size_t *len)
  112. LSM_HOOK(int, 0, inode_init_security_anon, struct inode *inode,
  113. const struct qstr *name, const struct inode *context_inode)
  114. LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry,
  115. umode_t mode)
  116. LSM_HOOK(int, 0, inode_link, struct dentry *old_dentry, struct inode *dir,
  117. struct dentry *new_dentry)
  118. LSM_HOOK(int, 0, inode_unlink, struct inode *dir, struct dentry *dentry)
  119. LSM_HOOK(int, 0, inode_symlink, struct inode *dir, struct dentry *dentry,
  120. const char *old_name)
  121. LSM_HOOK(int, 0, inode_mkdir, struct inode *dir, struct dentry *dentry,
  122. umode_t mode)
  123. LSM_HOOK(int, 0, inode_rmdir, struct inode *dir, struct dentry *dentry)
  124. LSM_HOOK(int, 0, inode_mknod, struct inode *dir, struct dentry *dentry,
  125. umode_t mode, dev_t dev)
  126. LSM_HOOK(int, 0, inode_rename, struct inode *old_dir, struct dentry *old_dentry,
  127. struct inode *new_dir, struct dentry *new_dentry)
  128. LSM_HOOK(int, 0, inode_readlink, struct dentry *dentry)
  129. LSM_HOOK(int, 0, inode_follow_link, struct dentry *dentry, struct inode *inode,
  130. bool rcu)
  131. LSM_HOOK(int, 0, inode_permission, struct inode *inode, int mask)
  132. LSM_HOOK(int, 0, inode_setattr, struct dentry *dentry, struct iattr *attr)
  133. LSM_HOOK(int, 0, inode_getattr, const struct path *path)
  134. LSM_HOOK(int, 0, inode_setxattr, struct dentry *dentry, const char *name,
  135. const void *value, size_t size, int flags)
  136. LSM_HOOK(void, LSM_RET_VOID, inode_post_setxattr, struct dentry *dentry,
  137. const char *name, const void *value, size_t size, int flags)
  138. LSM_HOOK(int, 0, inode_getxattr, struct dentry *dentry, const char *name)
  139. LSM_HOOK(int, 0, inode_listxattr, struct dentry *dentry)
  140. LSM_HOOK(int, 0, inode_removexattr, struct dentry *dentry, const char *name)
  141. LSM_HOOK(int, 0, inode_need_killpriv, struct dentry *dentry)
  142. LSM_HOOK(int, 0, inode_killpriv, struct dentry *dentry)
  143. LSM_HOOK(int, -EOPNOTSUPP, inode_getsecurity, struct inode *inode,
  144. const char *name, void **buffer, bool alloc)
  145. LSM_HOOK(int, -EOPNOTSUPP, inode_setsecurity, struct inode *inode,
  146. const char *name, const void *value, size_t size, int flags)
  147. LSM_HOOK(int, 0, inode_listsecurity, struct inode *inode, char *buffer,
  148. size_t buffer_size)
  149. LSM_HOOK(void, LSM_RET_VOID, inode_getsecid, struct inode *inode, u32 *secid)
  150. LSM_HOOK(int, 0, inode_copy_up, struct dentry *src, struct cred **new)
  151. LSM_HOOK(int, -EOPNOTSUPP, inode_copy_up_xattr, const char *name)
  152. LSM_HOOK(int, 0, kernfs_init_security, struct kernfs_node *kn_dir,
  153. struct kernfs_node *kn)
  154. LSM_HOOK(int, 0, file_permission, struct file *file, int mask)
  155. LSM_HOOK(int, 0, file_alloc_security, struct file *file)
  156. LSM_HOOK(void, LSM_RET_VOID, file_free_security, struct file *file)
  157. LSM_HOOK(int, 0, file_ioctl, struct file *file, unsigned int cmd,
  158. unsigned long arg)
  159. LSM_HOOK(int, 0, mmap_addr, unsigned long addr)
  160. LSM_HOOK(int, 0, mmap_file, struct file *file, unsigned long reqprot,
  161. unsigned long prot, unsigned long flags)
  162. LSM_HOOK(int, 0, file_mprotect, struct vm_area_struct *vma,
  163. unsigned long reqprot, unsigned long prot)
  164. LSM_HOOK(int, 0, file_lock, struct file *file, unsigned int cmd)
