security.c revision 649f6e7718891fe7691e5084ce3fa623acba3129
1/* 2 * Security plug functions 3 * 4 * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com> 5 * Copyright (C) 2001-2002 Greg Kroah-Hartman <greg@kroah.com> 6 * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com> 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 */ 13 14#include <linux/capability.h> 15#include <linux/dcache.h> 16#include <linux/module.h> 17#include <linux/init.h> 18#include <linux/kernel.h> 19#include <linux/security.h> 20#include <linux/integrity.h> 21#include <linux/ima.h> 22#include <linux/evm.h> 23#include <linux/fsnotify.h> 24#include <linux/mman.h> 25#include <linux/mount.h> 26#include <linux/personality.h> 27#include <linux/backing-dev.h> 28#include <net/flow.h> 29 30#define MAX_LSM_EVM_XATTR 2 31 32/* Boot-time LSM user choice */ 33static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] = 34 CONFIG_DEFAULT_SECURITY; 35 36static struct security_operations *security_ops; 37static struct security_operations default_security_ops = { 38 .name = "default", 39}; 40 41static inline int __init verify(struct security_operations *ops) 42{ 43 /* verify the security_operations structure exists */ 44 if (!ops) 45 return -EINVAL; 46 security_fixup_ops(ops); 47 return 0; 48} 49 50static void __init do_security_initcalls(void) 51{ 52 initcall_t *call; 53 call = __security_initcall_start; 54 while (call < __security_initcall_end) { 55 (*call) (); 56 call++; 57 } 58} 59 60/** 61 * security_init - initializes the security framework 62 * 63 * This should be called early in the kernel initialization sequence. 64 */ 65int __init security_init(void) 66{ 67 printk(KERN_INFO "Security Framework initialized\n"); 68 69 security_fixup_ops(&default_security_ops); 70 security_ops = &default_security_ops; 71 do_security_initcalls(); 72 73 return 0; 74} 75 76void reset_security_ops(void) 77{ 78 security_ops = &default_security_ops; 79} 80 81/* Save user chosen LSM */ 82static int __init choose_lsm(char *str) 83{ 84 strncpy(chosen_lsm, str, SECURITY_NAME_MAX); 85 return 1; 86} 87__setup("security=", choose_lsm); 88 89/** 90 * security_module_enable - Load given security module on boot ? 91 * @ops: a pointer to the struct security_operations that is to be checked. 92 * 93 * Each LSM must pass this method before registering its own operations 94 * to avoid security registration races. This method may also be used 95 * to check if your LSM is currently loaded during kernel initialization. 96 * 97 * Return true if: 98 * -The passed LSM is the one chosen by user at boot time, 99 * -or the passed LSM is configured as the default and the user did not 100 * choose an alternate LSM at boot time. 101 * Otherwise, return false. 102 */ 103int __init security_module_enable(struct security_operations *ops) 104{ 105 return !strcmp(ops->name, chosen_lsm); 106} 107 108/** 109 * register_security - registers a security framework with the kernel 110 * @ops: a pointer to the struct security_options that is to be registered 111 * 112 * This function allows a security module to register itself with the 113 * kernel security subsystem. Some rudimentary checking is done on the @ops 114 * value passed to this function. You'll need to check first if your LSM 115 * is allowed to register its @ops by calling security_module_enable(@ops). 116 * 117 * If there is already a security module registered with the kernel, 118 * an error will be returned. Otherwise %0 is returned on success. 119 */ 120int __init register_security(struct security_operations *ops) 121{ 122 if (verify(ops)) { 123 printk(KERN_DEBUG "%s could not verify " 124 "security_operations structure.