projects / deliverable / linux.git / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
selinux: update netlink socket classes
[deliverable/linux.git] / security / security.c
... / ...
CommitLineData
1/*
2 * Security plug functions
3 *
4 * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
5 * Copyright (C) 2001-2002 Greg Kroah-Hartman <greg@kroah.com>
6 * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 */
13
14#include <linux/capability.h>
15#include <linux/dcache.h>
16#include <linux/module.h>
17#include <linux/init.h>
18#include <linux/kernel.h>
19#include <linux/lsm_hooks.h>
20#include <linux/integrity.h>
21#include <linux/ima.h>
22#include <linux/evm.h>
23#include <linux/fsnotify.h>
24#include <linux/mman.h>
25#include <linux/mount.h>
26#include <linux/personality.h>
27#include <linux/backing-dev.h>
28#include <net/flow.h>
29
30#define MAX_LSM_EVM_XATTR 2
31
32/* Maximum number of letters for an LSM name string */
33#define SECURITY_NAME_MAX 10
34
35/* Boot-time LSM user choice */
36static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] =
37 CONFIG_DEFAULT_SECURITY;
38
39static void __init do_security_initcalls(void)
40{
41 initcall_t *call;
42 call = __security_initcall_start;
43 while (call < __security_initcall_end) {
44 (*call) ();
45 call++;
46 }
47}
48
49/**
50 * security_init - initializes the security framework
51 *
52 * This should be called early in the kernel initialization sequence.
53 */
54int __init security_init(void)
55{
56 pr_info("Security Framework initialized\n");
57
58 /*
59 * Always load the capability module.
60 */
61 capability_add_hooks();
62#ifdef CONFIG_SECURITY_YAMA_STACKED
63 /*
64 * If Yama is configured for stacking load it next.
65 */
66 yama_add_hooks();
67#endif
68 /*
69 * Load the chosen module if there is one.
70 * This will also find yama if it is stacking
71 */
72 do_security_initcalls();
73
74 return 0;
75}
76
77/* Save user chosen LSM */
78static int __init choose_lsm(char *str)
79{
80 strncpy(chosen_lsm, str, SECURITY_NAME_MAX);
81 return 1;
82}
83__setup("security=", choose_lsm);
84
85/**
86 * security_module_enable - Load given security module on boot ?
87 * @module: the name of the module
88 *
89 * Each LSM must pass this method before registering its own operations
90 * to avoid security registration races. This method may also be used
91 * to check if your LSM is currently loaded during kernel initialization.
92 *
93 * Return true if:
94 * -The passed LSM is the one chosen by user at boot time,
95 * -or the passed LSM is configured as the default and the user did not
96 * choose an alternate LSM at boot time.
97 * Otherwise, return false.
98 */
99int __init security_module_enable(const char *module)
100{
101 return !strcmp(module, chosen_lsm);
102}
103
104/*
105 * Hook list operation macros.
106 *
107 * call_void_hook:
108 * This is a hook that does not return a value.
109 *
110 * call_int_hook:
111 * This is a hook that returns a value.
112 */
113
114#define call_void_hook(FUNC, ...) \
115 do { \
116 struct security_hook_list *P; \
117 \
118 list_for_each_entry(P, &security_hook_heads.FUNC, list) \
119 P->hook.FUNC(__VA_ARGS__); \
120 } while (0)
121
122#define call_int_hook(FUNC, IRC, ...) ({ \
123 int RC = IRC; \
124 do { \
125 struct security_hook_list *P; \
126 \
127 list_for_each_entry(P, &security_hook_heads.FUNC, list) { \
128 RC = P->hook.FUNC(__VA_ARGS__); \
129 if (RC != 0) \
130 break; \
131 } \
132 } while (0); \
133 RC; \
134})
135
136/* Security operations */
137
138int security_binder_set_context_mgr(struct task_struct *mgr)
139{
140 return call_int_hook(binder_set_context_mgr, 0, mgr);
141}
142
143int security_binder_transaction(struct task_struct *from,
144 struct task_struct *to)
145{
146 return call_int_hook(binder_transaction, 0, from, to);
147}
148
149int security_binder_transfer_binder(struct task_struct *from,
150 struct task_struct *to)
151{
152 return call_int_hook(binder_transfer_binder, 0, from, to);
153}
154
155int security_binder_transfer_file(struct task_struct *from,
156 struct task_struct *to, struct file *file)
157{
158 return call_int_hook(binder_transfer_file, 0, from, to, file);
159}
160
161int security_ptrace_access_check(struct task_struct *child, unsigned int mode)
162{
163 return call_int_hook(ptrace_access_check, 0, child, mode);
164}
165
166int security_ptrace_traceme(struct task_struct *parent)
167{
168 return call_int_hook(ptrace_traceme, 0, parent);
169}
170
171int security_capget(struct task_struct *target,
172 kernel_cap_t *effective,
173 kernel_cap_t *inheritable,
174 kernel_cap_t *permitted)
175{
176 return call_int_hook(capget, 0, target,
177 effective, inheritable, permitted);
178}
179
180int security_capset(struct cred *new, const struct cred *old,
181 const kernel_cap_t *effective,
182 const kernel_cap_t *inheritable,
183 const kernel_cap_t *permitted)
184{
185 return call_int_hook(capset, 0, new, old,
186 effective, inheritable, permitted);
187}
188
189int security_capable(const struct cred *cred, struct user_namespace *ns,
190 int cap)
191{
192 return call_int_hook(capable, 0, cred, ns, cap, SECURITY_CAP_AUDIT);
193}
194
195int security_capable_noaudit(const struct cred *cred, struct user_namespace *ns,
196 int cap)
197{
198 return call_int_hook(capable, 0, cred, ns, cap, SECURITY_CAP_NOAUDIT);
199}
200
201int security_quotactl(int cmds, int type, int id, struct super_block *sb)
202{
203 return call_int_hook(quotactl, 0, cmds, type, id, sb);
204}
205
206int security_quota_on(struct dentry *dentry)
207{
208 return call_int_hook(quota_on, 0, dentry);
209}
210
211int security_syslog(int type)
212{
213 return call_int_hook(syslog, 0, type);
214}
215
216int security_settime(const struct timespec *ts, const struct timezone *tz)
217{
218 return call_int_hook(settime, 0, ts, tz);
219}
220
221int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
222{
223 struct security_hook_list *hp;
224 int cap_sys_admin = 1;
225 int rc;
226
227 /*
228 * The module will respond with a positive value if
229 * it thinks the __vm_enough_memory() call should be
230 * made with the cap_sys_admin set. If all of the modules
231 * agree that it should be set it will. If any module
232 * thinks it should not be set it won't.
