security.c revision 4b61d12c84293ac061909f27f567c1905e4d90e3
12f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox/* 22f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * Security plug functions 32f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * 42f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com> 52f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * Copyright (C) 2001-2002 Greg Kroah-Hartman <greg@kroah.com> 62f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com> 72f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * 82f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * This program is free software; you can redistribute it and/or modify 92f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * it under the terms of the GNU General Public License as published by 102f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * the Free Software Foundation; either version 2 of the License, or 112f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * (at your option) any later version. 122f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox */ 132f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 14c4192705fec85219086231a1c0fa61e8776e2c3bDave Jiang#include <linux/capability.h> 152f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox#include <linux/module.h> 162f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox#include <linux/init.h> 172f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox#include <linux/kernel.h> 182f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox#include <linux/security.h> 192f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox#include <linux/ima.h> 202f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 212f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox/* Boot-time LSM user choice */ 22c3c52bce6993c6d37af2c2de9b482a7013d646a7Hitoshi Mitakestatic __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] = 2320bcb7a81dee21bfa3408f03f46b2891c9b5c84bDouglas Thompson CONFIG_DEFAULT_SECURITY; 242f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 25152ba3942276c2a240703669ae4a3099e0a79451Michal Marek/* things that live in capability.c */ 26929a40ec324e947d4ad14cc1ced785c104c560e2Doug Thompsonextern void security_fixup_ops(struct security_operations *ops); 2737f04581abac20444e5b7106c1e1f28bec5b989cDoug Thompson 28537fba28928c01b7db1580627450691a4bb0b9b3Dave Petersonstatic struct security_operations *security_ops; 29e7ecd8910293564d357dbaf18eb179e06fa35fd0Dave Petersonstatic struct security_operations default_security_ops = { 30537fba28928c01b7db1580627450691a4bb0b9b3Dave Peterson .name = "default", 31537fba28928c01b7db1580627450691a4bb0b9b3Dave Peterson}; 32e7ecd8910293564d357dbaf18eb179e06fa35fd0Dave Peterson 33537fba28928c01b7db1580627450691a4bb0b9b3Dave Petersonstatic inline int verify(struct security_operations *ops) 342f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 352f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox /* verify the security_operations structure exists */ 362f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox if (!ops) 372f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return -EINVAL; 382f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox security_fixup_ops(ops); 392f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return 0; 402f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 412f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 422f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxstatic void __init do_security_initcalls(void) 432f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 442f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox initcall_t *call; 452f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox call = __security_initcall_start; 462f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox while (call < __security_initcall_end) { 472f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox (*call) (); 482f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox call++; 492f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox } 502f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 512f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 522f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox/** 532f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * security_init - initializes the security framework 542f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * 552f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * This should be called early in the kernel initialization sequence. 562f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox */ 572f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxint __init security_init(void) 582f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 592f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox printk(KERN_INFO "Security Framework initialized\n"); 602f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 612f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox security_fixup_ops(&default_security_ops); 622f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox security_ops = &default_security_ops; 632f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox do_security_initcalls(); 642f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 652f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return 0; 662f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 672f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 682f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxvoid reset_security_ops(void) 692f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 702f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox security_ops = &default_security_ops; 712f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 722f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 732f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox/* Save user chosen LSM */ 742f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxstatic int __init choose_lsm(char *str) 752f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 762f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox strncpy(chosen_lsm, str, SECURITY_NAME_MAX); 772f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return 1; 782f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 792f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox__setup("security=", choose_lsm); 802f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 812f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox/** 822f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * security_module_enable - Load given security module on boot ? 832f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * @ops: a pointer to the struct security_operations that is to be checked. 842f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * 852f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * Each LSM must pass this method before registering its own operations 862f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * to avoid security registration races. This method may also be used 872f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * to check if your LSM is currently loaded during kernel initialization. 