\n", __func__); 125 return -EINVAL; 126 } 127 128 if (security_ops != &default_security_ops) 129 return -EAGAIN; 130 131 security_ops = ops; 132 133 return 0; 134} 135 136/* Security operations */ 137 138int security_ptrace_access_check(struct task_struct *child, unsigned int mode) 139{ 140#ifdef CONFIG_SECURITY_YAMA_STACKED 141 int rc; 142 rc = yama_ptrace_access_check(child, mode); 143 if (rc) 144 return rc; 145#endif 146 return security_ops->ptrace_access_check(child, mode); 147} 148 149int security_ptrace_traceme(struct task_struct *parent) 150{ 151#ifdef CONFIG_SECURITY_YAMA_STACKED 152 int rc; 153 rc = yama_ptrace_traceme(parent); 154 if (rc) 155 return rc; 156#endif 157 return security_ops->ptrace_traceme(parent); 158} 159 160int security_capget(struct task_struct *target, 161 kernel_cap_t *effective, 162 kernel_cap_t *inheritable, 163 kernel_cap_t *permitted) 164{ 165 return security_ops->capget(target, effective, inheritable, permitted); 166} 167 168int security_capset(struct cred *new, const struct cred *old, 169 const kernel_cap_t *effective, 170 const kernel_cap_t *inheritable, 171 const kernel_cap_t *permitted) 172{ 173 return security_ops->capset(new, old, 174 effective, inheritable, permitted); 175} 176 177int security_capable(const struct cred *cred, struct user_namespace *ns, 178 int cap) 179{ 180 return security_ops->capable(cred, ns, cap, SECURITY_CAP_AUDIT); 181} 182 183int security_capable_noaudit(const struct cred *cred, struct user_namespace *ns, 184 int cap) 185{ 186 return security_ops->capable(cred, ns, cap, SECURITY_CAP_NOAUDIT); 187} 188 189int security_quotactl(int cmds, int type, int id, struct super_block *sb) 190{ 191 return security_ops->quotactl(cmds, type, id, sb); 192} 193 194int security_quota_on(struct dentry *dentry) 195{ 196 return security_ops->quota_on(dentry); 197} 198 199int security_syslog(int type) 200{ 201 return security_ops->syslog(type); 202} 203 204int security_settime(const struct timespec *ts, const struct timezone *tz) 205{ 206 return security_ops->settime(ts, tz); 207} 208 209int security_vm_enough_memory_mm(struct mm_struct *mm, long pages) 210{ 211 return security_ops->vm_enough_memory(mm, pages); 212} 213 214int security_bprm_set_creds(struct linux_binprm *bprm) 215{ 216 return security_ops->bprm_set_creds(bprm); 217} 218 219int security_bprm_check(struct linux_binprm *bprm) 220{ 221 int ret; 222 223 ret = security_ops->bprm_check_security(bprm); 224 if (ret) 225 return ret; 226 return ima_bprm_check(bprm); 227} 228 229void security_bprm_committing_creds(struct linux_binprm *bprm) 230{ 231 security_ops->bprm_committing_creds(bprm); 232} 233 234void security_bprm_committed_creds(struct linux_binprm *bprm) 235{ 236 security_ops->bprm_committed_creds(bprm); 237} 238 239int security_bprm_secureexec(struct linux_binprm *bprm) 240{ 241 return security_ops->bprm_secureexec(bprm); 242} 243 244int security_sb_alloc(struct super_block *sb) 245{ 246 return security_ops->sb_alloc_security(sb); 247} 248 249void security_sb_free(struct super_block *sb) 250{ 251 security_ops->sb_free_security(sb); 252} 253 254int security_sb_copy_data(char *orig, char *copy) 255{ 256 return security_ops->sb_copy_data(orig, copy); 257} 258EXPORT_SYMBOL(security_sb_copy_data); 259 260int security_sb_remount(struct super_block *sb, void *data) 261{ 262 return security_ops->sb_remount(sb, data); 263} 264 265int security_sb_kern_mount(struct super_block *sb, int flags, void *data) 266{ 267 return security_ops->sb_kern_mount(sb, flags, data); 268} 269 270int security_sb_show_options(struct seq_file *m, struct super_block *sb) 271{ 272 return security_ops->sb_show_options(m, sb); 273} 274 275int security_sb_statfs(struct dentry *dentry) 276{ 277 return security_ops->sb_statfs(dentry); 278} 279 280int security_sb_mount(const char *dev_name, struct path *path, 281 const char *type, unsigned long flags, void *data) 282{ 283 return security_ops->sb_mount(dev_name, path, type, flags, data); 