233 */
234 list_for_each_entry(hp, &security_hook_heads.vm_enough_memory, list) {
235 rc = hp->hook.vm_enough_memory(mm, pages);
236 if (rc <= 0) {
237 cap_sys_admin = 0;
238 break;
239 }
240 }
241 return __vm_enough_memory(mm, pages, cap_sys_admin);
242}
243
244int security_bprm_set_creds(struct linux_binprm *bprm)
245{
246 return call_int_hook(bprm_set_creds, 0, bprm);
247}
248
249int security_bprm_check(struct linux_binprm *bprm)
250{
251 int ret;
252
253 ret = call_int_hook(bprm_check_security, 0, bprm);
254 if (ret)
255 return ret;
256 return ima_bprm_check(bprm);
257}
258
259void security_bprm_committing_creds(struct linux_binprm *bprm)
260{
261 call_void_hook(bprm_committing_creds, bprm);
262}
263
264void security_bprm_committed_creds(struct linux_binprm *bprm)
265{
266 call_void_hook(bprm_committed_creds, bprm);
267}
268
269int security_bprm_secureexec(struct linux_binprm *bprm)
270{
271 return call_int_hook(bprm_secureexec, 0, bprm);
272}
273
274int security_sb_alloc(struct super_block *sb)
275{
276 return call_int_hook(sb_alloc_security, 0, sb);
277}
278
279void security_sb_free(struct super_block *sb)
280{
281 call_void_hook(sb_free_security, sb);
282}
283
284int security_sb_copy_data(char *orig, char *copy)
285{
286 return call_int_hook(sb_copy_data, 0, orig, copy);
287}
288EXPORT_SYMBOL(security_sb_copy_data);
289
290int security_sb_remount(struct super_block *sb, void *data)
291{
292 return call_int_hook(sb_remount, 0, sb, data);
293}
294
295int security_sb_kern_mount(struct super_block *sb, int flags, void *data)
296{
297 return call_int_hook(sb_kern_mount, 0, sb, flags, data);
298}
299
300int security_sb_show_options(struct seq_file *m, struct super_block *sb)
301{
302 return call_int_hook(sb_show_options, 0, m, sb);
303}
304
305int security_sb_statfs(struct dentry *dentry)
306{
307 return call_int_hook(sb_statfs, 0, dentry);
308}
309
310int security_sb_mount(const char *dev_name, struct path *path,
311 const char *type, unsigned long flags, void *data)
312{
313 return call_int_hook(sb_mount, 0, dev_name, path, type, flags, data);
314}
315
316int security_sb_umount(struct vfsmount *mnt, int flags)
317{
318 return call_int_hook(sb_umount, 0, mnt, flags);
319}
320
321int security_sb_pivotroot(struct path *old_path, struct path *new_path)
322{
323 return call_int_hook(sb_pivotroot, 0, old_path, new_path);
324}
325
326int security_sb_set_mnt_opts(struct super_block *sb,
327 struct security_mnt_opts *opts,
328 unsigned long kern_flags,
329 unsigned long *set_kern_flags)
330{
331 return call_int_hook(sb_set_mnt_opts,
332 opts->num_mnt_opts ? -EOPNOTSUPP : 0, sb,
333 opts, kern_flags, set_kern_flags);
334}
335EXPORT_SYMBOL(security_sb_set_mnt_opts);
336
337int security_sb_clone_mnt_opts(const struct super_block *oldsb,
338 struct super_block *newsb)
339{
340 return call_int_hook(sb_clone_mnt_opts, 0, oldsb, newsb);
341}
342EXPORT_SYMBOL(security_sb_clone_mnt_opts);
343
344int security_sb_parse_opts_str(char *options, struct security_mnt_opts *opts)
345{
346 return call_int_hook(sb_parse_opts_str, 0, options, opts);
347}
348EXPORT_SYMBOL(security_sb_parse_opts_str);
349
350int security_inode_alloc(struct inode *inode)
351{
352 inode->i_security = NULL;
353 return call_int_hook(inode_alloc_security, 0, inode);
354}
355
356void security_inode_free(struct inode *inode)
357{
358 integrity_inode_free(inode);
359 call_void_hook(inode_free_security, inode);
360}
361
362int security_dentry_init_security(struct dentry *dentry, int mode,
363 struct qstr *name, void **ctx,
364 u32 *ctxlen)
365{
366 return call_int_hook(dentry_init_security, -EOPNOTSUPP, dentry, mode,
367 name, ctx, ctxlen);
368}
369EXPORT_SYMBOL(security_dentry_init_security);
370
371int security_inode_init_security(struct inode *inode, struct inode *dir,
372 const struct qstr *qstr,
373 const initxattrs initxattrs, void *fs_data)
374{
375 struct xattr new_xattrs[MAX_LSM_EVM_XATTR + 1];
376 struct xattr *lsm_xattr, *evm_xattr, *xattr;
377 int ret;
378
379 if (unlikely(IS_PRIVATE(inode)))
380 return 0;
381
382 if (!initxattrs)
383 return call_int_hook(inode_init_security, 0, inode, dir, qstr,
384 NULL, NULL, NULL);
385 memset(new_xattrs, 0, sizeof(new_xattrs));
386 lsm_xattr = new_xattrs;
387 ret = call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, qstr,
388 &lsm_xattr->name,
389 &lsm_xattr->value,
390 &lsm_xattr->value_len);
391 if (ret)
392 goto out;
393
394 evm_xattr = lsm_xattr + 1;
395 ret = evm_inode_init_security(inode, lsm_xattr, evm_xattr);
396 if (ret)
397 goto out;
398 ret = initxattrs(inode, new_xattrs, fs_data);
399out:
400 for (xattr = new_xattrs; xattr->value != NULL; xattr++)
401 kfree(xattr->value);
402 return (ret == -EOPNOTSUPP) ? 0 : ret;
403}
404EXPORT_SYMBOL(security_inode_init_security);
405
406int security_old_inode_init_security(struct inode *inode, struct inode *dir,
407 const struct qstr *qstr, const char **name,
408 void **value, size_t *len)
409{
410 if (unlikely(IS_PRIVATE(inode)))
411 return -EOPNOTSUPP;
412 return call_int_hook(inode_init_security, 0, inode, dir, qstr,
413 name, value, len);
414}
415EXPORT_SYMBOL(security_old_inode_init_security);
416
417#ifdef CONFIG_SECURITY_PATH
418int security_path_mknod(struct path *dir, struct dentry *dentry, umode_t mode,
419 unsigned int dev)
420{
421 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
422 return 0;
423 return call_int_hook(path_mknod, 0, dir, dentry, mode, dev);
424}
425EXPORT_SYMBOL(security_path_mknod);
426
427int security_path_mkdir(struct path *dir, struct dentry *dentry, umode_t mode)
428{
429 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
430 return 0;
431 return call_int_hook(path_mkdir, 0, dir, dentry, mode);
432}
433EXPORT_SYMBOL(security_path_mkdir);
434
435int security_path_rmdir(struct path *dir, struct dentry *dentry)
436{
437 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
438 return 0;
439 return call_int_hook(path_rmdir, 0, dir, dentry);
440}
441
442int security_path_unlink(struct path *dir, struct dentry *dentry)
443{
444 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
445 return 0;
446 return call_int_hook(path_unlink, 0, dir, dentry);
447}
448EXPORT_SYMBOL(security_path_unlink);
449
450int security_path_symlink(struct path *dir, struct dentry *dentry,
451 const char *old_name)
452{
453 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
454 return 0;
455 return call_int_hook(path_symlink, 0, dir, dentry, old_name);
456}
457
458int security_path_link(struct dentry *old_dentry, struct path *new_dir,
459 struct dentry *new_dentry)
460{
461 if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
462 return 0;
463 return call_int_hook(path_link, 0, old_dentry, new_dir, new_dentry);
464}
465
466int security_path_rename(struct path *old_dir, struct dentry *old_dentry,
467 struct path *new_dir, struct dentry *new_dentry,
468 unsigned int flags)
469{
470 if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)) ||
471 (d_is_positive(new_dentry) && IS_PRIVATE(d_backing_inode(new_dentry)))))
472 return 0;
473
474 if (flags & RENAME_EXCHANGE) {
475 int err = call_int_hook(path_rename, 0, new_dir, new_dentry,
476 old_dir, old_dentry);
477 if (err)
478 return err;
479 }
480
481 return call_int_hook(path_rename, 0, old_dir, old_dentry, new_dir,
482 new_dentry);
483}
484EXPORT_SYMBOL(security_path_rename);
485
486int security_path_truncate(struct path *path)
487{
488 if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
489 return 0;
490 return call_int_hook(path_truncate, 0, path);
491}
492
493int security_path_chmod(struct path *path, umode_t mode)
494{
495 if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
496 return 0;
497 return call_int_hook(path_chmod, 0, path, mode);
498}
499
500int security_path_chown(struct path *path, kuid_t uid, kgid_t gid)
501{
502 if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
503 return 0;
504 return call_int_hook(path_chown, 0, path, uid, gid);
505}
506
507int security_path_chroot(struct path *path)
508{
509 return call_int_hook(path_chroot, 0, path);
510}
511#endif
512
513int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
514{
515 if (unlikely(IS_PRIVATE(dir)))
516 return 0;
517 return call_int_hook(inode_create, 0, dir, dentry, mode);
518}
519EXPORT_SYMBOL_GPL(security_inode_create);
520
521int security_inode_link(struct dentry *old_dentry, struct inode *dir,
522 struct dentry *new_dentry)
523{
524 if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
525 return 0;
526 return call_int_hook(inode_link, 0, old_dentry, dir, new_dentry);
527}
528
529int security_inode_unlink(struct inode *dir, struct dentry *dentry)
530{
531 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
532 return 0;
533 return call_int_hook(inode_unlink, 0, dir, dentry);
534}
535
536int security_inode_symlink(struct inode *dir, struct dentry *dentry,
537 const char *old_name)
538{
539 if (unlikely(IS_PRIVATE(dir)))
540 return 0;
541 return call_int_hook(inode_symlink, 0, dir, dentry, old_name);
542}
543
544int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
545{
546 if (unlikely(IS_PRIVATE(dir)))
547 return 0;
548 return call_int_hook(inode_mkdir, 0, dir, dentry, mode);
549}
550EXPORT_SYMBOL_GPL(security_inode_mkdir);
551
552int security_inode_rmdir(struct inode *dir, struct dentry *dentry)
553{
554 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
555 return 0;
556 return call_int_hook(inode_rmdir, 0, dir, dentry);
557}
558
559int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
560{
561 if (unlikely(IS_PRIVATE(dir)))
562 return 0;
563 return call_int_hook(inode_mknod, 0, dir, dentry, mode, dev);
564}
565
566int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
567 struct inode *new_dir, struct dentry *new_dentry,
568 unsigned int flags)
569{
570 if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)) ||
571 (d_is_positive(new_dentry) && IS_PRIVATE(d_backing_inode(new_dentry)))))
572 return 0;
573
574 if (flags & RENAME_EXCHANGE) {
575 int err = call_int_hook(inode_rename, 0, new_dir, new_dentry,
576 old_dir, old_dentry);
577 if (err)
578 return err;
579 }
580
581 return call_int_hook(inode_rename, 0, old_dir, old_dentry,
582 new_dir, new_dentry);
583}
584
585int security_inode_readlink(struct dentry *dentry)
586{
587 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
588 return 0;
589 return call_int_hook(inode_readlink, 0, dentry);
590}
591
592int security_inode_follow_link(struct dentry *dentry, struct nameidata *nd)
593{
594 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
595 return 0;
596 return call_int_hook(inode_follow_link, 0, dentry, nd);
597}
598
599int security_inode_permission(struct inode *inode, int mask)
600{
601 if (unlikely(IS_PRIVATE(inode)))
602 return 0;
603 return call_int_hook(inode_permission, 0, inode, mask);
604}
605
606int security_inode_setattr(struct dentry *dentry, struct iattr *attr)
607{
608 int ret;
609
610 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
611 return 0;
612 ret = call_int_hook(inode_setattr, 0, dentry, attr);
613 if (ret)
614 return ret;
615 return evm_inode_setattr(dentry, attr);
616}
617EXPORT_SYMBOL_GPL(security_inode_setattr);
618
619int security_inode_getattr(const struct path *path)
620{
621 if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
622 return 0;
623 return call_int_hook(inode_getattr, 0, path);
624}
625
626int security_inode_setxattr(struct dentry *dentry, const char *name,
627 const void *value, size_t size, int flags)
628{
629 int ret;
630
631 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
632 return 0;
633 /*
634 * SELinux and Smack integrate the cap call,
635 * so assume that all LSMs supplying this call do so.