882f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * 892f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * Return true if: 902f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * -The passed LSM is the one chosen by user at boot time, 912f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * -or the passed LSM is configured as the default and the user did not 922f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * choose an alternate LSM at boot time, 932f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * -or there is no default LSM set and the user didn't specify a 942f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * specific LSM and we're the first to ask for registration permission, 952f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * -or the passed LSM is currently loaded. 962f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * Otherwise, return false. 972f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox */ 982f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxint __init security_module_enable(struct security_operations *ops) 992f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 1002f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox if (!*chosen_lsm) 1012f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox strncpy(chosen_lsm, ops->name, SECURITY_NAME_MAX); 1022f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox else if (strncmp(ops->name, chosen_lsm, SECURITY_NAME_MAX)) 1032f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return 0; 1042f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 1052f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return 1; 1062f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 1072f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 1082f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox/** 1092f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * register_security - registers a security framework with the kernel 1102f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * @ops: a pointer to the struct security_options that is to be registered 1112f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * 1122f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * This function allows a security module to register itself with the 1132f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * kernel security subsystem. Some rudimentary checking is done on the @ops 1142f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * value passed to this function. You'll need to check first if your LSM 1152f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * is allowed to register its @ops by calling security_module_enable(@ops). 1162f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * 1172f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * If there is already a security module registered with the kernel, 1182f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox * an error will be returned. Otherwise %0 is returned on success. 1192f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox */ 1202f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxint __init register_security(struct security_operations *ops) 1212f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 1222f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox if (verify(ops)) { 12325985edcedea6396277003854657b5f3cb31a628Lucas De Marchi printk(KERN_DEBUG "%s could not verify " 1242f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox "security_operations structure.\n", __func__); 1252f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return -EINVAL; 1262f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox } 1272f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 1282f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox if (security_ops != &default_security_ops) 1292f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return -EAGAIN; 1302f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 1312f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox security_ops = ops; 1322f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 1332f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return 0; 13490ab5ee94171b3e28de6bb42ee30b527014e0be7Rusty Russell} 1352f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 136456a2f9552e7849475f4aea1a9aa4c0e54b3dddaDave Jiang/* Security operations */ 137456a2f9552e7849475f4aea1a9aa4c0e54b3dddaDave Jiang 138cddbfcacf02dc2d5b074fc2717358a7529a190dbDouglas Thompsonint security_ptrace_access_check(struct task_struct *child, unsigned int mode) 139052dfb45ccb5ea354a426b52556bcfee75b9d2f5Douglas Thompson{ 1402f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return security_ops->ptrace_access_check(child, mode); 14137f04581abac20444e5b7106c1e1f28bec5b989cDoug Thompson} 14237f04581abac20444e5b7106c1e1f28bec5b989cDoug Thompson 143fd687502dc8037aa5a4b84c570ada971106574eeMauro Carvalho Chehabint security_ptrace_traceme(struct task_struct *parent) 14437f04581abac20444e5b7106c1e1f28bec5b989cDoug Thompson{ 1452f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return security_ops->ptrace_traceme(parent); 1462f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 1472f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 14837f04581abac20444e5b7106c1e1f28bec5b989cDoug Thompsonint security_capget(struct task_struct *target, 149cddbfcacf02dc2d5b074fc2717358a7529a190dbDouglas Thompson kernel_cap_t *effective, 150cddbfcacf02dc2d5b074fc2717358a7529a190dbDouglas Thompson kernel_cap_t *inheritable, 1512f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox kernel_cap_t *permitted) 1522f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 1532f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return security_ops->capget(target, effective, inheritable, permitted); 15437f04581abac20444e5b7106c1e1f28bec5b989cDoug Thompson} 155cddbfcacf02dc2d5b074fc2717358a7529a190dbDouglas Thompson 156cddbfcacf02dc2d5b074fc2717358a7529a190dbDouglas Thompsonint security_capset(struct cred *new, const struct cred *old, 1572f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox const kernel_cap_t *effective, 1582f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox const kernel_cap_t *inheritable, 159cddbfcacf02dc2d5b074fc2717358a7529a190dbDouglas Thompson const kernel_cap_t *permitted) 160052dfb45ccb5ea354a426b52556bcfee75b9d2f5Douglas Thompson{ 161052dfb45ccb5ea354a426b52556bcfee75b9d2f5Douglas Thompson return security_ops->capset(new, old, 1622f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox effective, inheritable, permitted); 1632f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 1642f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 1652f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxint security_capable(int cap) 1662f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 1672f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return security_ops->capable(current, current_cred(), cap, 1682f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox SECURITY_CAP_AUDIT); 1692f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 1702f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 1712f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxint security_real_capable(struct task_struct *tsk, int cap) 1722f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 1732f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox const struct cred *cred; 1742f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox int ret; 1752f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 1762f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox cred = get_task_cred(tsk); 1772f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox ret = security_ops->capable(tsk, cred, cap, SECURITY_CAP_AUDIT); 178cddbfcacf02dc2d5b074fc2717358a7529a190dbDouglas Thompson put_cred(cred); 1792f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return ret; 1802f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 1812f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 