284} 285 286int security_sb_umount(struct vfsmount *mnt, int flags) 287{ 288 return security_ops->sb_umount(mnt, flags); 289} 290 291int security_sb_pivotroot(struct path *old_path, struct path *new_path) 292{ 293 return security_ops->sb_pivotroot(old_path, new_path); 294} 295 296int security_sb_set_mnt_opts(struct super_block *sb, 297 struct security_mnt_opts *opts, 298 unsigned long kern_flags, 299 unsigned long *set_kern_flags) 300{ 301 return security_ops->sb_set_mnt_opts(sb, opts, kern_flags, 302 set_kern_flags); 303} 304EXPORT_SYMBOL(security_sb_set_mnt_opts); 305 306int security_sb_clone_mnt_opts(const struct super_block *oldsb, 307 struct super_block *newsb) 308{ 309 return security_ops->sb_clone_mnt_opts(oldsb, newsb); 310} 311EXPORT_SYMBOL(security_sb_clone_mnt_opts); 312 313int security_sb_parse_opts_str(char *options, struct security_mnt_opts *opts) 314{ 315 return security_ops->sb_parse_opts_str(options, opts); 316} 317EXPORT_SYMBOL(security_sb_parse_opts_str); 318 319int security_inode_alloc(struct inode *inode) 320{ 321 inode->i_security = NULL; 322 return security_ops->inode_alloc_security(inode); 323} 324 325void security_inode_free(struct inode *inode) 326{ 327 integrity_inode_free(inode); 328 security_ops->inode_free_security(inode); 329} 330 331int security_dentry_init_security(struct dentry *dentry, int mode, 332 struct qstr *name, void **ctx, 333 u32 *ctxlen) 334{ 335 return security_ops->dentry_init_security(dentry, mode, name, 336 ctx, ctxlen); 337} 338EXPORT_SYMBOL(security_dentry_init_security); 339 340int security_inode_init_security(struct inode *inode, struct inode *dir, 341 const struct qstr *qstr, 342 const initxattrs initxattrs, void *fs_data) 343{ 344 struct xattr new_xattrs[MAX_LSM_EVM_XATTR + 1]; 345 struct xattr *lsm_xattr, *evm_xattr, *xattr; 346 int ret; 347 348 if (unlikely(IS_PRIVATE(inode))) 349 return 0; 350 351 memset(new_xattrs, 0, sizeof new_xattrs); 352 if (!initxattrs) 353 return security_ops->inode_init_security(inode, dir, qstr, 354 NULL, NULL, NULL); 355 lsm_xattr = new_xattrs; 356 ret = security_ops->inode_init_security(inode, dir, qstr, 357 &lsm_xattr->name, 358 &lsm_xattr->value, 359 &lsm_xattr->value_len); 360 if (ret) 361 goto out; 362 363 evm_xattr = lsm_xattr + 1; 364 ret = evm_inode_init_security(inode, lsm_xattr, evm_xattr); 365 if (ret) 366 goto out; 367 ret = initxattrs(inode, new_xattrs, fs_data); 368out: 369 for (xattr = new_xattrs; xattr->name != NULL; xattr++) { 370 kfree(xattr->name); 371 kfree(xattr->value); 372 } 373 return (ret == -EOPNOTSUPP) ? 0 : ret; 374} 375EXPORT_SYMBOL(security_inode_init_security); 376 377int security_old_inode_init_security(struct inode *inode, struct inode *dir, 378 const struct qstr *qstr, char **name, 379 void **value, size_t *len) 380{ 381 if (unlikely(IS_PRIVATE(inode))) 382 return -EOPNOTSUPP; 383 return security_ops->inode_init_security(inode, dir, qstr, name, value, 384 len); 385} 386EXPORT_SYMBOL(security_old_inode_init_security); 387 388#ifdef CONFIG_SECURITY_PATH 389int security_path_mknod(struct path *dir, struct dentry *dentry, umode_t mode, 390 unsigned int dev) 391{ 392 if (unlikely(IS_PRIVATE(dir->dentry->d_inode))) 393 return 0; 394 return security_ops->path_mknod(dir, dentry, mode, dev); 395} 396EXPORT_SYMBOL(security_path_mknod); 397 398int security_path_mkdir(struct path *dir, struct dentry *dentry, umode_t mode) 399{ 400 if (unlikely(IS_PRIVATE(dir->dentry->d_inode))) 401 return 0; 402 return security_ops->path_mkdir(dir, dentry, mode); 403} 404EXPORT_SYMBOL(security_path_mkdir); 405 406int security_path_rmdir(struct path *dir, struct dentry *dentry) 407{ 408 if (unlikely(IS_PRIVATE(dir->dentry->d_inode))) 409 return 0; 410 return security_ops->path_rmdir(dir, dentry); 411} 412 413int security_path_unlink(struct