636 */
637 ret = call_int_hook(inode_setxattr, 1, dentry, name, value, size,
638 flags);
639
640 if (ret == 1)
641 ret = cap_inode_setxattr(dentry, name, value, size, flags);
642 if (ret)
643 return ret;
644 ret = ima_inode_setxattr(dentry, name, value, size);
645 if (ret)
646 return ret;
647 return evm_inode_setxattr(dentry, name, value, size);
648}
649
650void security_inode_post_setxattr(struct dentry *dentry, const char *name,
651 const void *value, size_t size, int flags)
652{
653 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
654 return;
655 call_void_hook(inode_post_setxattr, dentry, name, value, size, flags);
656 evm_inode_post_setxattr(dentry, name, value, size);
657}
658
659int security_inode_getxattr(struct dentry *dentry, const char *name)
660{
661 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
662 return 0;
663 return call_int_hook(inode_getxattr, 0, dentry, name);
664}
665
666int security_inode_listxattr(struct dentry *dentry)
667{
668 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
669 return 0;
670 return call_int_hook(inode_listxattr, 0, dentry);
671}
672
673int security_inode_removexattr(struct dentry *dentry, const char *name)
674{
675 int ret;
676
677 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
678 return 0;
679 /*
680 * SELinux and Smack integrate the cap call,
681 * so assume that all LSMs supplying this call do so.
682 */
683 ret = call_int_hook(inode_removexattr, 1, dentry, name);
684 if (ret == 1)
685 ret = cap_inode_removexattr(dentry, name);
686 if (ret)
687 return ret;
688 ret = ima_inode_removexattr(dentry, name);
689 if (ret)
690 return ret;
691 return evm_inode_removexattr(dentry, name);
692}
693
694int security_inode_need_killpriv(struct dentry *dentry)
695{
696 return call_int_hook(inode_need_killpriv, 0, dentry);
697}
698
699int security_inode_killpriv(struct dentry *dentry)
700{
701 return call_int_hook(inode_killpriv, 0, dentry);
702}
703
704int security_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
705{
706 if (unlikely(IS_PRIVATE(inode)))
707 return -EOPNOTSUPP;
708 return call_int_hook(inode_getsecurity, -EOPNOTSUPP, inode, name,
709 buffer, alloc);
710}
711
712int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
713{
714 if (unlikely(IS_PRIVATE(inode)))
715 return -EOPNOTSUPP;
716 return call_int_hook(inode_setsecurity, -EOPNOTSUPP, inode, name,
717 value, size, flags);
718}
719
720int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
721{
722 if (unlikely(IS_PRIVATE(inode)))
723 return 0;
724 return call_int_hook(inode_listsecurity, 0, inode, buffer, buffer_size);
725}
726EXPORT_SYMBOL(security_inode_listsecurity);
727
728void security_inode_getsecid(const struct inode *inode, u32 *secid)
729{
730 call_void_hook(inode_getsecid, inode, secid);
731}
732
733int security_file_permission(struct file *file, int mask)
734{
735 int ret;
736
737 ret = call_int_hook(file_permission, 0, file, mask);
738 if (ret)
739 return ret;
740
741 return fsnotify_perm(file, mask);
742}
743
744int security_file_alloc(struct file *file)
745{
746 return call_int_hook(file_alloc_security, 0, file);
747}
748
749void security_file_free(struct file *file)
750{
751 call_void_hook(file_free_security, file);
752}
753
754int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
755{
756 return call_int_hook(file_ioctl, 0, file, cmd, arg);
757}
758
759static inline unsigned long mmap_prot(struct file *file, unsigned long prot)
760{
761 /*
762 * Does we have PROT_READ and does the application expect
763 * it to imply PROT_EXEC? If not, nothing to talk about...
764 */
765 if ((prot & (PROT_READ | PROT_EXEC)) != PROT_READ)
766 return prot;
767 if (!(current->personality & READ_IMPLIES_EXEC))
768 return prot;
769 /*
770 * if that's an anonymous mapping, let it.
771 */
772 if (!file)
773 return prot | PROT_EXEC;
774 /*
775 * ditto if it's not on noexec mount, except that on !MMU we need
776 * NOMMU_MAP_EXEC (== VM_MAYEXEC) in this case
777 */
778 if (!(file->f_path.mnt->mnt_flags & MNT_NOEXEC)) {
779#ifndef CONFIG_MMU
780 if (file->f_op->mmap_capabilities) {
781 unsigned caps = file->f_op->mmap_capabilities(file);
782 if (!(caps & NOMMU_MAP_EXEC))
783 return prot;
784 }
785#endif
786 return prot | PROT_EXEC;
787 }
788 /* anything on noexec mount won't get PROT_EXEC */
789 return prot;
790}
791
792int security_mmap_file(struct file *file, unsigned long prot,
793 unsigned long flags)
794{
795 int ret;
796 ret = call_int_hook(mmap_file, 0, file, prot,
797 mmap_prot(file, prot), flags);
798 if (ret)
799 return ret;
800 return ima_file_mmap(file, prot);
801}
802
803int security_mmap_addr(unsigned long addr)
804{
805 return call_int_hook(mmap_addr, 0, addr);
806}
807
808int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
809 unsigned long prot)
810{
811 return call_int_hook(file_mprotect, 0, vma, reqprot, prot);
812}
813
814int security_file_lock(struct file *file, unsigned int cmd)
815{
816 return call_int_hook(file_lock, 0, file, cmd);
817}
818
819int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
820{
821 return call_int_hook(file_fcntl, 0, file, cmd, arg);
822}
823
824void security_file_set_fowner(struct file *file)
825{
826 call_void_hook(file_set_fowner, file);
827}
828
829int security_file_send_sigiotask(struct task_struct *tsk,
830 struct fown_struct *fown, int sig)
831{
832 return call_int_hook(file_send_sigiotask, 0, tsk, fown, sig);
833}
834
835int security_file_receive(struct file *file)
836{
837 return call_int_hook(file_receive, 0, file);
838}
839
840int security_file_open(struct file *file, const struct cred *cred)
841{
842 int ret;
843
844 ret = call_int_hook(file_open, 0, file, cred);
845 if (ret)
846 return ret;
847
848 return fsnotify_perm(file, MAY_OPEN);
849}
850
851int security_task_create(unsigned long clone_flags)
852{
853 return call_int_hook(task_create, 0, clone_flags);
854}
855
856void security_task_free(struct task_struct *task)
857{
858 call_void_hook(task_free, task);
859}
860
861int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
862{
863 return call_int_hook(cred_alloc_blank, 0, cred, gfp);
864}
865
866void security_cred_free(struct cred *cred)
867{
868 call_void_hook(cred_free, cred);
869}
870
871int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp)
872{
873 return call_int_hook(cred_prepare, 0, new, old, gfp);
874}
875
876void security_transfer_creds(struct cred *new, const struct cred *old)
877{
878 call_void_hook(cred_transfer, new, old);
879}
880
881int security_kernel_act_as(struct cred *new, u32 secid)
882{
883 return call_int_hook(kernel_act_as, 0, new, secid);
884}
885
886int security_kernel_create_files_as(struct cred *new, struct inode *inode)
887{
888 return call_int_hook(kernel_create_files_as, 0, new, inode);
889}
890
891int security_kernel_fw_from_file(struct file *file, char *buf, size_t size)
892{
893 int ret;
894
895 ret = call_int_hook(kernel_fw_from_file, 0, file, buf, size);
896 if (ret)
897 return ret;
898 return ima_fw_from_file(file, buf, size);
899}
900EXPORT_SYMBOL_GPL(security_kernel_fw_from_file);
901
902int security_kernel_module_request(char *kmod_name)
903{
904 return call_int_hook(kernel_module_request, 0, kmod_name);
905}
906
907int security_kernel_module_from_file(struct file *file)
908{
909 int ret;
910
911 ret = call_int_hook(kernel_module_from_file, 0, file);
912 if (ret)
913 return ret;
914 return ima_module_check(file);
915}
916
917int security_task_fix_setuid(struct cred *new, const struct cred *old,
918 int flags)
919{
920 return call_int_hook(task_fix_setuid, 0, new, old, flags);
921}
922
923int security_task_setpgid(struct task_struct *p, pid_t pgid)
924{
925 return call_int_hook(task_setpgid, 0, p, pgid);