1829eb07a7fb8a90ee39fa9d5489afc0330cfcfbea7Mauro Carvalho Chehabint security_real_capable_noaudit(struct task_struct *tsk, int cap) 18363b5d1d9aa4b59847ce6279b8798ed28c686a459Mauro Carvalho Chehab{ 18463b5d1d9aa4b59847ce6279b8798ed28c686a459Mauro Carvalho Chehab const struct cred *cred; 18563b5d1d9aa4b59847ce6279b8798ed28c686a459Mauro Carvalho Chehab int ret; 18603f7eae80f4b913929be84e0c883ee98196fd6ffMauro Carvalho Chehab 1872f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox cred = get_task_cred(tsk); 1882f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox ret = security_ops->capable(tsk, cred, cap, SECURITY_CAP_NOAUDIT); 189cddbfcacf02dc2d5b074fc2717358a7529a190dbDouglas Thompson put_cred(cred); 1902f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return ret; 1912f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 1922f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 1932f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxint security_acct(struct file *file) 1949eb07a7fb8a90ee39fa9d5489afc0330cfcfbea7Mauro Carvalho Chehab{ 19563b5d1d9aa4b59847ce6279b8798ed28c686a459Mauro Carvalho Chehab return security_ops->acct(file); 19663b5d1d9aa4b59847ce6279b8798ed28c686a459Mauro Carvalho Chehab} 19763b5d1d9aa4b59847ce6279b8798ed28c686a459Mauro Carvalho Chehab 19803f7eae80f4b913929be84e0c883ee98196fd6ffMauro Carvalho Chehabint security_sysctl(struct ctl_table *table, int op) 1992f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 2002f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return security_ops->sysctl(table, op); 2012f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 2022f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 2032f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxint security_quotactl(int cmds, int type, int id, struct super_block *sb) 2042f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 2052f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return security_ops->quotactl(cmds, type, id, sb); 2062f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 2072f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 208956b9ba156dbfdb9cede2b2927ddf8be2233b3a7Joe Perchesint security_quota_on(struct dentry *dentry) 2092f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 2102f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return security_ops->quota_on(dentry); 2112f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 2122f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 2131318952514d5651c453d89989595a9df3b37267bDoug Thompsonint security_syslog(int type, bool from_file) 2142f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 2151318952514d5651c453d89989595a9df3b37267bDoug Thompson return security_ops->syslog(type, from_file); 2161318952514d5651c453d89989595a9df3b37267bDoug Thompson} 2171318952514d5651c453d89989595a9df3b37267bDoug Thompson 2181318952514d5651c453d89989595a9df3b37267bDoug Thompsonint security_settime(struct timespec *ts, struct timezone *tz) 219052dfb45ccb5ea354a426b52556bcfee75b9d2f5Douglas Thompson{ 2201318952514d5651c453d89989595a9df3b37267bDoug Thompson return security_ops->settime(ts, tz); 2211318952514d5651c453d89989595a9df3b37267bDoug Thompson} 222084a4fccef39ac7abb039511f32380f28d0b67e6Mauro Carvalho Chehab 2232f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxint security_vm_enough_memory(long pages) 22425985edcedea6396277003854657b5f3cb31a628Lucas De Marchi{ 2251318952514d5651c453d89989595a9df3b37267bDoug Thompson WARN_ON(current->mm == NULL); 2261318952514d5651c453d89989595a9df3b37267bDoug Thompson return security_ops->vm_enough_memory(current->mm, pages); 2271318952514d5651c453d89989595a9df3b37267bDoug Thompson} 2281318952514d5651c453d89989595a9df3b37267bDoug Thompson 2291318952514d5651c453d89989595a9df3b37267bDoug Thompsonint security_vm_enough_memory_mm(struct mm_struct *mm, long pages) 2301318952514d5651c453d89989595a9df3b37267bDoug Thompson{ 2311318952514d5651c453d89989595a9df3b37267bDoug Thompson WARN_ON(mm == NULL); 2321318952514d5651c453d89989595a9df3b37267bDoug Thompson return security_ops->vm_enough_memory(mm, pages); 233de3910eb79ac8c0f29a11224661c0ebaaf813039Mauro Carvalho Chehab} 234de3910eb79ac8c0f29a11224661c0ebaaf813039Mauro Carvalho Chehab 2351318952514d5651c453d89989595a9df3b37267bDoug Thompsonint security_vm_enough_memory_kern(long pages) 2361318952514d5651c453d89989595a9df3b37267bDoug Thompson{ 2371318952514d5651c453d89989595a9df3b37267bDoug Thompson /* If current->mm is a kernel thread then we will pass NULL, 2381318952514d5651c453d89989595a9df3b37267bDoug Thompson for this specific case that is fine */ 239956b9ba156dbfdb9cede2b2927ddf8be2233b3a7Joe Perches return security_ops->vm_enough_memory(current->mm, pages); 2401318952514d5651c453d89989595a9df3b37267bDoug Thompson} 2411318952514d5651c453d89989595a9df3b37267bDoug Thompson 2421318952514d5651c453d89989595a9df3b37267bDoug Thompsonint security_bprm_set_creds(struct linux_binprm *bprm) 2431318952514d5651c453d89989595a9df3b37267bDoug Thompson{ 244956b9ba156dbfdb9cede2b2927ddf8be2233b3a7Joe Perches return security_ops->bprm_set_creds(bprm); 245956b9ba156dbfdb9cede2b2927ddf8be2233b3a7Joe Perches} 2461318952514d5651c453d89989595a9df3b37267bDoug Thompson 2471318952514d5651c453d89989595a9df3b37267bDoug Thompsonint security_bprm_check(struct linux_binprm *bprm) 2481318952514d5651c453d89989595a9df3b37267bDoug Thompson{ 2491318952514d5651c453d89989595a9df3b37267bDoug Thompson int ret; 2501318952514d5651c453d89989595a9df3b37267bDoug Thompson 2511318952514d5651c453d89989595a9df3b37267bDoug Thompson ret = security_ops->bprm_check_security(bprm); 2521318952514d5651c453d89989595a9df3b37267bDoug Thompson if (ret) 2531318952514d5651c453d89989595a9df3b37267bDoug Thompson return ret; 2541318952514d5651c453d89989595a9df3b37267bDoug Thompson return ima_bprm_check(bprm); 255a895bf8b1e1ea4c032a8fa8a09475a2ce09fe77aMauro Carvalho Chehab} 256a895bf8b1e1ea4c032a8fa8a09475a2ce09fe77aMauro Carvalho Chehab 2571318952514d5651c453d89989595a9df3b37267bDoug Thompsonvoid security_bprm_committing_creds(struct linux_binprm *bprm) 2581318952514d5651c453d89989595a9df3b37267bDoug Thompson{ 259084a4fccef39ac7abb039511f32380f28d0b67e6Mauro Carvalho Chehab security_ops->bprm_committing_creds(bprm); 260084a4fccef39ac7abb039511f32380f28d0b67e6Mauro Carvalho Chehab} 2611318952514d5651c453d89989595a9df3b37267bDoug Thompson 262084a4fccef39ac7abb039511f32380f28d0b67e6Mauro Carvalho Chehabvoid security_bprm_committed_creds(struct linux_binprm *bprm) 2631318952514d5651c453d89989595a9df3b37267bDoug Thompson{ 2641318952514d5651c453d89989595a9df3b37267bDoug Thompson security_ops->bprm_committed_creds(bprm); 265084a4fccef39ac7abb039511f32380f28d0b67e6Mauro Carvalho Chehab} 2661318952514d5651c453d89989595a9df3b37267bDoug Thompson 2671318952514d5651c453d89989595a9df3b37267bDoug Thompsonint security_bprm_secureexec(struct linux_binprm *bprm) 2681318952514d5651c453d89989595a9df3b37267bDoug Thompson{ 2691318952514d5651c453d89989595a9df3b37267bDoug Thompson return security_ops->bprm_secureexec(bprm); 2701318952514d5651c453d89989595a9df3b37267bDoug Thompson} 2711318952514d5651c453d89989595a9df3b37267bDoug Thompson 2721318952514d5651c453d89989595a9df3b37267bDoug Thompsonint security_sb_alloc(struct super_block *sb) 27363b5d1d9aa4b59847ce6279b8798ed28c686a459Mauro Carvalho Chehab{ 2742f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return security_ops->sb_alloc_security(sb); 2752f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 2762f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 