path *dir, struct dentry *dentry) 414{ 415 if (unlikely(IS_PRIVATE(dir->dentry->d_inode))) 416 return 0; 417 return security_ops->path_unlink(dir, dentry); 418} 419EXPORT_SYMBOL(security_path_unlink); 420 421int security_path_symlink(struct path *dir, struct dentry *dentry, 422 const char *old_name) 423{ 424 if (unlikely(IS_PRIVATE(dir->dentry->d_inode))) 425 return 0; 426 return security_ops->path_symlink(dir, dentry, old_name); 427} 428 429int security_path_link(struct dentry *old_dentry, struct path *new_dir, 430 struct dentry *new_dentry) 431{ 432 if (unlikely(IS_PRIVATE(old_dentry->d_inode))) 433 return 0; 434 return security_ops->path_link(old_dentry, new_dir, new_dentry); 435} 436 437int security_path_rename(struct path *old_dir, struct dentry *old_dentry, 438 struct path *new_dir, struct dentry *new_dentry) 439{ 440 if (unlikely(IS_PRIVATE(old_dentry->d_inode) || 441 (new_dentry->d_inode && IS_PRIVATE(new_dentry->d_inode)))) 442 return 0; 443 return security_ops->path_rename(old_dir, old_dentry, new_dir, 444 new_dentry); 445} 446EXPORT_SYMBOL(security_path_rename); 447 448int security_path_truncate(struct path *path) 449{ 450 if (unlikely(IS_PRIVATE(path->dentry->d_inode))) 451 return 0; 452 return security_ops->path_truncate(path); 453} 454 455int security_path_chmod(struct path *path, umode_t mode) 456{ 457 if (unlikely(IS_PRIVATE(path->dentry->d_inode))) 458 return 0; 459 return security_ops->path_chmod(path, mode); 460} 461 462int security_path_chown(struct path *path, kuid_t uid, kgid_t gid) 463{ 464 if (unlikely(IS_PRIVATE(path->dentry->d_inode))) 465 return 0; 466 return security_ops->path_chown(path, uid, gid); 467} 468 469int security_path_chroot(struct path *path) 470{ 471 return security_ops->path_chroot(path); 472} 473#endif 474 475int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode) 476{ 477 if (unlikely(IS_PRIVATE(dir))) 478 return 0; 479 return security_ops->inode_create(dir, dentry, mode); 480} 481EXPORT_SYMBOL_GPL(security_inode_create); 482 483int security_inode_link(struct dentry *old_dentry, struct inode *dir, 484 struct dentry *new_dentry) 485{ 486 if (unlikely(IS_PRIVATE(old_dentry->d_inode))) 487 return 0; 488 return security_ops->inode_link(old_dentry, dir, new_dentry); 489} 490 491int security_inode_unlink(struct inode *dir, struct dentry *dentry) 492{ 493 if (unlikely(IS_PRIVATE(dentry->d_inode))) 494 return 0; 495 return security_ops->inode_unlink(dir, dentry); 496} 497 498int security_inode_symlink(struct inode *dir, struct dentry *dentry, 499 const char *old_name) 500{ 501 if (unlikely(IS_PRIVATE(dir))) 502 return 0; 503 return security_ops->inode_symlink(dir, dentry, old_name); 504} 505 506int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) 507{ 508 if (unlikely(IS_PRIVATE(dir))) 509 return 0; 510 return security_ops->inode_mkdir(dir, dentry, mode); 511} 512EXPORT_SYMBOL_GPL(security_inode_mkdir); 513 514int security_inode_rmdir(struct inode *dir, struct dentry *dentry) 515{ 516 if (unlikely(IS_PRIVATE(dentry->d_inode))) 517 return 0; 518 return security_ops->inode_rmdir(dir, dentry); 519} 520 521int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) 522{ 523 if (unlikely(IS_PRIVATE(dir))) 524 return 0; 525 return security_ops->inode_mknod(dir, dentry, mode, dev); 526} 527 528int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry, 529 struct inode *new_dir, struct dentry *new_dentry) 530{ 531 if (unlikely(IS_PRIVATE(old_dentry->d_inode) || 532 (new_dentry->d_inode && IS_PRIVATE(new_dentry->d_inode)))) 533 return 0; 534 return security_ops->inode_rename(old_dir, old_dentry, 535 new_dir, new_dentry); 536} 537 538int security_inode_readlink(struct dentry *dentry) 539{ 540 if (unlikely(IS_PRIVATE(dentry->d_inode))) 541 return 0; 542 return security_ops->inode_readlink(dentry); 543} 544 