  165. LSM_HOOK(int, 0, file_fcntl, struct file *file, unsigned int cmd,
  166. unsigned long arg)
  167. LSM_HOOK(void, LSM_RET_VOID, file_set_fowner, struct file *file)
  168. LSM_HOOK(int, 0, file_send_sigiotask, struct task_struct *tsk,
  169. struct fown_struct *fown, int sig)
  170. LSM_HOOK(int, 0, file_receive, struct file *file)
  171. LSM_HOOK(int, 0, file_open, struct file *file)
  172. LSM_HOOK(int, 0, task_alloc, struct task_struct *task,
  173. unsigned long clone_flags)
  174. LSM_HOOK(void, LSM_RET_VOID, task_free, struct task_struct *task)
  175. LSM_HOOK(int, 0, cred_alloc_blank, struct cred *cred, gfp_t gfp)
  176. LSM_HOOK(void, LSM_RET_VOID, cred_free, struct cred *cred)
  177. LSM_HOOK(int, 0, cred_prepare, struct cred *new, const struct cred *old,
  178. gfp_t gfp)
  179. LSM_HOOK(void, LSM_RET_VOID, cred_transfer, struct cred *new,
  180. const struct cred *old)
  181. LSM_HOOK(void, LSM_RET_VOID, cred_getsecid, const struct cred *c, u32 *secid)
  182. LSM_HOOK(int, 0, kernel_act_as, struct cred *new, u32 secid)
  183. LSM_HOOK(int, 0, kernel_create_files_as, struct cred *new, struct inode *inode)
  184. LSM_HOOK(int, 0, kernel_module_request, char *kmod_name)
  185. LSM_HOOK(int, 0, kernel_load_data, enum kernel_load_data_id id, bool contents)
  186. LSM_HOOK(int, 0, kernel_post_load_data, char *buf, loff_t size,
  187. enum kernel_load_data_id id, char *description)
  188. LSM_HOOK(int, 0, kernel_read_file, struct file *file,
  189. enum kernel_read_file_id id, bool contents)
  190. LSM_HOOK(int, 0, kernel_post_read_file, struct file *file, char *buf,
  191. loff_t size, enum kernel_read_file_id id)
  192. LSM_HOOK(int, 0, task_fix_setuid, struct cred *new, const struct cred *old,
  193. int flags)
  194. LSM_HOOK(int, 0, task_fix_setgid, struct cred *new, const struct cred * old,
  195. int flags)
  196. LSM_HOOK(int, 0, task_setpgid, struct task_struct *p, pid_t pgid)
  197. LSM_HOOK(int, 0, task_getpgid, struct task_struct *p)
  198. LSM_HOOK(int, 0, task_getsid, struct task_struct *p)
  199. LSM_HOOK(void, LSM_RET_VOID, task_getsecid, struct task_struct *p, u32 *secid)
  200. LSM_HOOK(int, 0, task_setnice, struct task_struct *p, int nice)
  201. LSM_HOOK(int, 0, task_setioprio, struct task_struct *p, int ioprio)
  202. LSM_HOOK(int, 0, task_getioprio, struct task_struct *p)
  203. LSM_HOOK(int, 0, task_prlimit, const struct cred *cred,
  204. const struct cred *tcred, unsigned int flags)
  205. LSM_HOOK(int, 0, task_setrlimit, struct task_struct *p, unsigned int resource,
  206. struct rlimit *new_rlim)
  207. LSM_HOOK(int, 0, task_setscheduler, struct task_struct *p)
  208. LSM_HOOK(int, 0, task_getscheduler, struct task_struct *p)
  209. LSM_HOOK(int, 0, task_movememory, struct task_struct *p)
  210. LSM_HOOK(int, 0, task_kill, struct task_struct *p, struct kernel_siginfo *info,
  211. int sig, const struct cred *cred)
  212. LSM_HOOK(int, -ENOSYS, task_prctl, int option, unsigned long arg2,
  213. unsigned long arg3, unsigned long arg4, unsigned long arg5)
  214. LSM_HOOK(void, LSM_RET_VOID, task_to_inode, struct task_struct *p,
  215. struct inode *inode)
  216. LSM_HOOK(int, 0, ipc_permission, struct kern_ipc_perm *ipcp, short flag)
  217. LSM_HOOK(void, LSM_RET_VOID, ipc_getsecid, struct kern_ipc_perm *ipcp,
  218. u32 *secid)
  219. LSM_HOOK(int, 0, msg_msg_alloc_security, struct msg_msg *msg)