2772f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxvoid security_sb_free(struct super_block *sb) 278749ede57443b2a7ede2db105145f21047efcea6aDave Peterson{ 2792f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox security_ops->sb_free_security(sb); 280956b9ba156dbfdb9cede2b2927ddf8be2233b3a7Joe Perches} 2812f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 2822f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxint security_sb_copy_data(char *orig, char *copy) 2832f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 2842f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return security_ops->sb_copy_data(orig, copy); 285956b9ba156dbfdb9cede2b2927ddf8be2233b3a7Joe Perches} 286956b9ba156dbfdb9cede2b2927ddf8be2233b3a7Joe PerchesEXPORT_SYMBOL(security_sb_copy_data); 28763b5d1d9aa4b59847ce6279b8798ed28c686a459Mauro Carvalho Chehab 28863b5d1d9aa4b59847ce6279b8798ed28c686a459Mauro Carvalho Chehabint security_sb_kern_mount(struct super_block *sb, int flags, void *data) 28963b5d1d9aa4b59847ce6279b8798ed28c686a459Mauro Carvalho Chehab{ 29063b5d1d9aa4b59847ce6279b8798ed28c686a459Mauro Carvalho Chehab return security_ops->sb_kern_mount(sb, flags, data); 29163b5d1d9aa4b59847ce6279b8798ed28c686a459Mauro Carvalho Chehab} 29263b5d1d9aa4b59847ce6279b8798ed28c686a459Mauro Carvalho Chehab 293ca0907b9e413bb1d1f3ea123b663535b74928846Mauro Carvalho Chehabint security_sb_show_options(struct seq_file *m, struct super_block *sb) 2941318952514d5651c453d89989595a9df3b37267bDoug Thompson{ 2951318952514d5651c453d89989595a9df3b37267bDoug Thompson return security_ops->sb_show_options(m, sb); 2962f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 297956b9ba156dbfdb9cede2b2927ddf8be2233b3a7Joe Perches 298fd687502dc8037aa5a4b84c570ada971106574eeMauro Carvalho Chehabint security_sb_statfs(struct dentry *dentry) 2992f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 3002f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return security_ops->sb_statfs(dentry); 301e7ecd8910293564d357dbaf18eb179e06fa35fd0Dave Peterson} 302e7ecd8910293564d357dbaf18eb179e06fa35fd0Dave Peterson 303e7ecd8910293564d357dbaf18eb179e06fa35fd0Dave Petersonint security_sb_mount(char *dev_name, struct path *path, 3042f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox char *type, unsigned long flags, void *data) 3052f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 3062f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return security_ops->sb_mount(dev_name, path, type, flags, data); 3072f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 3082f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 3092f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxint security_sb_umount(struct vfsmount *mnt, int flags) 310e7ecd8910293564d357dbaf18eb179e06fa35fd0Dave Peterson{ 3111318952514d5651c453d89989595a9df3b37267bDoug Thompson return security_ops->sb_umount(mnt, flags); 3122f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 313956b9ba156dbfdb9cede2b2927ddf8be2233b3a7Joe Perches 314956b9ba156dbfdb9cede2b2927ddf8be2233b3a7Joe Perchesvoid security_sb_post_remount(struct vfsmount *mnt, unsigned long flags, void *data) 3152f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 3162f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox security_ops->sb_post_remount(mnt, flags, data); 3172f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 318680cbbbb0e336b04b74be48b8ddd870537f1e226Dave Peterson 31937f04581abac20444e5b7106c1e1f28bec5b989cDoug Thompsonvoid security_sb_post_addmount(struct vfsmount *mnt, struct path *mountpoint) 3202f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 321c4192705fec85219086231a1c0fa61e8776e2c3bDave Jiang security_ops->sb_post_addmount(mnt, mountpoint); 3222f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 3232f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 3241318952514d5651c453d89989595a9df3b37267bDoug Thompsonint security_sb_pivotroot(struct path *old_path, struct path *new_path) 325cddbfcacf02dc2d5b074fc2717358a7529a190dbDouglas Thompson{ 3262f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return security_ops->sb_pivotroot(old_path, new_path); 3272d7bbb91c8df26c60d223205a087507430024177Doug Thompson} 3282d7bbb91c8df26c60d223205a087507430024177Doug Thompson 3292d7bbb91c8df26c60d223205a087507430024177Doug Thompsonvoid security_sb_post_pivotroot(struct path *old_path, struct path *new_path) 330b8f6f9755248026f21282e25cac49a1af698056cDoug Thompson{ 331956b9ba156dbfdb9cede2b2927ddf8be2233b3a7Joe Perches security_ops->sb_post_pivotroot(old_path, new_path); 3322f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 3332f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 3342f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxint security_sb_set_mnt_opts(struct super_block *sb, 3352f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox struct security_mnt_opts *opts) 3362f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 3372f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return security_ops->sb_set_mnt_opts(sb, opts); 338956b9ba156dbfdb9cede2b2927ddf8be2233b3a7Joe Perches} 33937f04581abac20444e5b7106c1e1f28bec5b989cDoug ThompsonEXPORT_SYMBOL(security_sb_set_mnt_opts); 3402f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 3412f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxvoid security_sb_clone_mnt_opts(const struct super_block *oldsb, 342456a2f9552e7849475f4aea1a9aa4c0e54b3dddaDave Jiang struct super_block *newsb) 343456a2f9552e7849475f4aea1a9aa4c0e54b3dddaDave Jiang{ 344456a2f9552e7849475f4aea1a9aa4c0e54b3dddaDave Jiang security_ops->sb_clone_mnt_opts(oldsb, newsb); 345456a2f9552e7849475f4aea1a9aa4c0e54b3dddaDave Jiang} 346456a2f9552e7849475f4aea1a9aa4c0e54b3dddaDave JiangEXPORT_SYMBOL(security_sb_clone_mnt_opts); 347456a2f9552e7849475f4aea1a9aa4c0e54b3dddaDave Jiang 348456a2f9552e7849475f4aea1a9aa4c0e54b3dddaDave Jiangint security_sb_parse_opts_str(char *options, struct security_mnt_opts *opts) 349456a2f9552e7849475f4aea1a9aa4c0e54b3dddaDave Jiang{ 350456a2f9552e7849475f4aea1a9aa4c0e54b3dddaDave Jiang return security_ops->sb_parse_opts_str(options, opts); 351456a2f9552e7849475f4aea1a9aa4c0e54b3dddaDave Jiang} 352456a2f9552e7849475f4aea1a9aa4c0e54b3dddaDave JiangEXPORT_SYMBOL(security_sb_parse_opts_str); 353956b9ba156dbfdb9cede2b2927ddf8be2233b3a7Joe Perches 3542f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxint security_inode_alloc(struct inode *inode) 3552f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 356052dfb45ccb5ea354a426b52556bcfee75b9d2f5Douglas Thompson int ret; 3571318952514d5651c453d89989595a9df3b37267bDoug Thompson 3581318952514d5651c453d89989595a9df3b37267bDoug Thompson inode->i_security = NULL; 3592f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox ret = security_ops->inode_alloc_security(inode); 3602f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox if (ret) 3612f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return ret; 3622f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox ret = ima_inode_alloc(inode); 363052dfb45ccb5ea354a426b52556bcfee75b9d2f5Douglas Thompson if (ret) 3642f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox security_inode_free(inode); 365956b9ba156dbfdb9cede2b2927ddf8be2233b3a7Joe Perches return ret; 3662f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 367ee6583f6e8f8dad4a53985dbabcd7c242d66a6b6Roman Fietze 3682f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxvoid security_inode_free(struct inode *inode) 3692f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 3702f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox ima_inode_free(inode); 3712f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox security_ops->inode_free_security(inode); 3722f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 3732f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 3742f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxint security_inode_init_security(struct inode *inode, struct inode *dir, 375956b9ba156dbfdb9cede2b2927ddf8be2233b3a7Joe Perches char **name, void **value, size_t *len) 3762f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 377456a2f9552e7849475f4aea1a9aa4c0e54b3dddaDave Jiang if (unlikely(IS_PRIVATE(inode))) 378456a2f9552e7849475f4aea1a9aa4c0e54b3dddaDave Jiang return -EOPNOTSUPP; 379456a2f9552e7849475f4aea1a9aa4c0e54b3dddaDave Jiang return security_ops->inode_init_security(inode, dir, name, value, len); 38037f04581abac20444e5b7106c1e1f28bec5b989cDoug Thompson} 38118dbc337af5d6efd30cb9291e74722c8ad134fd3Dave PetersonEXPORT_SYMBOL(security_inode_init_security); 38218dbc337af5d6efd30cb9291e74722c8ad134fd3Dave Peterson 38318dbc337af5d6efd30cb9291e74722c8ad134fd3Dave Peterson#ifdef CONFIG_SECURITY_PATH 3842f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxint security_path_mknod(struct path *dir, struct dentry *dentry, int mode, 3852f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox unsigned int dev) 38636c46f31df910b092aaaed27c7c616bb8e2302a1Lionel Debroux{ 387e7ecd8910293564d357dbaf18eb179e06fa35fd0Dave Peterson if (unlikely(IS_PRIVATE(dir->dentry->d_inode))) 388cddbfcacf02dc2d5b074fc2717358a7529a190dbDouglas Thompson return 0; 389cddbfcacf02dc2d5b074fc2717358a7529a190dbDouglas Thompson return security_ops->path_mknod(dir, dentry, mode, dev); 390e7ecd8910293564d357dbaf18eb179e06fa35fd0Dave Peterson} 391cddbfcacf02dc2d5b074fc2717358a7529a190dbDouglas ThompsonEXPORT_SYMBOL(security_path_mknod); 392cddbfcacf02dc2d5b074fc2717358a7529a190dbDouglas Thompson 3932f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxint security_path_mkdir(struct path *dir, struct dentry *dentry, int mode) 3942f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 3952f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox if (unlikely(IS_PRIVATE(dir->dentry->d_inode))) 3962f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return 0; 3972f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return security_ops->path_mkdir(dir, dentry, mode); 398680cbbbb0e336b04b74be48b8ddd870537f1e226Dave Peterson} 3992f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 4002f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxint security_path_rmdir(struct path *dir, struct dentry *dentry) 4012f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 4022f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox if (unlikely(IS_PRIVATE(dir->dentry->d_inode))) 4032f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return 0; 404da9bb1d27b21cb24cbb6a2efb5d3c464d357a01eAlan Cox return security_ops->path_rmdir(dir, dentry); 4052f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 406c3c52bce6993c6d37af2c2de9b482a7013d646a7Hitoshi Mitake 407c3c52bce6993c6d37af2c2de9b482a7013d646a7Hitoshi Mitakeint security_path_unlink(struct path *dir, struct dentry *dentry) 408c3c52bce6993c6d37af2c2de9b482a7013d646a7Hitoshi Mitake{ 4092f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox if (unlikely(IS_PRIVATE(dir->dentry->d_inode))) 4102f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return 0; 4112f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return security_ops->path_unlink(dir, dentry); 4122f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 4132f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 4142f768af73fea4c70f9046388a7ff648ad11f028eAlan Coxint security_path_symlink(struct path *dir, struct dentry *dentry, 4152f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox const char *old_name) 4162f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 4172f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox if (unlikely(IS_PRIVATE(dir->dentry->d_inode))) 4182f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return 0; 4192f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return security_ops->path_symlink(dir, dentry, old_name); 4202f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox} 4212f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox 422052dfb45ccb5ea354a426b52556bcfee75b9d2f5Douglas Thompsonint security_path_link(struct dentry *old_dentry, struct path *new_dir, 4232f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox struct dentry *new_dentry) 4242f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox{ 4252f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox if (unlikely(IS_PRIVATE(old_dentry->d_inode))) 4262f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return 0; 4272f768af73fea4c70f9046388a7ff648ad11f028eAlan Cox return security_ops->path_link(old_dentry, new_dir, new_dentry); 428c3c52bce6993c6d37af2c2de9b482a7013d646a7Hitoshi Mitake} 429c3c52bce6993c6d37af2c2de9b482a7013d646a7Hitoshi Mitake 430c3c52bce6993c6d37af2c2de9b482a7013d646a7Hitoshi Mitakeint security_path_rename(struct path *old_dir, struct dentry *old_dentry, 431 struct path *new_dir, struct dentry *new_dentry) 432{ 433 if (unlikely(IS_PRIVATE(old_dentry->d_inode) || 434 (new_dentry->d_inode && IS_PRIVATE(new_dentry->d_inode)))) 435 return 0; 436 return security_ops->path_rename(old_dir, old_dentry, new_dir, 437 new_dentry); 438} 439 440int security_path_truncate(struct path *path, loff_t length, 441 unsigned int time_attrs) 442{ 443 if (unlikely(IS_PRIVATE(path->dentry->d_inode))) 444 return 0; 445 return security_ops->path_truncate(path, length, time_attrs); 446} 447 448int security_path_chmod(struct dentry *dentry, struct vfsmount *mnt, 449 mode_t mode) 450{ 451 if (unlikely(IS_PRIVATE(dentry->d_inode))) 452 return 0; 453 return security_ops->path_chmod(dentry, mnt, mode); 454} 455 456int security_path_chown(struct path *path, uid_t uid, gid_t gid) 457{ 458 if (unlikely(IS_PRIVATE(path->dentry->d_inode))) 459 return 0; 460 return security_ops->path_chown(path, uid, gid); 461} 462 463int security_path_chroot(struct path *path) 464{ 465 return security_ops->path_chroot(path); 466} 467#endif 468 469int security_inode_create(struct inode *dir, struct dentry *dentry, int mode) 470{ 471 if (unlikely(IS_PRIVATE(dir))) 472 return 0; 473 return security_ops->inode_create(dir, dentry, mode); 474} 475EXPORT_SYMBOL_GPL(security_inode_create); 476 477int security_inode_link(struct dentry *old_dentry, struct inode *dir, 478 struct dentry *new_dentry) 479{ 480 if (unlikely(IS_PRIVATE(old_dentry->d_inode))) 481 return 0; 482 return security_ops->inode_link(old_dentry, dir, new_dentry); 483} 484 485int security_inode_unlink(struct inode *dir, struct dentry *dentry) 486{ 487 if (unlikely(IS_PRIVATE(dentry->d_inode))) 488 return 0; 489 return security_ops->inode_unlink(dir, dentry); 490} 491 492int security_inode_symlink(struct inode *dir, struct dentry *dentry, 493 const char *old_name) 494{ 495 if (unlikely(IS_PRIVATE(dir))) 496 return 0; 497 return security_ops->inode_symlink(dir, dentry, old_name); 498} 499 500int security_inode_mkdir(struct inode *dir, struct dentry *dentry, int mode) 501{ 502 if (unlikely(IS_PRIVATE(dir))) 503 return 0; 504 return security_ops->inode_mkdir(dir, dentry, mode); 505} 506EXPORT_SYMBOL_GPL(security_inode_mkdir); 507 508int security_inode_rmdir(struct inode *dir, struct dentry *dentry) 509{ 510 if (unlikely(IS_PRIVATE(dentry->d_inode))) 511 return 0; 512 return security_ops->inode_rmdir(dir, dentry); 513} 514 515int security_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev) 