545int security_inode_follow_link(struct dentry *dentry, struct nameidata *nd) 546{ 547 if (unlikely(IS_PRIVATE(dentry->d_inode))) 548 return 0; 549 return security_ops->inode_follow_link(dentry, nd); 550} 551 552int security_inode_permission(struct inode *inode, int mask) 553{ 554 if (unlikely(IS_PRIVATE(inode))) 555 return 0; 556 return security_ops->inode_permission(inode, mask); 557} 558 559int security_inode_setattr(struct dentry *dentry, struct iattr *attr) 560{ 561 int ret; 562 563 if (unlikely(IS_PRIVATE(dentry->d_inode))) 564 return 0; 565 ret = security_ops->inode_setattr(dentry, attr); 566 if (ret) 567 return ret; 568 return evm_inode_setattr(dentry, attr); 569} 570EXPORT_SYMBOL_GPL(security_inode_setattr); 571 572int security_inode_getattr(struct vfsmount *mnt, struct dentry *dentry) 573{ 574 if (unlikely(IS_PRIVATE(dentry->d_inode))) 575 return 0; 576 return security_ops->inode_getattr(mnt, dentry); 577} 578 579int security_inode_setxattr(struct dentry *dentry, const char *name, 580 const void *value, size_t size, int flags) 581{ 582 int ret; 583 584 if (unlikely(IS_PRIVATE(dentry->d_inode))) 585 return 0; 586 ret = security_ops->inode_setxattr(dentry, name, value, size, flags); 587 if (ret) 588 return ret; 589 ret = ima_inode_setxattr(dentry, name, value, size); 590 if (ret) 591 return ret; 592 return evm_inode_setxattr(dentry, name, value, size); 593} 594 595void security_inode_post_setxattr(struct dentry *dentry, const char *name, 596 const void *value, size_t size, int flags) 597{ 598 if (unlikely(IS_PRIVATE(dentry->d_inode))) 599 return; 600 security_ops->inode_post_setxattr(dentry, name, value, size, flags); 601 evm_inode_post_setxattr(dentry, name, value, size); 602} 603 604int security_inode_getxattr(struct dentry *dentry, const char *name) 605{ 606 if (unlikely(IS_PRIVATE(dentry->d_inode))) 607 return 0; 608 return security_ops->inode_getxattr(dentry, name); 609} 610 611int security_inode_listxattr(struct dentry *dentry) 612{ 613 if (unlikely(IS_PRIVATE(dentry->d_inode))) 614 return 0; 615 return security_ops->inode_listxattr(dentry); 616} 617 618int security_inode_removexattr(struct dentry *dentry, const char *name) 619{ 620 int ret; 621 622 if (unlikely(IS_PRIVATE(dentry->d_inode))) 623 return 0; 624 ret = security_ops->inode_removexattr(dentry, name); 625 if (ret) 626 return ret; 627 ret = ima_inode_removexattr(dentry, name); 628 if (ret) 629 return ret; 630 return evm_inode_removexattr(dentry, name); 631} 632 633int security_inode_need_killpriv(struct dentry *dentry) 634{ 635 return security_ops->inode_need_killpriv(dentry); 636} 637 638int security_inode_killpriv(struct dentry *dentry) 639{ 640 return security_ops->inode_killpriv(dentry); 641} 642 643int security_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc) 644{ 645 if (unlikely(IS_PRIVATE(inode))) 646 return -EOPNOTSUPP; 647 return security_ops->inode_getsecurity(inode, name, buffer, alloc); 648} 649 650int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags) 651{ 652 if (unlikely(IS_PRIVATE(inode))) 653 return -EOPNOTSUPP; 654 return security_ops->inode_setsecurity(inode, name, value, size, flags); 655} 656 657int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size) 658{ 659 if (unlikely(IS_PRIVATE(inode))) 660 return 0; 661 return security_ops->inode_listsecurity(inode, buffer, buffer_size); 662} 663 664void security_inode_getsecid(const struct inode *inode, u32 *secid) 665{ 666 security_ops->inode_getsecid(inode, secid); 667} 668 669int security_file_permission(struct file *file, int mask) 670{ 671 int ret; 672 673 ret = security_ops->file_permission(file, mask); 674 if (ret) 675 return ret; 676 677 return fsnotify_perm(file, mask); 678} 679 680int security_file_alloc(struct file *file) 681{ 682 return security_ops->file_alloc_security(file); 683} 684 685void security_file_free(struct file *file) 686{ 687 security_ops->file_free_security(file); 688} 689 690int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 691{ 692 return security_ops->file_ioctl(file, cmd, arg); 693} 694 695static inline unsigned long mmap_prot(struct file *file, unsigned long prot) 696{ 697 /* 698 * Does we have PROT_READ and does the application expect 699 * it to imply PROT_EXEC? If not, nothing to talk about... 