  220. LSM_HOOK(void, LSM_RET_VOID, msg_msg_free_security, struct msg_msg *msg)
  221. LSM_HOOK(int, 0, msg_queue_alloc_security, struct kern_ipc_perm *perm)
  222. LSM_HOOK(void, LSM_RET_VOID, msg_queue_free_security,
  223. struct kern_ipc_perm *perm)
  224. LSM_HOOK(int, 0, msg_queue_associate, struct kern_ipc_perm *perm, int msqflg)
  225. LSM_HOOK(int, 0, msg_queue_msgctl, struct kern_ipc_perm *perm, int cmd)
  226. LSM_HOOK(int, 0, msg_queue_msgsnd, struct kern_ipc_perm *perm,
  227. struct msg_msg *msg, int msqflg)
  228. LSM_HOOK(int, 0, msg_queue_msgrcv, struct kern_ipc_perm *perm,
  229. struct msg_msg *msg, struct task_struct *target, long type, int mode)
  230. LSM_HOOK(int, 0, shm_alloc_security, struct kern_ipc_perm *perm)
  231. LSM_HOOK(void, LSM_RET_VOID, shm_free_security, struct kern_ipc_perm *perm)
  232. LSM_HOOK(int, 0, shm_associate, struct kern_ipc_perm *perm, int shmflg)
  233. LSM_HOOK(int, 0, shm_shmctl, struct kern_ipc_perm *perm, int cmd)
  234. LSM_HOOK(int, 0, shm_shmat, struct kern_ipc_perm *perm, char __user *shmaddr,
  235. int shmflg)
  236. LSM_HOOK(int, 0, sem_alloc_security, struct kern_ipc_perm *perm)
  237. LSM_HOOK(void, LSM_RET_VOID, sem_free_security, struct kern_ipc_perm *perm)
  238. LSM_HOOK(int, 0, sem_associate, struct kern_ipc_perm *perm, int semflg)
  239. LSM_HOOK(int, 0, sem_semctl, struct kern_ipc_perm *perm, int cmd)
  240. LSM_HOOK(int, 0, sem_semop, struct kern_ipc_perm *perm, struct sembuf *sops,
  241. unsigned nsops, int alter)
  242. LSM_HOOK(int, 0, netlink_send, struct sock *sk, struct sk_buff *skb)
  243. LSM_HOOK(void, LSM_RET_VOID, d_instantiate, struct dentry *dentry,
  244. struct inode *inode)
  245. LSM_HOOK(int, -EINVAL, getprocattr, struct task_struct *p, char *name,
  246. char **value)
  247. LSM_HOOK(int, -EINVAL, setprocattr, const char *name, void *value, size_t size)
  248. LSM_HOOK(int, 0, ismaclabel, const char *name)
  249. LSM_HOOK(int, -EOPNOTSUPP, secid_to_secctx, u32 secid, char **secdata,
  250. u32 *seclen)
  251. LSM_HOOK(int, 0, secctx_to_secid, const char *secdata, u32 seclen, u32 *secid)
  252. LSM_HOOK(void, LSM_RET_VOID, release_secctx, char *secdata, u32 seclen)
  253. LSM_HOOK(void, LSM_RET_VOID, inode_invalidate_secctx, struct inode *inode)
  254. LSM_HOOK(int, 0, inode_notifysecctx, struct inode *inode, void *ctx, u32 ctxlen)
  255. LSM_HOOK(int, 0, inode_setsecctx, struct dentry *dentry, void *ctx, u32 ctxlen)
  256. LSM_HOOK(int, 0, inode_getsecctx, struct inode *inode, void **ctx,
  257. u32 *ctxlen)
  258. #if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
  259. LSM_HOOK(int, 0, post_notification, const struct cred *w_cred,
  260. const struct cred *cred, struct watch_notification *n)
  261. #endif /* CONFIG_SECURITY && CONFIG_WATCH_QUEUE */
  262. #if defined(CONFIG_SECURITY) && defined(CONFIG_KEY_NOTIFICATIONS)
  263. LSM_HOOK(int, 0, watch_key, struct key *key)
  264. #endif /* CONFIG_SECURITY && CONFIG_KEY_NOTIFICATIONS */
  265. #ifdef CONFIG_SECURITY_NETWORK
  266. LSM_HOOK(int, 0, unix_stream_connect, struct sock *sock, struct sock *other,
  267. struct sock *newsk)
  268. LSM_HOOK(int, 0, unix_may_send, struct socket *sock, struct socket *other)
  269. LSM_HOOK(int, 0, socket_create, int family, int type, int protocol, int kern)
  270. LSM_HOOK(int, 0, socket_post_create, struct socket *sock, int family, int type,