926}
927
928int security_task_getpgid(struct task_struct *p)
929{
930 return call_int_hook(task_getpgid, 0, p);
931}
932
933int security_task_getsid(struct task_struct *p)
934{
935 return call_int_hook(task_getsid, 0, p);
936}
937
938void security_task_getsecid(struct task_struct *p, u32 *secid)
939{
940 *secid = 0;
941 call_void_hook(task_getsecid, p, secid);
942}
943EXPORT_SYMBOL(security_task_getsecid);
944
945int security_task_setnice(struct task_struct *p, int nice)
946{
947 return call_int_hook(task_setnice, 0, p, nice);
948}
949
950int security_task_setioprio(struct task_struct *p, int ioprio)
951{
952 return call_int_hook(task_setioprio, 0, p, ioprio);
953}
954
955int security_task_getioprio(struct task_struct *p)
956{
957 return call_int_hook(task_getioprio, 0, p);
958}
959
960int security_task_setrlimit(struct task_struct *p, unsigned int resource,
961 struct rlimit *new_rlim)
962{
963 return call_int_hook(task_setrlimit, 0, p, resource, new_rlim);
964}
965
966int security_task_setscheduler(struct task_struct *p)
967{
968 return call_int_hook(task_setscheduler, 0, p);
969}
970
971int security_task_getscheduler(struct task_struct *p)
972{
973 return call_int_hook(task_getscheduler, 0, p);
974}
975
976int security_task_movememory(struct task_struct *p)
977{
978 return call_int_hook(task_movememory, 0, p);
979}
980
981int security_task_kill(struct task_struct *p, struct siginfo *info,
982 int sig, u32 secid)
983{
984 return call_int_hook(task_kill, 0, p, info, sig, secid);
985}
986
987int security_task_wait(struct task_struct *p)
988{
989 return call_int_hook(task_wait, 0, p);
990}
991
992int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
993 unsigned long arg4, unsigned long arg5)
994{
995 int thisrc;
996 int rc = -ENOSYS;
997 struct security_hook_list *hp;
998
999 list_for_each_entry(hp, &security_hook_heads.task_prctl, list) {
1000 thisrc = hp->hook.task_prctl(option, arg2, arg3, arg4, arg5);
1001 if (thisrc != -ENOSYS) {
1002 rc = thisrc;
1003 if (thisrc != 0)
1004 break;
1005 }
1006 }
1007 return rc;
1008}
1009
1010void security_task_to_inode(struct task_struct *p, struct inode *inode)
1011{
1012 call_void_hook(task_to_inode, p, inode);
1013}
1014
1015int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
1016{
1017 return call_int_hook(ipc_permission, 0, ipcp, flag);
1018}
1019
1020void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
1021{
1022 *secid = 0;
1023 call_void_hook(ipc_getsecid, ipcp, secid);
1024}
1025
1026int security_msg_msg_alloc(struct msg_msg *msg)
1027{
1028 return call_int_hook(msg_msg_alloc_security, 0, msg);
1029}
1030
1031void security_msg_msg_free(struct msg_msg *msg)
1032{
1033 call_void_hook(msg_msg_free_security, msg);
1034}
1035
1036int security_msg_queue_alloc(struct msg_queue *msq)
1037{
1038 return call_int_hook(msg_queue_alloc_security, 0, msq);
1039}
1040
1041void security_msg_queue_free(struct msg_queue *msq)
1042{
1043 call_void_hook(msg_queue_free_security, msq);
1044}
1045
1046int security_msg_queue_associate(struct msg_queue *msq, int msqflg)
1047{
1048 return call_int_hook(msg_queue_associate, 0, msq, msqflg);
1049}
1050
1051int security_msg_queue_msgctl(struct msg_queue *msq, int cmd)
1052{
1053 return call_int_hook(msg_queue_msgctl, 0, msq, cmd);
1054}
1055
1056int security_msg_queue_msgsnd(struct msg_queue *msq,
1057 struct msg_msg *msg, int msqflg)
1058{
1059 return call_int_hook(msg_queue_msgsnd, 0, msq, msg, msqflg);
1060}
1061
1062int security_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
1063 struct task_struct *target, long type, int mode)
1064{
1065 return call_int_hook(msg_queue_msgrcv, 0, msq, msg, target, type, mode);
1066}
1067
1068int security_shm_alloc(struct shmid_kernel *shp)
1069{
1070 return call_int_hook(shm_alloc_security, 0, shp);
1071}
1072
1073void security_shm_free(struct shmid_kernel *shp)
1074{
1075 call_void_hook(shm_free_security, shp);
1076}
1077
1078int security_shm_associate(struct shmid_kernel *shp, int shmflg)
1079{
1080 return call_int_hook(shm_associate, 0, shp, shmflg);
1081}
1082
1083int security_shm_shmctl(struct shmid_kernel *shp, int cmd)
1084{
1085 return call_int_hook(shm_shmctl, 0, shp, cmd);
1086}
1087
1088int security_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, int shmflg)
1089{
1090 return call_int_hook(shm_shmat, 0, shp, shmaddr, shmflg);
1091}
1092
1093int security_sem_alloc(struct sem_array *sma)
1094{
1095 return call_int_hook(sem_alloc_security, 0, sma);
1096}
1097
1098void security_sem_free(struct sem_array *sma)
1099{
1100 call_void_hook(sem_free_security, sma);
1101}
1102
1103int security_sem_associate(struct sem_array *sma, int semflg)
1104{
1105 return call_int_hook(sem_associate, 0, sma, semflg);
1106}
1107
1108int security_sem_semctl(struct sem_array *sma, int cmd)
1109{
1110 return call_int_hook(sem_semctl, 0, sma, cmd);
1111}
1112
1113int security_sem_semop(struct sem_array *sma, struct sembuf *sops,
1114 unsigned nsops, int alter)
1115{
1116 return call_int_hook(sem_semop, 0, sma, sops, nsops, alter);
1117}
1118
1119void security_d_instantiate(struct dentry *dentry, struct inode *inode)
1120{
1121 if (unlikely(inode && IS_PRIVATE(inode)))
1122 return;
1123 call_void_hook(d_instantiate, dentry, inode);
1124}
1125EXPORT_SYMBOL(security_d_instantiate);
1126
1127int security_getprocattr(struct task_struct *p, char *name, char **value)
1128{
1129 return call_int_hook(getprocattr, -EINVAL, p, name, value);
1130}
1131
1132int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size)
1133{
1134 return call_int_hook(setprocattr, -EINVAL, p, name, value, size);
1135}
1136
1137int security_netlink_send(struct sock *sk, struct sk_buff *skb)
1138{
1139 return call_int_hook(netlink_send, 0, sk, skb);
1140}
1141
1142int security_ismaclabel(const char *name)
1143{
1144 return call_int_hook(ismaclabel, 0, name);
1145}
1146EXPORT_SYMBOL(security_ismaclabel);
1147
1148int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
1149{
1150 return call_int_hook(secid_to_secctx, -EOPNOTSUPP, secid, secdata,
1151 seclen);
1152}
1153EXPORT_SYMBOL(security_secid_to_secctx);
1154
1155int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
1156{
1157 *secid = 0;
1158 return call_int_hook(secctx_to_secid, 0, secdata, seclen, secid);
1159}
1160EXPORT_SYMBOL(security_secctx_to_secid);
1161
1162void security_release_secctx(char *secdata, u32 seclen)
1163{
1164 call_void_hook(release_secctx, secdata, seclen);
1165}
1166EXPORT_SYMBOL(security_release_secctx);
1167
1168int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
1169{
1170 return call_int_hook(inode_notifysecctx, 0, inode, ctx, ctxlen);
1171}
1172EXPORT_SYMBOL(security_inode_notifysecctx);
1173
1174int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
1175{
1176 return call_int_hook(inode_setsecctx, 0, dentry, ctx, ctxlen);
1177}
1178EXPORT_SYMBOL(security_inode_setsecctx);
1179
1180int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
1181{
1182 return call_int_hook(inode_getsecctx, -EOPNOTSUPP, inode, ctx, ctxlen);
1183}
1184EXPORT_SYMBOL(security_inode_getsecctx);
1185
1186#ifdef CONFIG_SECURITY_NETWORK
1187
1188int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk)
1189{
1190 return call_int_hook(unix_stream_connect, 0, sock, other, newsk);
1191}
1192EXPORT_SYMBOL(security_unix_stream_connect);
1193
1194int security_unix_may_send(struct socket *sock, struct socket *other)
1195{
1196 return call_int_hook(unix_may_send, 0, sock, other);
1197}
1198EXPORT_SYMBOL(security_unix_may_send);
1199
1200int security_socket_create(int family, int type, int protocol, int kern)
1201{
1202 return call_int_hook(socket_create, 0, family, type, protocol, kern);