700 */ 701 if ((prot & (PROT_READ | PROT_EXEC)) != PROT_READ) 702 return prot; 703 if (!(current->personality & READ_IMPLIES_EXEC)) 704 return prot; 705 /* 706 * if that's an anonymous mapping, let it. 707 */ 708 if (!file) 709 return prot | PROT_EXEC; 710 /* 711 * ditto if it's not on noexec mount, except that on !MMU we need 712 * BDI_CAP_EXEC_MMAP (== VM_MAYEXEC) in this case 713 */ 714 if (!(file->f_path.mnt->mnt_flags & MNT_NOEXEC)) { 715#ifndef CONFIG_MMU 716 unsigned long caps = 0; 717 struct address_space *mapping = file->f_mapping; 718 if (mapping && mapping->backing_dev_info) 719 caps = mapping->backing_dev_info->capabilities; 720 if (!(caps & BDI_CAP_EXEC_MAP)) 721 return prot; 722#endif 723 return prot | PROT_EXEC; 724 } 725 /* anything on noexec mount won't get PROT_EXEC */ 726 return prot; 727} 728 729int security_mmap_file(struct file *file, unsigned long prot, 730 unsigned long flags) 731{ 732 int ret; 733 ret = security_ops->mmap_file(file, prot, 734 mmap_prot(file, prot), flags); 735 if (ret) 736 return ret; 737 return ima_file_mmap(file, prot); 738} 739 740int security_mmap_addr(unsigned long addr) 741{ 742 return security_ops->mmap_addr(addr); 743} 744 745int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, 746 unsigned long prot) 747{ 748 return security_ops->file_mprotect(vma, reqprot, prot); 749} 750 751int security_file_lock(struct file *file, unsigned int cmd) 752{ 753 return security_ops->file_lock(file, cmd); 754} 755 756int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg) 757{ 758 return security_ops->file_fcntl(file, cmd, arg); 759} 760 761int security_file_set_fowner(struct file *file) 762{ 763 return security_ops->file_set_fowner(file); 764} 765 766int security_file_send_sigiotask(struct task_struct *tsk, 767 struct fown_struct *fown, int sig) 768{ 769 return security_ops->file_send_sigiotask(tsk, fown, sig); 770} 771 772int security_file_receive(struct file *file) 773{ 774 return security_ops->file_receive(file); 775} 776 777int security_file_open(struct file *file, const struct cred *cred) 778{ 779 int ret; 780 781 ret = security_ops->file_open(file, cred); 782 if (ret) 783 return ret; 784 785 return fsnotify_perm(file, MAY_OPEN); 786} 787 788int security_task_create(unsigned long clone_flags) 789{ 790 return security_ops->task_create(clone_flags); 791} 792 793void security_task_free(struct task_struct *task) 794{ 795#ifdef CONFIG_SECURITY_YAMA_STACKED 796 yama_task_free(task); 797#endif 798 security_ops->task_free(task); 799} 800 801int security_cred_alloc_blank(struct cred *cred, gfp_t gfp) 802{ 803 return security_ops->cred_alloc_blank(cred, gfp); 804} 805 806void security_cred_free(struct cred *cred) 807{ 808 security_ops->cred_free(cred); 809} 810 811int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp) 812{ 813 return security_ops->cred_prepare(new, old, gfp); 814} 815 816void security_transfer_creds(struct cred *new, const struct cred *old) 817{ 818 security_ops->cred_transfer(new, old); 819} 820 821int security_kernel_act_as(struct cred *new, u32 secid) 822{ 823 return security_ops->kernel_act_as(new, secid); 824} 825 826int security_kernel_create_files_as(struct cred *new, struct inode *inode) 827{ 828 return security_ops->kernel_create_files_as(new, inode); 829} 830 831int security_kernel_module_request(char *kmod_name) 832{ 833 return