  271. int protocol, int kern)
  272. LSM_HOOK(int, 0, socket_socketpair, struct socket *socka, struct socket *sockb)
  273. LSM_HOOK(int, 0, socket_bind, struct socket *sock, struct sockaddr *address,
  274. int addrlen)
  275. LSM_HOOK(int, 0, socket_connect, struct socket *sock, struct sockaddr *address,
  276. int addrlen)
  277. LSM_HOOK(int, 0, socket_listen, struct socket *sock, int backlog)
  278. LSM_HOOK(int, 0, socket_accept, struct socket *sock, struct socket *newsock)
  279. LSM_HOOK(int, 0, socket_sendmsg, struct socket *sock, struct msghdr *msg,
  280. int size)
  281. LSM_HOOK(int, 0, socket_recvmsg, struct socket *sock, struct msghdr *msg,
  282. int size, int flags)
  283. LSM_HOOK(int, 0, socket_getsockname, struct socket *sock)
  284. LSM_HOOK(int, 0, socket_getpeername, struct socket *sock)
  285. LSM_HOOK(int, 0, socket_getsockopt, struct socket *sock, int level, int optname)
  286. LSM_HOOK(int, 0, socket_setsockopt, struct socket *sock, int level, int optname)
  287. LSM_HOOK(int, 0, socket_shutdown, struct socket *sock, int how)
  288. LSM_HOOK(int, 0, socket_sock_rcv_skb, struct sock *sk, struct sk_buff *skb)
  289. LSM_HOOK(int, 0, socket_getpeersec_stream, struct socket *sock,
  290. char __user *optval, int __user *optlen, unsigned len)
  291. LSM_HOOK(int, 0, socket_getpeersec_dgram, struct socket *sock,
  292. struct sk_buff *skb, u32 *secid)
  293. LSM_HOOK(int, 0, sk_alloc_security, struct sock *sk, int family, gfp_t priority)
  294. LSM_HOOK(void, LSM_RET_VOID, sk_free_security, struct sock *sk)
  295. LSM_HOOK(void, LSM_RET_VOID, sk_clone_security, const struct sock *sk,
  296. struct sock *newsk)
  297. LSM_HOOK(void, LSM_RET_VOID, sk_getsecid, struct sock *sk, u32 *secid)
  298. LSM_HOOK(void, LSM_RET_VOID, sock_graft, struct sock *sk, struct socket *parent)
  299. LSM_HOOK(int, 0, inet_conn_request, struct sock *sk, struct sk_buff *skb,
  300. struct request_sock *req)
  301. LSM_HOOK(void, LSM_RET_VOID, inet_csk_clone, struct sock *newsk,
  302. const struct request_sock *req)
  303. LSM_HOOK(void, LSM_RET_VOID, inet_conn_established, struct sock *sk,
  304. struct sk_buff *skb)
  305. LSM_HOOK(int, 0, secmark_relabel_packet, u32 secid)
  306. LSM_HOOK(void, LSM_RET_VOID, secmark_refcount_inc, void)
  307. LSM_HOOK(void, LSM_RET_VOID, secmark_refcount_dec, void)
  308. LSM_HOOK(void, LSM_RET_VOID, req_classify_flow, const struct request_sock *req,
  309. struct flowi *fl)
  310. LSM_HOOK(int, 0, tun_dev_alloc_security, void **security)
  311. LSM_HOOK(void, LSM_RET_VOID, tun_dev_free_security, void *security)
  312. LSM_HOOK(int, 0, tun_dev_create, void)
  313. LSM_HOOK(int, 0, tun_dev_attach_queue, void *security)
  314. LSM_HOOK(int, 0, tun_dev_attach, struct sock *sk, void *security)
  315. LSM_HOOK(int, 0, tun_dev_open, void *security)
  316. LSM_HOOK(int, 0, sctp_assoc_request, struct sctp_endpoint *ep,
  317. struct sk_buff *skb)
  318. LSM_HOOK(int, 0, sctp_bind_connect, struct sock *sk, int optname,
  319. struct sockaddr *address, int addrlen)
  320. LSM_HOOK(void, LSM_RET_VOID, sctp_sk_clone, struct sctp_endpoint *ep,
  321. struct sock *sk, struct sock *newsk)
  322. #endif /* CONFIG_SECURITY_NETWORK */
  323. #ifdef CONFIG_SECURITY_INFINIBAND
  324. LSM_HOOK(int, 0, ib_pkey_access, void *sec, u64 subnet_prefix, u16 pkey)