1203}
1204
1205int security_socket_post_create(struct socket *sock, int family,
1206 int type, int protocol, int kern)
1207{
1208 return call_int_hook(socket_post_create, 0, sock, family, type,
1209 protocol, kern);
1210}
1211
1212int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
1213{
1214 return call_int_hook(socket_bind, 0, sock, address, addrlen);
1215}
1216
1217int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
1218{
1219 return call_int_hook(socket_connect, 0, sock, address, addrlen);
1220}
1221
1222int security_socket_listen(struct socket *sock, int backlog)
1223{
1224 return call_int_hook(socket_listen, 0, sock, backlog);
1225}
1226
1227int security_socket_accept(struct socket *sock, struct socket *newsock)
1228{
1229 return call_int_hook(socket_accept, 0, sock, newsock);
1230}
1231
1232int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size)
1233{
1234 return call_int_hook(socket_sendmsg, 0, sock, msg, size);
1235}
1236
1237int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,
1238 int size, int flags)
1239{
1240 return call_int_hook(socket_recvmsg, 0, sock, msg, size, flags);
1241}
1242
1243int security_socket_getsockname(struct socket *sock)
1244{
1245 return call_int_hook(socket_getsockname, 0, sock);
1246}
1247
1248int security_socket_getpeername(struct socket *sock)
1249{
1250 return call_int_hook(socket_getpeername, 0, sock);
1251}
1252
1253int security_socket_getsockopt(struct socket *sock, int level, int optname)
1254{
1255 return call_int_hook(socket_getsockopt, 0, sock, level, optname);
1256}
1257
1258int security_socket_setsockopt(struct socket *sock, int level, int optname)
1259{
1260 return call_int_hook(socket_setsockopt, 0, sock, level, optname);
1261}
1262
1263int security_socket_shutdown(struct socket *sock, int how)
1264{
1265 return call_int_hook(socket_shutdown, 0, sock, how);
1266}
1267
1268int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
1269{
1270 return call_int_hook(socket_sock_rcv_skb, 0, sk, skb);
1271}
1272EXPORT_SYMBOL(security_sock_rcv_skb);
1273
1274int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
1275 int __user *optlen, unsigned len)
1276{
1277 return call_int_hook(socket_getpeersec_stream, -ENOPROTOOPT, sock,
1278 optval, optlen, len);
1279}
1280
1281int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
1282{
1283 return call_int_hook(socket_getpeersec_dgram, 0, sock, skb, secid);
1284}
1285EXPORT_SYMBOL(security_socket_getpeersec_dgram);
1286
1287int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
1288{
1289 return call_int_hook(sk_alloc_security, 0, sk, family, priority);
1290}
1291
1292void security_sk_free(struct sock *sk)
1293{
1294 call_void_hook(sk_free_security, sk);
1295}
1296
1297void security_sk_clone(const struct sock *sk, struct sock *newsk)
1298{
1299 call_void_hook(sk_clone_security, sk, newsk);
1300}
1301EXPORT_SYMBOL(security_sk_clone);
1302
1303void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
1304{
1305 call_void_hook(sk_getsecid, sk, &fl->flowi_secid);
1306}
1307EXPORT_SYMBOL(security_sk_classify_flow);
1308
1309void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
1310{
1311 call_void_hook(req_classify_flow, req, fl);
1312}
1313EXPORT_SYMBOL(security_req_classify_flow);
1314
1315void security_sock_graft(struct sock *sk, struct socket *parent)
1316{
1317 call_void_hook(sock_graft, sk, parent);
1318}
1319EXPORT_SYMBOL(security_sock_graft);
1320
1321int security_inet_conn_request(struct sock *sk,
1322 struct sk_buff *skb, struct request_sock *req)
1323{
1324 return call_int_hook(inet_conn_request, 0, sk, skb, req);
1325}
1326EXPORT_SYMBOL(security_inet_conn_request);
1327
1328void security_inet_csk_clone(struct sock *newsk,
1329 const struct request_sock *req)
1330{
1331 call_void_hook(inet_csk_clone, newsk, req);
1332}
1333
1334void security_inet_conn_established(struct sock *sk,
1335 struct sk_buff *skb)
1336{
1337 call_void_hook(inet_conn_established, sk, skb);
1338}
1339
1340int security_secmark_relabel_packet(u32 secid)
1341{
1342 return call_int_hook(secmark_relabel_packet, 0, secid);
1343}
1344EXPORT_SYMBOL(security_secmark_relabel_packet);
1345
1346void security_secmark_refcount_inc(void)
1347{
1348 call_void_hook(secmark_refcount_inc);
1349}
1350EXPORT_SYMBOL(security_secmark_refcount_inc);
1351
1352void security_secmark_refcount_dec(void)
1353{
1354 call_void_hook(secmark_refcount_dec);
1355}
1356EXPORT_SYMBOL(security_secmark_refcount_dec);
1357
1358int security_tun_dev_alloc_security(void **security)
1359{
1360 return call_int_hook(tun_dev_alloc_security, 0, security);
1361}
1362EXPORT_SYMBOL(security_tun_dev_alloc_security);
1363
1364void security_tun_dev_free_security(void *security)
1365{
1366 call_void_hook(tun_dev_free_security, security);
1367}
1368EXPORT_SYMBOL(security_tun_dev_free_security);
1369
1370int security_tun_dev_create(void)
1371{
1372 return call_int_hook(tun_dev_create, 0);
1373}
1374EXPORT_SYMBOL(security_tun_dev_create);
1375
1376int security_tun_dev_attach_queue(void *security)
1377{
1378 return call_int_hook(tun_dev_attach_queue, 0, security);
1379}
1380EXPORT_SYMBOL(security_tun_dev_attach_queue);
1381
1382int security_tun_dev_attach(struct sock *sk, void *security)
1383{
1384 return call_int_hook(tun_dev_attach, 0, sk, security);
1385}
1386EXPORT_SYMBOL(security_tun_dev_attach);
1387
1388int security_tun_dev_open(void *security)
1389{
1390 return call_int_hook(tun_dev_open, 0, security);
1391}
1392EXPORT_SYMBOL(security_tun_dev_open);
1393
1394#endif /* CONFIG_SECURITY_NETWORK */
1395
1396#ifdef CONFIG_SECURITY_NETWORK_XFRM
1397
1398int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
1399 struct xfrm_user_sec_ctx *sec_ctx,
1400 gfp_t gfp)
1401{
1402 return call_int_hook(xfrm_policy_alloc_security, 0, ctxp, sec_ctx, gfp);
1403}
1404EXPORT_SYMBOL(security_xfrm_policy_alloc);
1405
1406int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
1407 struct xfrm_sec_ctx **new_ctxp)
1408{
1409 return call_int_hook(xfrm_policy_clone_security, 0, old_ctx, new_ctxp);
1410}
1411
1412void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
1413{
1414 call_void_hook(xfrm_policy_free_security, ctx);
1415}
1416EXPORT_SYMBOL(security_xfrm_policy_free);
1417
1418int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
1419{
1420 return call_int_hook(xfrm_policy_delete_security, 0, ctx);
1421}
1422
1423int security_xfrm_state_alloc(struct xfrm_state *x,
1424 struct xfrm_user_sec_ctx *sec_ctx)
1425{
1426 return call_int_hook(xfrm_state_alloc, 0, x, sec_ctx);
1427}
1428EXPORT_SYMBOL(security_xfrm_state_alloc);
1429
1430int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
1431 struct xfrm_sec_ctx *polsec, u32 secid)
1432{
1433 return call_int_hook(xfrm_state_alloc_acquire, 0, x, polsec, secid);
1434}
1435
1436int security_xfrm_state_delete(struct xfrm_state *x)
1437{
1438 return call_int_hook(xfrm_state_delete_security, 0, x);
1439}
1440EXPORT_SYMBOL(security_xfrm_state_delete);
1441
1442void security_xfrm_state_free(struct xfrm_state *x)
1443{
1444 call_void_hook(xfrm_state_free_security, x);
1445}
1446
1447int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
1448{
1449 return call_int_hook(xfrm_policy_lookup, 0, ctx, fl_secid, dir);
1450}
1451
1452int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
1453 struct xfrm_policy *xp,
1454 const struct flowi *fl)
1455{
1456 struct security_hook_list *hp;
1457 int rc = 1;
1458
1459 /*
1460 * Since this function is expected to return 0 or 1, the judgment
1461 * becomes difficult if multiple LSMs supply this call. Fortunately,
1462 * we can use the first LSM's judgment because currently only SELinux
1463 * supplies this call.