516{ 517 if (unlikely(IS_PRIVATE(dir))) 518 return 0; 519 return security_ops->inode_mknod(dir, dentry, mode, dev); 520} 521 522int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry, 523 struct inode *new_dir, struct dentry *new_dentry) 524{ 525 if (unlikely(IS_PRIVATE(old_dentry->d_inode) || 526 (new_dentry->d_inode && IS_PRIVATE(new_dentry->d_inode)))) 527 return 0; 528 return security_ops->inode_rename(old_dir, old_dentry, 529 new_dir, new_dentry); 530} 531 532int security_inode_readlink(struct dentry *dentry) 533{ 534 if (unlikely(IS_PRIVATE(dentry->d_inode))) 535 return 0; 536 return security_ops->inode_readlink(dentry); 537} 538 539int security_inode_follow_link(struct dentry *dentry, struct nameidata *nd) 540{ 541 if (unlikely(IS_PRIVATE(dentry->d_inode))) 542 return 0; 543 return security_ops->inode_follow_link(dentry, nd); 544} 545 546int security_inode_permission(struct inode *inode, int mask) 547{ 548 if (unlikely(IS_PRIVATE(inode))) 549 return 0; 550 return security_ops->inode_permission(inode, mask); 551} 552 553int security_inode_setattr(struct dentry *dentry, struct iattr *attr) 554{ 555 if (unlikely(IS_PRIVATE(dentry->d_inode))) 556 return 0; 557 return security_ops->inode_setattr(dentry, attr); 558} 559EXPORT_SYMBOL_GPL(security_inode_setattr); 560 561int security_inode_getattr(struct vfsmount *mnt, struct dentry *dentry) 562{ 563 if (unlikely(IS_PRIVATE(dentry->d_inode))) 564 return 0; 565 return security_ops->inode_getattr(mnt, dentry); 566} 567 568void security_inode_delete(struct inode *inode) 569{ 570 if (unlikely(IS_PRIVATE(inode))) 571 return; 572 security_ops->inode_delete(inode); 573} 574 575int security_inode_setxattr(struct dentry *dentry, const char *name, 576 const void *value, size_t size, int flags) 577{ 578 if (unlikely(IS_PRIVATE(dentry->d_inode))) 579 return 0; 580 return security_ops->inode_setxattr(dentry, name, value, size, flags); 581} 582 583void security_inode_post_setxattr(struct dentry *dentry, const char *name, 584 const void *value, size_t size, int flags) 585{ 586 if (unlikely(IS_PRIVATE(dentry->d_inode))) 587 return; 588 security_ops->inode_post_setxattr(dentry, name, value, size, flags); 589} 590 591int security_inode_getxattr(struct dentry *dentry, const char *name) 592{ 593 if (unlikely(IS_PRIVATE(dentry->d_inode))) 594 return 0; 595 return security_ops->inode_getxattr(dentry, name); 596} 597 598int security_inode_listxattr(struct dentry *dentry) 599{ 600 if (unlikely(IS_PRIVATE(dentry->d_inode))) 601 return 0; 602 return security_ops->inode_listxattr(dentry); 603} 604 605int security_inode_removexattr(struct dentry *dentry, const char *name) 606{ 607 if (unlikely(IS_PRIVATE(dentry->d_inode))) 608 return 0; 609 return security_ops->inode_removexattr(dentry, name); 610} 611 612int security_inode_need_killpriv(struct dentry *dentry) 613{ 614 return security_ops->inode_need_killpriv(dentry); 615} 616 617int security_inode_killpriv(struct dentry *dentry) 618{ 619 return security_ops->inode_killpriv(dentry); 620} 621 622int security_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc) 623{ 624 if (unlikely(IS_PRIVATE(inode))) 625 return -EOPNOTSUPP; 626 return security_ops->inode_getsecurity(inode, name, buffer, alloc); 627} 628 629int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags) 630{ 631 if (unlikely(IS_PRIVATE(inode))) 632 return -EOPNOTSUPP; 633 return security_ops->inode_setsecurity(inode, name, value, size, flags); 634} 635 636int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size) 637{ 638 if (unlikely(IS_PRIVATE(inode))) 639 return 0; 640 return security_ops->inode_listsecurity(inode, buffer, buffer_size); 641} 642 643void security_inode_getsecid(const struct inode *inode, u32 *secid) 644{ 645 security_ops->inode_getsecid(inode, secid); 646} 647 648int security_file_permission(struct file *file, int mask) 649{ 650 return security_ops->file_permission(file, mask); 651} 652 653int security_file_alloc(struct file *file) 654{ 655 return security_ops->file_alloc_security(file); 656} 657 658void security_file_free(struct file *file) 659{ 660 security_ops->file_free_security(file); 661} 662 663int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 664{ 665 return security_ops->file_ioctl(file, cmd, arg); 666} 667 668int security_file_mmap(struct file *file, unsigned long reqprot, 669 unsigned long prot, unsigned long flags, 670 unsigned long addr, unsigned long addr_only) 671{ 672 int ret; 673 674 ret = security_ops->file_mmap(file, reqprot, prot, flags, addr, addr_only); 675 if (ret) 676 return ret; 677 return ima_file_mmap(file, prot); 678} 679 680int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, 681 unsigned long prot) 682{ 683 return security_ops->file_mprotect(vma, reqprot, prot); 684} 685 686int security_file_lock(struct file *file, unsigned int cmd) 687{ 688 return security_ops->file_lock(file, cmd); 689} 690 691int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg) 692{ 693 return security_ops->file_fcntl(file, cmd, arg); 694} 695 696int security_file_set_fowner(struct file *file) 697{ 698 return security_ops->file_set_fowner(file); 699} 700 701int security_file_send_sigiotask(struct task_struct *tsk, 702 struct fown_struct *fown, int sig) 703{ 704 return security_ops->file_send_sigiotask(tsk, fown, sig); 705} 706 707int security_file_receive(struct file *file) 708{ 709 return security_ops->file_receive(file); 710} 711 712int security_dentry_open(struct file *file, const struct cred *cred) 713{ 714 return security_ops->dentry_open(file, cred); 715} 716 717int security_task_create(unsigned long clone_flags) 718{ 719 return security_ops->task_create(clone_flags); 720} 721 722int security_cred_alloc_blank(struct cred *cred, gfp_t gfp) 723{ 724 return security_ops->cred_alloc_blank(cred, gfp); 725} 726 727void security_cred_free(struct cred *cred) 728{ 729 security_ops->cred_free(cred); 730} 731 732int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp) 733{ 734 return security_ops->cred_prepare(new, old, gfp); 735} 736 737void security_commit_creds(struct cred *new, const struct cred *old) 738{ 739 security_ops->cred_commit(new, old); 740} 741 742void security_transfer_creds(struct cred *new, const struct cred *old) 743{ 744 security_ops->cred_transfer(new, old); 745} 746 747int security_kernel_act_as(struct cred *new, u32 secid) 748{ 749 return security_ops->kernel_act_as(new, secid); 750} 751 752int security_kernel_create_files_as(struct cred *new, struct inode *inode) 753{ 754 return security_ops->kernel_create_files_as(new, inode); 755} 756 757int security_kernel_module_request(char *kmod_name) 758{ 759 return security_ops->kernel_module_request(kmod_name); 760} 761 762int security_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags) 763{ 764 return security_ops->task_setuid(id0, id1, id2, flags); 765} 766 767int security_task_fix_setuid(struct cred *new, const struct cred *old, 768 int flags) 769{ 770 return security_ops->task_fix_setuid(new, old, flags); 771} 772 773int security_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags) 774{ 775 return security_ops->task_setgid(id0, id1, id2, flags); 776} 777 778int security_task_setpgid(struct task_struct *p, pid_t pgid) 779{ 780 return security_ops->task_setpgid(p, pgid); 781} 782 783int security_task_getpgid(struct task_struct *p) 784{ 785 return security_ops->task_getpgid(p); 786} 787 788int security_task_getsid(struct task_struct *p) 789{ 790 return security_ops->task_getsid(p); 791} 792 793void security_task_getsecid(struct task_struct *p, u32 *secid) 794{ 795 