security_ops->kernel_module_request(kmod_name); 834} 835 836int security_kernel_module_from_file(struct file *file) 837{ 838 int ret; 839 840 ret = security_ops->kernel_module_from_file(file); 841 if (ret) 842 return ret; 843 return ima_module_check(file); 844} 845 846int security_task_fix_setuid(struct cred *new, const struct cred *old, 847 int flags) 848{ 849 return security_ops->task_fix_setuid(new, old, flags); 850} 851 852int security_task_setpgid(struct task_struct *p, pid_t pgid) 853{ 854 return security_ops->task_setpgid(p, pgid); 855} 856 857int security_task_getpgid(struct task_struct *p) 858{ 859 return security_ops->task_getpgid(p); 860} 861 862int security_task_getsid(struct task_struct *p) 863{ 864 return security_ops->task_getsid(p); 865} 866 867void security_task_getsecid(struct task_struct *p, u32 *secid) 868{ 869 security_ops->task_getsecid(p, secid); 870} 871EXPORT_SYMBOL(security_task_getsecid); 872 873int security_task_setnice(struct task_struct *p, int nice) 874{ 875 return security_ops->task_setnice(p, nice); 876} 877 878int security_task_setioprio(struct task_struct *p, int ioprio) 879{ 880 return security_ops->task_setioprio(p, ioprio); 881} 882 883int security_task_getioprio(struct task_struct *p) 884{ 885 return security_ops->task_getioprio(p); 886} 887 888int security_task_setrlimit(struct task_struct *p, unsigned int resource, 889 struct rlimit *new_rlim) 890{ 891 return security_ops->task_setrlimit(p, resource, new_rlim); 892} 893 894int security_task_setscheduler(struct task_struct *p) 895{ 896 return security_ops->task_setscheduler(p); 897} 898 899int security_task_getscheduler(struct task_struct *p) 900{ 901 return security_ops->task_getscheduler(p); 902} 903 904int security_task_movememory(struct task_struct *p) 905{ 906 return security_ops->task_movememory(p); 907} 908 909int security_task_kill(struct task_struct *p, struct siginfo *info, 910 int sig, u32 secid) 911{ 912 return security_ops->task_kill(p, info, sig, secid); 913} 914 915int security_task_wait(struct task_struct *p) 916{ 917 return security_ops->task_wait(p); 918} 919 920int security_task_prctl(int option, unsigned long arg2, unsigned long arg3, 921 unsigned long arg4, unsigned long arg5) 922{ 923#ifdef CONFIG_SECURITY_YAMA_STACKED 924 int rc; 925 rc = yama_task_prctl(option, arg2, arg3, arg4, arg5); 926 if (rc != -ENOSYS) 927 return rc; 928#endif 929 return security_ops->task_prctl(option, arg2, arg3, arg4, arg5); 930} 931 932void security_task_to_inode(struct task_struct *p, struct inode *inode) 933{ 934 security_ops->task_to_inode(p, inode); 935} 936 937int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag) 938{ 939 return security_ops->ipc_permission(ipcp, flag); 940} 941 942void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid) 943{ 944 security_ops->ipc_getsecid(ipcp, secid); 945} 946 947int security_msg_msg_alloc(struct msg_msg *msg) 948{ 949 return security_ops->msg_msg_alloc_security(msg); 950} 951 952void security_msg_msg_free(struct msg_msg *msg) 953{ 954 security_ops->msg_msg_free_security(msg); 955} 956 957int security_msg_queue_alloc(struct msg_queue *msq) 958{ 959 return security_ops->msg_queue_alloc_security(msq); 960} 961 962void security_msg_queue_free(struct msg_queue *msq) 963{ 964 security_ops->msg_queue_free_security(msq); 965} 966 967int security_msg_queue_associate(struct msg_queue *msq, int msqflg) 968{ 969 return security_ops->msg_queue_associate(msq, msqflg); 970} 971 972int security_msg_queue_msgctl(struct msg_queue *msq, int cmd) 973{ 974 return security_ops->msg_queue_msgctl(msq, cmd); 975} 976 977int security_msg_queue_msgsnd(struct msg_queue *msq, 978 struct msg_msg *msg, int msqflg) 979{ 980 return security_ops->msg_queue_msgsnd(msq, msg, msqflg); 981} 982 983int security_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg, 