1464 *
1465 * For speed optimization, we explicitly break the loop rather than
1466 * using the macro
1467 */
1468 list_for_each_entry(hp, &security_hook_heads.xfrm_state_pol_flow_match,
1469 list) {
1470 rc = hp->hook.xfrm_state_pol_flow_match(x, xp, fl);
1471 break;
1472 }
1473 return rc;
1474}
1475
1476int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
1477{
1478 return call_int_hook(xfrm_decode_session, 0, skb, secid, 1);
1479}
1480
1481void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)
1482{
1483 int rc = call_int_hook(xfrm_decode_session, 0, skb, &fl->flowi_secid,
1484 0);
1485
1486 BUG_ON(rc);
1487}
1488EXPORT_SYMBOL(security_skb_classify_flow);
1489
1490#endif /* CONFIG_SECURITY_NETWORK_XFRM */
1491
1492#ifdef CONFIG_KEYS
1493
1494int security_key_alloc(struct key *key, const struct cred *cred,
1495 unsigned long flags)
1496{
1497 return call_int_hook(key_alloc, 0, key, cred, flags);
1498}
1499
1500void security_key_free(struct key *key)
1501{
1502 call_void_hook(key_free, key);
1503}
1504
1505int security_key_permission(key_ref_t key_ref,
1506 const struct cred *cred, unsigned perm)
1507{
1508 return call_int_hook(key_permission, 0, key_ref, cred, perm);
1509}
1510
1511int security_key_getsecurity(struct key *key, char **_buffer)
1512{
1513 *_buffer = NULL;
1514 return call_int_hook(key_getsecurity, 0, key, _buffer);
1515}
1516
1517#endif /* CONFIG_KEYS */
1518
1519#ifdef CONFIG_AUDIT
1520
1521int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule)
1522{
1523 return call_int_hook(audit_rule_init, 0, field, op, rulestr, lsmrule);
1524}
1525
1526int security_audit_rule_known(struct audit_krule *krule)
1527{
1528 return call_int_hook(audit_rule_known, 0, krule);
1529}
1530
1531void security_audit_rule_free(void *lsmrule)
1532{
1533 call_void_hook(audit_rule_free, lsmrule);
1534}
1535
1536int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule,
1537 struct audit_context *actx)
1538{
1539 return call_int_hook(audit_rule_match, 0, secid, field, op, lsmrule,
1540 actx);
1541}
1542#endif /* CONFIG_AUDIT */
1543
1544struct security_hook_heads security_hook_heads = {
1545 .binder_set_context_mgr =
1546 LIST_HEAD_INIT(security_hook_heads.binder_set_context_mgr),
1547 .binder_transaction =
1548 LIST_HEAD_INIT(security_hook_heads.binder_transaction),
1549 .binder_transfer_binder =
1550 LIST_HEAD_INIT(security_hook_heads.binder_transfer_binder),
1551 .binder_transfer_file =
1552 LIST_HEAD_INIT(security_hook_heads.binder_transfer_file),
1553
1554 .ptrace_access_check =
1555 LIST_HEAD_INIT(security_hook_heads.ptrace_access_check),
1556 .ptrace_traceme =
1557 LIST_HEAD_INIT(security_hook_heads.ptrace_traceme),
1558 .capget = LIST_HEAD_INIT(security_hook_heads.capget),
1559 .capset = LIST_HEAD_INIT(security_hook_heads.capset),
1560 .capable = LIST_HEAD_INIT(security_hook_heads.capable),
1561 .quotactl = LIST_HEAD_INIT(security_hook_heads.quotactl),
1562 .quota_on = LIST_HEAD_INIT(security_hook_heads.quota_on),
1563 .syslog = LIST_HEAD_INIT(security_hook_heads.syslog),
1564 .settime = LIST_HEAD_INIT(security_hook_heads.settime),
1565 .vm_enough_memory =
1566 LIST_HEAD_INIT(security_hook_heads.vm_enough_memory),
1567 .bprm_set_creds =
1568 LIST_HEAD_INIT(security_hook_heads.bprm_set_creds),
1569 .bprm_check_security =
1570 LIST_HEAD_INIT(security_hook_heads.bprm_check_security),
1571 .bprm_secureexec =
1572 LIST_HEAD_INIT(security_hook_heads.bprm_secureexec),
1573 .bprm_committing_creds =
1574 LIST_HEAD_INIT(security_hook_heads.bprm_committing_creds),
1575 .bprm_committed_creds =
1576 LIST_HEAD_INIT(security_hook_heads.bprm_committed_creds),
1577 .sb_alloc_security =
1578 LIST_HEAD_INIT(security_hook_heads.sb_alloc_security),
1579 .sb_free_security =
1580 LIST_HEAD_INIT(security_hook_heads.sb_free_security),
1581 .sb_copy_data = LIST_HEAD_INIT(security_hook_heads.sb_copy_data),
1582 .sb_remount = LIST_HEAD_INIT(security_hook_heads.sb_remount),
1583 .sb_kern_mount =
1584 LIST_HEAD_INIT(security_hook_heads.sb_kern_mount),
1585 .sb_show_options =
1586 LIST_HEAD_INIT(security_hook_heads.sb_show_options),
1587 .sb_statfs = LIST_HEAD_INIT(security_hook_heads.sb_statfs),
1588 .sb_mount = LIST_HEAD_INIT(security_hook_heads.sb_mount),
1589 .sb_umount = LIST_HEAD_INIT(security_hook_heads.sb_umount),
1590 .sb_pivotroot = LIST_HEAD_INIT(security_hook_heads.sb_pivotroot),
1591 .sb_set_mnt_opts =
1592 LIST_HEAD_INIT(security_hook_heads.sb_set_mnt_opts),
1593 .sb_clone_mnt_opts =
1594 LIST_HEAD_INIT(security_hook_heads.sb_clone_mnt_opts),
1595 .sb_parse_opts_str =
1596 LIST_HEAD_INIT(security_hook_heads.sb_parse_opts_str),
1597 .dentry_init_security =
1598 LIST_HEAD_INIT(security_hook_heads.dentry_init_security),
1599#ifdef CONFIG_SECURITY_PATH
1600 .path_unlink = LIST_HEAD_INIT(security_hook_heads.path_unlink),
1601 .path_mkdir = LIST_HEAD_INIT(security_hook_heads.path_mkdir),
1602 .path_rmdir = LIST_HEAD_INIT(security_hook_heads.path_rmdir),
1603 .path_mknod = LIST_HEAD_INIT(security_hook_heads.path_mknod),
1604 .path_truncate =
1605 LIST_HEAD_INIT(security_hook_heads.path_truncate),
1606 .path_symlink = LIST_HEAD_INIT(security_hook_heads.path_symlink),
1607 .path_link = LIST_HEAD_INIT(security_hook_heads.path_link),
1608 .path_rename = LIST_HEAD_INIT(security_hook_heads.path_rename),
1609 .path_chmod = LIST_HEAD_INIT(security_hook_heads.path_chmod),
1610 .path_chown = LIST_HEAD_INIT(security_hook_heads.path_chown),
1611 .path_chroot = LIST_HEAD_INIT(security_hook_heads.path_chroot),
1612#endif
1613 .inode_alloc_security =
1614 LIST_HEAD_INIT(security_hook_heads.inode_alloc_security),
1615 .inode_free_security =
1616 LIST_HEAD_INIT(security_hook_heads.inode_free_security),
1617 .inode_init_security =
1618 LIST_HEAD_INIT(security_hook_heads.inode_init_security),
1619 .inode_create = LIST_HEAD_INIT(security_hook_heads.inode_create),
1620 .inode_link = LIST_HEAD_INIT(security_hook_heads.inode_link),
1621 .inode_unlink = LIST_HEAD_INIT(security_hook_heads.inode_unlink),
1622 .inode_symlink =
1623 LIST_HEAD_INIT(security_hook_heads.inode_symlink),
1624 .inode_mkdir = LIST_HEAD_INIT(security_hook_heads.inode_mkdir),