  325. LSM_HOOK(int, 0, ib_endport_manage_subnet, void *sec, const char *dev_name,
  326. u8 port_num)
  327. LSM_HOOK(int, 0, ib_alloc_security, void **sec)
  328. LSM_HOOK(void, LSM_RET_VOID, ib_free_security, void *sec)
  329. #endif /* CONFIG_SECURITY_INFINIBAND */
  330. #ifdef CONFIG_SECURITY_NETWORK_XFRM
  331. LSM_HOOK(int, 0, xfrm_policy_alloc_security, struct xfrm_sec_ctx **ctxp,
  332. struct xfrm_user_sec_ctx *sec_ctx, gfp_t gfp)
  333. LSM_HOOK(int, 0, xfrm_policy_clone_security, struct xfrm_sec_ctx *old_ctx,
  334. struct xfrm_sec_ctx **new_ctx)
  335. LSM_HOOK(void, LSM_RET_VOID, xfrm_policy_free_security,
  336. struct xfrm_sec_ctx *ctx)
  337. LSM_HOOK(int, 0, xfrm_policy_delete_security, struct xfrm_sec_ctx *ctx)
  338. LSM_HOOK(int, 0, xfrm_state_alloc, struct xfrm_state *x,
  339. struct xfrm_user_sec_ctx *sec_ctx)
  340. LSM_HOOK(int, 0, xfrm_state_alloc_acquire, struct xfrm_state *x,
  341. struct xfrm_sec_ctx *polsec, u32 secid)
  342. LSM_HOOK(void, LSM_RET_VOID, xfrm_state_free_security, struct xfrm_state *x)
  343. LSM_HOOK(int, 0, xfrm_state_delete_security, struct xfrm_state *x)
  344. LSM_HOOK(int, 0, xfrm_policy_lookup, struct xfrm_sec_ctx *ctx, u32 fl_secid,
  345. u8 dir)
  346. LSM_HOOK(int, 1, xfrm_state_pol_flow_match, struct xfrm_state *x,
  347. struct xfrm_policy *xp, const struct flowi *fl)
  348. LSM_HOOK(int, 0, xfrm_decode_session, struct sk_buff *skb, u32 *secid,
  349. int ckall)
  350. #endif /* CONFIG_SECURITY_NETWORK_XFRM */
  351. /* key management security hooks */
  352. #ifdef CONFIG_KEYS
  353. LSM_HOOK(int, 0, key_alloc, struct key *key, const struct cred *cred,
  354. unsigned long flags)
  355. LSM_HOOK(void, LSM_RET_VOID, key_free, struct key *key)
  356. LSM_HOOK(int, 0, key_permission, key_ref_t key_ref, const struct cred *cred,
  357. enum key_need_perm need_perm)
  358. LSM_HOOK(int, 0, key_getsecurity, struct key *key, char **_buffer)
  359. #endif /* CONFIG_KEYS */
  360. #ifdef CONFIG_AUDIT
  361. LSM_HOOK(int, 0, audit_rule_init, u32 field, u32 op, char *rulestr,
  362. void **lsmrule)
  363. LSM_HOOK(int, 0, audit_rule_known, struct audit_krule *krule)
  364. LSM_HOOK(int, 0, audit_rule_match, u32 secid, u32 field, u32 op, void *lsmrule)
  365. LSM_HOOK(void, LSM_RET_VOID, audit_rule_free, void *lsmrule)
  366. #endif /* CONFIG_AUDIT */
  367. #ifdef CONFIG_BPF_SYSCALL
  368. LSM_HOOK(int, 0, bpf, int cmd, union bpf_attr *attr, unsigned int size)
  369. LSM_HOOK(int, 0, bpf_map, struct bpf_map *map, fmode_t fmode)
  370. LSM_HOOK(int, 0, bpf_prog, struct bpf_prog *prog)
  371. LSM_HOOK(int, 0, bpf_map_alloc_security, struct bpf_map *map)
  372. LSM_HOOK(void, LSM_RET_VOID, bpf_map_free_security, struct bpf_map *map)
  373. LSM_HOOK(int, 0, bpf_prog_alloc_security, struct bpf_prog_aux *aux)
  374. LSM_HOOK(void, LSM_RET_VOID, bpf_prog_free_security, struct bpf_prog_aux *aux)
  375. #endif /* CONFIG_BPF_SYSCALL */
  376. LSM_HOOK(int, 0, locked_down, enum lockdown_reason what)
  377. #ifdef CONFIG_PERF_EVENTS
  378. LSM_HOOK(int, 0, perf_event_open, struct perf_event_attr *attr, int type)
  379. LSM_HOOK(int, 0, perf_event_alloc, struct perf_event *event)
  380. LSM_HOOK(void, LSM_RET_VOID, perf_event_free, struct perf_event *event)
  381. LSM_HOOK(int, 0, perf_event_read, struct perf_event *event)
  382. LSM_HOOK(int, 0, perf_event_write, struct perf_event *event)
  383. #endif /* CONFIG_PERF_EVENTS */