security_ops->task_getsecid(p, secid); 796} 797EXPORT_SYMBOL(security_task_getsecid); 798 799int security_task_setgroups(struct group_info *group_info) 800{ 801 return security_ops->task_setgroups(group_info); 802} 803 804int security_task_setnice(struct task_struct *p, int nice) 805{ 806 return security_ops->task_setnice(p, nice); 807} 808 809int security_task_setioprio(struct task_struct *p, int ioprio) 810{ 811 return security_ops->task_setioprio(p, ioprio); 812} 813 814int security_task_getioprio(struct task_struct *p) 815{ 816 return security_ops->task_getioprio(p); 817} 818 819int security_task_setrlimit(unsigned int resource, struct rlimit *new_rlim) 820{ 821 return security_ops->task_setrlimit(resource, new_rlim); 822} 823 824int security_task_setscheduler(struct task_struct *p, 825 int policy, struct sched_param *lp) 826{ 827 return security_ops->task_setscheduler(p, policy, lp); 828} 829 830int security_task_getscheduler(struct task_struct *p) 831{ 832 return security_ops->task_getscheduler(p); 833} 834 835int security_task_movememory(struct task_struct *p) 836{ 837 return security_ops->task_movememory(p); 838} 839 840int security_task_kill(struct task_struct *p, struct siginfo *info, 841 int sig, u32 secid) 842{ 843 return security_ops->task_kill(p, info, sig, secid); 844} 845 846int security_task_wait(struct task_struct *p) 847{ 848 return security_ops->task_wait(p); 849} 850 851int security_task_prctl(int option, unsigned long arg2, unsigned long arg3, 852 unsigned long arg4, unsigned long arg5) 853{ 854 return security_ops->task_prctl(option, arg2, arg3, arg4, arg5); 855} 856 857void security_task_to_inode(struct task_struct *p, struct inode *inode) 858{ 859 security_ops->task_to_inode(p, inode); 860} 861 862int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag) 863{ 864 return security_ops->ipc_permission(ipcp, flag); 865} 866 867void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid) 868{ 869 security_ops->ipc_getsecid(ipcp, secid); 870} 871 872int security_msg_msg_alloc(struct msg_msg *msg) 873{ 874 return security_ops->msg_msg_alloc_security(msg); 875} 876 877void security_msg_msg_free(struct msg_msg *msg) 878{ 879 security_ops->msg_msg_free_security(msg); 880} 881 882int security_msg_queue_alloc(struct msg_queue *msq) 883{ 884 return security_ops->msg_queue_alloc_security(msq); 885} 886 887void security_msg_queue_free(struct msg_queue *msq) 888{ 889 security_ops->msg_queue_free_security(msq); 890} 891 892int security_msg_queue_associate(struct msg_queue *msq, int msqflg) 893{ 894 return security_ops->msg_queue_associate(msq, msqflg); 895} 896 897int security_msg_queue_msgctl(struct msg_queue *msq, int cmd) 898{ 899 return security_ops->msg_queue_msgctl(msq, cmd); 900} 901 902int security_msg_queue_msgsnd(struct msg_queue *msq, 903 struct msg_msg *msg, int msqflg) 904{ 905 return security_ops->msg_queue_msgsnd(msq, msg, msqflg); 906} 907 908int security_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg, 909 struct task_struct *target, long type, int mode) 910{ 911 return security_ops->msg_queue_msgrcv(msq, msg, target, type, mode); 912} 913 914int security_shm_alloc(struct shmid_kernel *shp) 915{ 916 return security_ops->shm_alloc_security(shp); 917} 918 919void security_shm_free(struct shmid_kernel *shp) 920{ 921 security_ops->shm_free_security(shp); 922} 923 924int security_shm_associate(struct shmid_kernel *shp, int shmflg) 925{ 926 return security_ops->shm_associate(shp, shmflg); 927} 928 929int security_shm_shmctl(struct shmid_kernel *shp, int cmd) 930{ 931 return security_ops->shm_shmctl(shp, cmd); 932} 933 934int security_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, int shmflg) 935{ 936 return security_ops->shm_shmat(shp, shmaddr, shmflg); 937} 938 939int security_sem_alloc(struct sem_array *sma) 940{ 941 return security_ops->sem_alloc_security(sma); 942} 943 944void security_sem_free(struct sem_array *sma) 945{ 946 security_ops->sem_free_security(sma); 947} 948 949int security_sem_associate(struct sem_array *sma, int semflg) 950{ 951 return security_ops->sem_associate(sma, semflg); 952} 953 954int security_sem_semctl(struct sem_array *sma, int cmd) 955{ 956 return security_ops->sem_semctl(sma, cmd); 957} 958 959int security_sem_semop(struct sem_array *sma, struct sembuf *sops, 960 unsigned nsops, int alter) 961{ 962 return security_ops->sem_semop(sma, sops, nsops, alter); 963} 964 965void security_d_instantiate(struct dentry *dentry, struct inode *inode) 966{ 967 if (unlikely(inode && IS_PRIVATE(inode))) 968 return; 969 security_ops->d_instantiate(dentry, inode); 970} 971EXPORT_SYMBOL(security_d_instantiate); 972 973int security_getprocattr(struct task_struct *p, char *name, char **value) 974{ 975 return security_ops->getprocattr(p, name, value); 976} 977 978int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size) 979{ 980 return security_ops->setprocattr(p, name, value, size); 981} 982 983int security_netlink_send(struct sock *sk, struct sk_buff *skb) 984{ 985 return security_ops->netlink_send(sk, skb); 986} 987 988int security_netlink_recv(struct sk_buff *skb, int cap) 989{ 990 return security_ops->netlink_recv(skb, cap); 991} 992EXPORT_SYMBOL(security_netlink_recv); 993 994int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) 995{ 996 return security_ops->secid_to_secctx(secid, secdata, seclen); 997} 998EXPORT_SYMBOL(security_secid_to_secctx); 999 1000int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) 1001{ 1002 return security_ops->secctx_to_secid(secdata, seclen, secid); 1003} 1004EXPORT_SYMBOL(security_secctx_to_secid); 1005 1006void security_release_secctx(char *secdata, u32 seclen) 1007{ 1008 security_ops->release_secctx(secdata, seclen); 1009} 1010EXPORT_SYMBOL(security_release_secctx); 1011 1012int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen) 1013{ 1014 return security_ops->inode_notifysecctx(inode, ctx, ctxlen); 1015} 1016EXPORT_SYMBOL(security_inode_notifysecctx); 1017 1018int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) 1019{ 1020 return security_ops->inode_setsecctx(dentry, ctx, ctxlen); 1021} 1022EXPORT_SYMBOL(security_inode_setsecctx); 1023 1024int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) 1025{ 1026 return security_ops->inode_getsecctx(inode, ctx, ctxlen); 1027} 1028EXPORT_SYMBOL(security_inode_getsecctx); 1029 1030#ifdef CONFIG_SECURITY_NETWORK 1031 1032int security_unix_stream_connect(struct socket *sock, struct socket *other, 1033 struct sock *newsk) 1034{ 1035 return security_ops->unix_stream_connect(sock, other, newsk); 1036} 1037EXPORT_SYMBOL(security_unix_stream_connect); 1038 1039int security_unix_may_send(struct socket *sock, struct socket *other) 1040{ 1041 return security_ops->unix_may_send(sock, other); 1042} 1043EXPORT_SYMBOL(security_unix_may_send); 1044 1045int security_socket_create(int family, int type, int protocol, int kern) 1046{ 1047 return security_ops->socket_create(family, type, protocol, kern); 1048} 1049 1050int security_socket_post_create(struct socket *sock, int family, 1051 int type, int protocol, int kern) 1052{ 1053 return security_ops->socket_post_create(sock, family, type, 1054 protocol, kern); 1055} 1056 1057int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen) 1058{ 1059 return security_ops->socket_bind(sock, address, addrlen); 1060} 1061 1062int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen) 1063{ 1064 return security_ops->socket_connect(sock, address, addrlen); 1065} 1066 1067int security_socket_listen(struct socket *sock, int backlog) 1068{ 1069 return security_ops->socket_listen(sock, backlog); 1070} 1071 