1625 .inode_rmdir = LIST_HEAD_INIT(security_hook_heads.inode_rmdir),
1626 .inode_mknod = LIST_HEAD_INIT(security_hook_heads.inode_mknod),
1627 .inode_rename = LIST_HEAD_INIT(security_hook_heads.inode_rename),
1628 .inode_readlink =
1629 LIST_HEAD_INIT(security_hook_heads.inode_readlink),
1630 .inode_follow_link =
1631 LIST_HEAD_INIT(security_hook_heads.inode_follow_link),
1632 .inode_permission =
1633 LIST_HEAD_INIT(security_hook_heads.inode_permission),
1634 .inode_setattr =
1635 LIST_HEAD_INIT(security_hook_heads.inode_setattr),
1636 .inode_getattr =
1637 LIST_HEAD_INIT(security_hook_heads.inode_getattr),
1638 .inode_setxattr =
1639 LIST_HEAD_INIT(security_hook_heads.inode_setxattr),
1640 .inode_post_setxattr =
1641 LIST_HEAD_INIT(security_hook_heads.inode_post_setxattr),
1642 .inode_getxattr =
1643 LIST_HEAD_INIT(security_hook_heads.inode_getxattr),
1644 .inode_listxattr =
1645 LIST_HEAD_INIT(security_hook_heads.inode_listxattr),
1646 .inode_removexattr =
1647 LIST_HEAD_INIT(security_hook_heads.inode_removexattr),
1648 .inode_need_killpriv =
1649 LIST_HEAD_INIT(security_hook_heads.inode_need_killpriv),
1650 .inode_killpriv =
1651 LIST_HEAD_INIT(security_hook_heads.inode_killpriv),
1652 .inode_getsecurity =
1653 LIST_HEAD_INIT(security_hook_heads.inode_getsecurity),
1654 .inode_setsecurity =
1655 LIST_HEAD_INIT(security_hook_heads.inode_setsecurity),
1656 .inode_listsecurity =
1657 LIST_HEAD_INIT(security_hook_heads.inode_listsecurity),
1658 .inode_getsecid =
1659 LIST_HEAD_INIT(security_hook_heads.inode_getsecid),
1660 .file_permission =
1661 LIST_HEAD_INIT(security_hook_heads.file_permission),
1662 .file_alloc_security =
1663 LIST_HEAD_INIT(security_hook_heads.file_alloc_security),
1664 .file_free_security =
1665 LIST_HEAD_INIT(security_hook_heads.file_free_security),
1666 .file_ioctl = LIST_HEAD_INIT(security_hook_heads.file_ioctl),
1667 .mmap_addr = LIST_HEAD_INIT(security_hook_heads.mmap_addr),
1668 .mmap_file = LIST_HEAD_INIT(security_hook_heads.mmap_file),
1669 .file_mprotect =
1670 LIST_HEAD_INIT(security_hook_heads.file_mprotect),
1671 .file_lock = LIST_HEAD_INIT(security_hook_heads.file_lock),
1672 .file_fcntl = LIST_HEAD_INIT(security_hook_heads.file_fcntl),
1673 .file_set_fowner =
1674 LIST_HEAD_INIT(security_hook_heads.file_set_fowner),
1675 .file_send_sigiotask =
1676 LIST_HEAD_INIT(security_hook_heads.file_send_sigiotask),
1677 .file_receive = LIST_HEAD_INIT(security_hook_heads.file_receive),
1678 .file_open = LIST_HEAD_INIT(security_hook_heads.file_open),
1679 .task_create = LIST_HEAD_INIT(security_hook_heads.task_create),
1680 .task_free = LIST_HEAD_INIT(security_hook_heads.task_free),
1681 .cred_alloc_blank =
1682 LIST_HEAD_INIT(security_hook_heads.cred_alloc_blank),
1683 .cred_free = LIST_HEAD_INIT(security_hook_heads.cred_free),
1684 .cred_prepare = LIST_HEAD_INIT(security_hook_heads.cred_prepare),
1685 .cred_transfer =
1686 LIST_HEAD_INIT(security_hook_heads.cred_transfer),
1687 .kernel_act_as =
1688 LIST_HEAD_INIT(security_hook_heads.kernel_act_as),
1689 .kernel_create_files_as =
1690 LIST_HEAD_INIT(security_hook_heads.kernel_create_files_as),
1691 .kernel_fw_from_file =
1692 LIST_HEAD_INIT(security_hook_heads.kernel_fw_from_file),
1693 .kernel_module_request =
1694 LIST_HEAD_INIT(security_hook_heads.kernel_module_request),
1695 .kernel_module_from_file =
1696 LIST_HEAD_INIT(security_hook_heads.kernel_module_from_file),
1697 .task_fix_setuid =
1698 LIST_HEAD_INIT(security_hook_heads.task_fix_setuid),
1699 .task_setpgid = LIST_HEAD_INIT(security_hook_heads.task_setpgid),
1700 .task_getpgid = LIST_HEAD_INIT(security_hook_heads.task_getpgid),
1701 .task_getsid = LIST_HEAD_INIT(security_hook_heads.task_getsid),
1702 .task_getsecid =
1703 LIST_HEAD_INIT(security_hook_heads.task_getsecid),
1704 .task_setnice = LIST_HEAD_INIT(security_hook_heads.task_setnice),
1705 .task_setioprio =
1706 LIST_HEAD_INIT(security_hook_heads.task_setioprio),
1707 .task_getioprio =
1708 LIST_HEAD_INIT(security_hook_heads.task_getioprio),
1709 .task_setrlimit =
1710 LIST_HEAD_INIT(security_hook_heads.task_setrlimit),
1711 .task_setscheduler =
1712 LIST_HEAD_INIT(security_hook_heads.task_setscheduler),
1713 .task_getscheduler =
1714 LIST_HEAD_INIT(security_hook_heads.task_getscheduler),
1715 .task_movememory =
1716 LIST_HEAD_INIT(security_hook_heads.task_movememory),
1717 .task_kill = LIST_HEAD_INIT(security_hook_heads.task_kill),
1718 .task_wait = LIST_HEAD_INIT(security_hook_heads.task_wait),
1719 .task_prctl = LIST_HEAD_INIT(security_hook_heads.task_prctl),
1720 .task_to_inode =
1721 LIST_HEAD_INIT(security_hook_heads.task_to_inode),
1722 .ipc_permission =
1723 LIST_HEAD_INIT(security_hook_heads.ipc_permission),
1724 .ipc_getsecid = LIST_HEAD_INIT(security_hook_heads.ipc_getsecid),
1725 .msg_msg_alloc_security =
1726 LIST_HEAD_INIT(security_hook_heads.msg_msg_alloc_security),
1727 .msg_msg_free_security =
1728 LIST_HEAD_INIT(security_hook_heads.msg_msg_free_security),
1729 .msg_queue_alloc_security =
1730 LIST_HEAD_INIT(security_hook_heads.msg_queue_alloc_security),
1731 .msg_queue_free_security =
1732 LIST_HEAD_INIT(security_hook_heads.msg_queue_free_security),
1733 .msg_queue_associate =
1734 LIST_HEAD_INIT(security_hook_heads.msg_queue_associate),
1735 .msg_queue_msgctl =
1736 LIST_HEAD_INIT(security_hook_heads.msg_queue_msgctl),
1737 .msg_queue_msgsnd =
1738 LIST_HEAD_INIT(security_hook_heads.msg_queue_msgsnd),
1739 .msg_queue_msgrcv =
1740 LIST_HEAD_INIT(security_hook_heads.msg_queue_msgrcv),
1741 .shm_alloc_security =
1742 LIST_HEAD_INIT(security_hook_heads.shm_alloc_security),
1743 .shm_free_security =
1744 LIST_HEAD_INIT(security_hook_heads.shm_free_security),
1745 .shm_associate =
1746 LIST_HEAD_INIT(security_hook_heads.shm_associate),
1747 .shm_shmctl = LIST_HEAD_INIT(security_hook_heads.shm_shmctl),
1748 .shm_shmat = LIST_HEAD_INIT(security_hook_heads.shm_shmat),
1749 .sem_alloc_security =
1750 LIST_HEAD_INIT(security_hook_heads.sem_alloc_security),
1751 .sem_free_security =
1752 LIST_HEAD_INIT(security_hook_heads.sem_free_security),
1753 .sem_associate =
1754 LIST_HEAD_INIT(security_hook_heads.sem_associate),
1755 .sem_semctl = LIST_HEAD_INIT(security_hook_heads.sem_semctl),
1756 .sem_semop = LIST_HEAD_INIT(security_hook_heads.sem_semop),
1757 .netlink_send = LIST_HEAD_INIT(security_hook_heads.netlink_send),
1758 .d_instantiate =
1759 LIST_HEAD_INIT(security_hook_heads.d_instantiate),
1760 .getprocattr = LIST_HEAD_INIT(security_hook_heads.getprocattr),
1761 .setprocattr = LIST_HEAD_INIT(security_hook_heads.setprocattr),
1762 .ismaclabel = LIST_HEAD_INIT(security_hook_heads.ismaclabel),
1763 .secid_to_secctx =
1764 LIST_HEAD_INIT(security_hook_heads.secid_to_secctx),
1765 .secctx_to_secid =
1766 LIST_HEAD_INIT(security_hook_heads.secctx_to_secid),
1767 .release_secctx =
1768 LIST_HEAD_INIT(security_hook_heads.release_secctx),
1769 .inode_notifysecctx =
1770 LIST_HEAD_INIT(security_hook_heads.inode_notifysecctx),
1771 .inode_setsecctx =
1772 LIST_HEAD_INIT(security_hook_heads.inode_setsecctx),
1773 .inode_getsecctx =
1774 LIST_HEAD_INIT(security_hook_heads.inode_getsecctx),
1775#ifdef CONFIG_SECURITY_NETWORK
1776 .unix_stream_connect =
1777 LIST_HEAD_INIT(security_hook_heads.unix_stream_connect),
1778 .unix_may_send =
1779 LIST_HEAD_INIT(security_hook_heads.unix_may_send),
1780 .socket_create =
1781 LIST_HEAD_INIT(security_hook_heads.socket_create),
1782 .socket_post_create =
1783 LIST_HEAD_INIT(security_hook_heads.socket_post_create),
1784 .socket_bind = LIST_HEAD_INIT(security_hook_heads.socket_bind),
1785 .socket_connect =
1786 LIST_HEAD_INIT(security_hook_heads.socket_connect),
1787 .socket_listen =
1788 LIST_HEAD_INIT(security_hook_heads.socket_listen),
1789 .socket_accept =
1790 LIST_HEAD_INIT(security_hook_heads.socket_accept),
1791 .socket_sendmsg =
1792 LIST_HEAD_INIT(security_hook_heads.socket_sendmsg),
1793 .socket_recvmsg =
1794 LIST_HEAD_INIT(security_hook_heads.socket_recvmsg),
1795 .socket_getsockname =
1796 LIST_HEAD_INIT(security_hook_heads.socket_getsockname),
1797 .socket_getpeername =
1798 LIST_HEAD_INIT(security_hook_heads.socket_getpeername),
1799 .socket_getsockopt =
1800 LIST_HEAD_INIT(security_hook_heads.socket_getsockopt),
1801 .socket_setsockopt =
1802 LIST_HEAD_INIT(security_hook_heads.socket_setsockopt),
1803 .socket_shutdown =
1804 LIST_HEAD_INIT(security_hook_heads.socket_shutdown),
1805 .socket_sock_rcv_skb =
1806 LIST_HEAD_INIT(security_hook_heads.socket_sock_rcv_skb),
1807 .socket_getpeersec_stream =
1808 LIST_HEAD_INIT(security_hook_heads.socket_getpeersec_stream),
1809 .socket_getpeersec_dgram =
1810 LIST_HEAD_INIT(security_hook_heads.socket_getpeersec_dgram),
1811 .sk_alloc_security =
1812 LIST_HEAD_INIT(security_hook_heads.sk_alloc_security),
1813 .sk_free_security =
1814 LIST_HEAD_INIT(security_hook_heads.sk_free_security),
1815 .sk_clone_security =
1816 LIST_HEAD_INIT(security_hook_heads.sk_clone_security),
1817 .sk_getsecid = LIST_HEAD_INIT(security_hook_heads.sk_getsecid),
1818 .sock_graft = LIST_HEAD_INIT(security_hook_heads.sock_graft),
1819 .inet_conn_request =
1820 LIST_HEAD_INIT(security_hook_heads.inet_conn_request),
1821 .inet_csk_clone =
1822 LIST_HEAD_INIT(security_hook_heads.inet_csk_clone),
1823 .inet_conn_established =
1824 LIST_HEAD_INIT(security_hook_heads.inet_conn_established),
1825 .secmark_relabel_packet =
1826 LIST_HEAD_INIT(security_hook_heads.secmark_relabel_packet),
1827 .secmark_refcount_inc =
1828 LIST_HEAD_INIT(security_hook_heads.secmark_refcount_inc),
1829 .secmark_refcount_dec =
1830 LIST_HEAD_INIT(security_hook_heads.secmark_refcount_dec),
1831 .req_classify_flow =
1832 LIST_HEAD_INIT(security_hook_heads.req_classify_flow),
1833 .tun_dev_alloc_security =
1834 LIST_HEAD_INIT(security_hook_heads.tun_dev_alloc_security),
1835 .tun_dev_free_security =
1836 LIST_HEAD_INIT(security_hook_heads.tun_dev_free_security),
1837 .tun_dev_create =
1838 LIST_HEAD_INIT(security_hook_heads.tun_dev_create),
1839 .tun_dev_attach_queue =
1840 LIST_HEAD_INIT(security_hook_heads.tun_dev_attach_queue),
1841 .tun_dev_attach =
1842 LIST_HEAD_INIT(security_hook_heads.tun_dev_attach),
1843 .tun_dev_open = LIST_HEAD_INIT(security_hook_heads.tun_dev_open),
1844 .skb_owned_by = LIST_HEAD_INIT(security_hook_heads.skb_owned_by),
1845#endif /* CONFIG_SECURITY_NETWORK */
1846#ifdef CONFIG_SECURITY_NETWORK_XFRM
1847 .xfrm_policy_alloc_security =
1848 LIST_HEAD_INIT(security_hook_heads.xfrm_policy_alloc_security),
1849 .xfrm_policy_clone_security =
1850 LIST_HEAD_INIT(security_hook_heads.xfrm_policy_clone_security),
1851 .xfrm_policy_free_security =
1852 LIST_HEAD_INIT(security_hook_heads.xfrm_policy_free_security),
1853 .xfrm_policy_delete_security =
1854 LIST_HEAD_INIT(security_hook_heads.xfrm_policy_delete_security),
1855 .xfrm_state_alloc =
1856 LIST_HEAD_INIT(security_hook_heads.xfrm_state_alloc),
1857 .xfrm_state_alloc_acquire =
1858 LIST_HEAD_INIT(security_hook_heads.xfrm_state_alloc_acquire),
1859 .xfrm_state_free_security =
1860 LIST_HEAD_INIT(security_hook_heads.xfrm_state_free_security),
1861 .xfrm_state_delete_security =
1862 LIST_HEAD_INIT(security_hook_heads.xfrm_state_delete_security),
1863 .xfrm_policy_lookup =
1864 LIST_HEAD_INIT(security_hook_heads.xfrm_policy_lookup),
1865 .xfrm_state_pol_flow_match =
1866 LIST_HEAD_INIT(security_hook_heads.xfrm_state_pol_flow_match),
1867 .xfrm_decode_session =
1868 LIST_HEAD_INIT(security_hook_heads.xfrm_decode_session),
1869#endif /* CONFIG_SECURITY_NETWORK_XFRM */
1870#ifdef CONFIG_KEYS
1871 .key_alloc = LIST_HEAD_INIT(security_hook_heads.key_alloc),
1872 .key_free = LIST_HEAD_INIT(security_hook_heads.key_free),
1873 .key_permission =
1874 LIST_HEAD_INIT(security_hook_heads.key_permission),
1875 .key_getsecurity =
1876 LIST_HEAD_INIT(security_hook_heads.key_getsecurity),
1877#endif /* CONFIG_KEYS */
1878#ifdef CONFIG_AUDIT
1879 .audit_rule_init =
1880 LIST_HEAD_INIT(security_hook_heads.audit_rule_init),
1881 .audit_rule_known =
1882 LIST_HEAD_INIT(security_hook_heads.audit_rule_known),
1883 .audit_rule_match =
1884 LIST_HEAD_INIT(security_hook_heads.audit_rule_match),
1885 .audit_rule_free =
1886 LIST_HEAD_INIT(security_hook_heads.audit_rule_free),
1887#endif /* CONFIG_AUDIT */
1888};
Linux kernel - Deliverables
This page took 0.043545 seconds and 5 git commands to generate.