1072int security_socket_accept(struct socket *sock, struct socket *newsock) 1073{ 1074 return security_ops->socket_accept(sock, newsock); 1075} 1076 1077int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size) 1078{ 1079 return security_ops->socket_sendmsg(sock, msg, size); 1080} 1081 1082int security_socket_recvmsg(struct socket *sock, struct msghdr *msg, 1083 int size, int flags) 1084{ 1085 return security_ops->socket_recvmsg(sock, msg, size, flags); 1086} 1087 1088int security_socket_getsockname(struct socket *sock) 1089{ 1090 return security_ops->socket_getsockname(sock); 1091} 1092 1093int security_socket_getpeername(struct socket *sock) 1094{ 1095 return security_ops->socket_getpeername(sock); 1096} 1097 1098int security_socket_getsockopt(struct socket *sock, int level, int optname) 1099{ 1100 return security_ops->socket_getsockopt(sock, level, optname); 1101} 1102 1103int security_socket_setsockopt(struct socket *sock, int level, int optname) 1104{ 1105 return security_ops->socket_setsockopt(sock, level, optname); 1106} 1107 1108int security_socket_shutdown(struct socket *sock, int how) 1109{ 1110 return security_ops->socket_shutdown(sock, how); 1111} 1112 1113int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) 1114{ 1115 return security_ops->socket_sock_rcv_skb(sk, skb); 1116} 1117EXPORT_SYMBOL(security_sock_rcv_skb); 1118 1119int security_socket_getpeersec_stream(struct socket *sock, char __user *optval, 1120 int __user *optlen, unsigned len) 1121{ 1122 return security_ops->socket_getpeersec_stream(sock, optval, optlen, len); 1123} 1124 1125int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid) 1126{ 1127 return security_ops->socket_getpeersec_dgram(sock, skb, secid); 1128} 1129EXPORT_SYMBOL(security_socket_getpeersec_dgram); 1130 1131int security_sk_alloc(struct sock *sk, int family, gfp_t priority) 1132{ 1133 return security_ops->sk_alloc_security(sk, family, priority); 1134} 1135 1136void security_sk_free(struct sock *sk) 1137{ 1138 security_ops->sk_free_security(sk); 1139} 1140 1141void security_sk_clone(const struct sock *sk, struct sock *newsk) 1142{ 1143 security_ops->sk_clone_security(sk, newsk); 1144} 1145 1146void security_sk_classify_flow(struct sock *sk, struct flowi *fl) 1147{ 1148 security_ops->sk_getsecid(sk, &fl->secid); 1149} 1150EXPORT_SYMBOL(security_sk_classify_flow); 1151 1152void security_req_classify_flow(const struct request_sock *req, struct flowi *fl) 1153{ 1154 security_ops->req_classify_flow(req, fl); 1155} 1156EXPORT_SYMBOL(security_req_classify_flow); 1157 1158void security_sock_graft(struct sock *sk, struct socket *parent) 1159{ 1160 security_ops->sock_graft(sk, parent); 1161} 1162EXPORT_SYMBOL(security_sock_graft); 1163 1164int security_inet_conn_request(struct sock *sk, 1165 struct sk_buff *skb, struct request_sock *req) 1166{ 1167 return security_ops->inet_conn_request(sk, skb, req); 1168} 1169EXPORT_SYMBOL(security_inet_conn_request); 1170 1171void security_inet_csk_clone(struct sock *newsk, 1172 const struct request_sock *req) 1173{ 1174 security_ops->inet_csk_clone(newsk, req); 1175} 1176 1177void security_inet_conn_established(struct sock *sk, 1178 struct sk_buff *skb) 1179{ 1180 security_ops->inet_conn_established(sk, skb); 1181} 1182 1183int security_tun_dev_create(void) 1184{ 1185 return security_ops->tun_dev_create(); 1186} 1187EXPORT_SYMBOL(security_tun_dev_create); 1188 1189void security_tun_dev_post_create(struct sock *sk) 1190{ 1191 return security_ops->tun_dev_post_create(sk); 1192} 1193EXPORT_SYMBOL(security_tun_dev_post_create); 1194 1195int security_tun_dev_attach(struct sock *sk) 1196{ 1197 return security_ops->tun_dev_attach(sk); 1198} 1199EXPORT_SYMBOL(security_tun_dev_attach); 1200 1201#endif /* CONFIG_SECURITY_NETWORK */ 1202 1203#ifdef CONFIG_SECURITY_NETWORK_XFRM 1204 1205int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx) 1206{ 1207 return security_ops->xfrm_policy_alloc_security(ctxp, sec_ctx); 1208} 1209EXPORT_SYMBOL(security_xfrm_policy_alloc); 1210 1211int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, 1212 struct xfrm_sec_ctx **new_ctxp) 1213{ 1214 return security_ops->xfrm_policy_clone_security(old_ctx, new_ctxp); 1215} 1216 1217void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx) 1218{ 1219 security_ops->xfrm_policy_free_security(ctx); 1220} 1221EXPORT_SYMBOL(security_xfrm_policy_free); 1222 1223int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx) 1224{ 1225 return security_ops->xfrm_policy_delete_security(ctx); 1226} 1227 1228int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx) 1229{ 1230 return security_ops->xfrm_state_alloc_security(x, sec_ctx, 0); 1231} 1232EXPORT_SYMBOL(security_xfrm_state_alloc); 1233 1234int security_xfrm_state_alloc_acquire(struct xfrm_state *x, 1235 struct xfrm_sec_ctx *polsec, u32 secid) 1236{ 1237 if (!polsec) 1238 return 0; 1239 /* 1240 * We want the context to be taken from secid which is usually 1241 * from the sock. 1242 */ 1243 return security_ops->xfrm_state_alloc_security(x, NULL, secid); 1244} 1245 1246int security_xfrm_state_delete(struct xfrm_state *x) 1247{ 1248 return security_ops->xfrm_state_delete_security(x); 1249} 1250EXPORT_SYMBOL(security_xfrm_state_delete); 1251 1252void security_xfrm_state_free(struct xfrm_state *x) 1253{ 1254 security_ops->xfrm_state_free_security(x); 1255} 1256 1257int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir) 1258{ 1259 return security_ops->xfrm_policy_lookup(ctx, fl_secid, dir); 1260} 1261 1262int security_xfrm_state_pol_flow_match(struct xfrm_state *x, 1263 struct xfrm_policy *xp, struct flowi *fl) 1264{ 1265 return security_ops->xfrm_state_pol_flow_match(x, xp, fl); 1266} 1267 1268int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid) 1269{ 1270 return security_ops->xfrm_decode_session(skb, secid, 1); 1271} 1272 1273void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl) 1274{ 1275 int rc = security_ops->xfrm_decode_session(skb, &fl->secid, 0); 1276 1277 BUG_ON(rc); 1278} 1279EXPORT_SYMBOL(security_skb_classify_flow); 1280 1281#endif /* CONFIG_SECURITY_NETWORK_XFRM */ 1282 1283#ifdef CONFIG_KEYS 1284 1285int security_key_alloc(struct key *key, const struct cred *cred, 1286 unsigned long flags) 1287{ 1288 return security_ops->key_alloc(key, cred, flags); 1289} 1290 1291void security_key_free(struct key *key) 1292{ 1293 security_ops->key_free(key); 1294} 1295 1296int security_key_permission(key_ref_t key_ref, 1297 const struct cred *cred, key_perm_t perm) 1298{ 1299 return security_ops->key_permission(key_ref, cred, perm); 1300} 1301 1302int security_key_getsecurity(struct key *key, char **_buffer) 1303{ 1304 return security_ops->key_getsecurity(key, _buffer); 1305} 1306 1307int security_key_session_to_parent(const struct cred *cred, 1308 const struct cred *parent_cred, 1309 struct key *key) 1310{ 1311 return security_ops->key_session_to_parent(cred, parent_cred, key); 1312} 1313 1314#endif /* CONFIG_KEYS */ 1315 1316#ifdef CONFIG_AUDIT 1317 1318int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule) 1319{ 1320 return security_ops->audit_rule_init(field, op, rulestr, lsmrule); 1321} 1322 1323int security_audit_rule_known(struct audit_krule *krule) 1324{ 1325 return security_ops->audit_rule_known(krule); 1326} 1327 1328void security_audit_rule_free(void *lsmrule) 1329{ 1330 security_ops->audit_rule_free(lsmrule); 1331} 1332 1333int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule, 1334 struct audit_context *actx) 1335{ 1336 return security_ops->audit_rule_match(secid, field, op, lsmrule, actx); 1337} 1338 1339#endif /* CONFIG_AUDIT */ 1340