984 struct task_struct *target, long type, int mode) 985{ 986 return security_ops->msg_queue_msgrcv(msq, msg, target, type, mode); 987} 988 989int security_shm_alloc(struct shmid_kernel *shp) 990{ 991 return security_ops->shm_alloc_security(shp); 992} 993 994void security_shm_free(struct shmid_kernel *shp) 995{ 996 security_ops->shm_free_security(shp); 997} 998 999int security_shm_associate(struct shmid_kernel *shp, int shmflg) 1000{ 1001 return security_ops->shm_associate(shp, shmflg); 1002} 1003 1004int security_shm_shmctl(struct shmid_kernel *shp, int cmd) 1005{ 1006 return security_ops->shm_shmctl(shp, cmd); 1007} 1008 1009int security_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, int shmflg) 1010{ 1011 return security_ops->shm_shmat(shp, shmaddr, shmflg); 1012} 1013 1014int security_sem_alloc(struct sem_array *sma) 1015{ 1016 return security_ops->sem_alloc_security(sma); 1017} 1018 1019void security_sem_free(struct sem_array *sma) 1020{ 1021 security_ops->sem_free_security(sma); 1022} 1023 1024int security_sem_associate(struct sem_array *sma, int semflg) 1025{ 1026 return security_ops->sem_associate(sma, semflg); 1027} 1028 1029int security_sem_semctl(struct sem_array *sma, int cmd) 1030{ 1031 return security_ops->sem_semctl(sma, cmd); 1032} 1033 1034int security_sem_semop(struct sem_array *sma, struct sembuf *sops, 1035 unsigned nsops, int alter) 1036{ 1037 return security_ops->sem_semop(sma, sops, nsops, alter); 1038} 1039 1040void security_d_instantiate(struct dentry *dentry, struct inode *inode) 1041{ 1042 if (unlikely(inode && IS_PRIVATE(inode))) 1043 return; 1044 security_ops->d_instantiate(dentry, inode); 1045} 1046EXPORT_SYMBOL(security_d_instantiate); 1047 1048int security_getprocattr(struct task_struct *p, char *name, char **value) 1049{ 1050 return security_ops->getprocattr(p, name, value); 1051} 1052 1053int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size) 1054{ 1055 return security_ops->setprocattr(p, name, value, size); 1056} 1057 1058int security_netlink_send(struct sock *sk, struct sk_buff *skb) 1059{ 1060 return security_ops->netlink_send(sk, skb); 1061} 1062 1063int security_ismaclabel(const char *name) 1064{ 1065 return security_ops->ismaclabel(name); 1066} 1067EXPORT_SYMBOL(security_ismaclabel); 1068 1069int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) 1070{ 1071 return security_ops->secid_to_secctx(secid, secdata, seclen); 1072} 1073EXPORT_SYMBOL(security_secid_to_secctx); 1074 1075int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) 1076{ 1077 return security_ops->secctx_to_secid(secdata, seclen, secid); 1078} 1079EXPORT_SYMBOL(security_secctx_to_secid); 1080 1081void security_release_secctx(char *secdata, u32 seclen) 1082{ 1083 security_ops->release_secctx(secdata, seclen); 1084} 1085EXPORT_SYMBOL(security_release_secctx); 1086 1087int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen) 1088{ 1089 return security_ops->inode_notifysecctx(inode, ctx, ctxlen); 1090} 1091EXPORT_SYMBOL(security_inode_notifysecctx); 1092 1093int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) 1094{ 1095 return security_ops->inode_setsecctx(dentry, ctx, ctxlen); 1096} 1097EXPORT_SYMBOL(security_inode_setsecctx); 1098 1099int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) 1100{ 1101 return security_ops->inode_getsecctx(inode, ctx, ctxlen); 1102} 1103EXPORT_SYMBOL(security_inode_getsecctx); 1104 1105#ifdef CONFIG_SECURITY_NETWORK 1106 1107int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk) 1108{ 1109 return security_ops->unix_stream_connect(sock, other, newsk); 1110} 1111EXPORT_SYMBOL(security_unix_stream_connect); 1112 1113int security_unix_may_send(struct socket *sock, struct socket *other) 1114{ 1115 return security_ops->unix_may_send(sock, other); 1116} 1117EXPORT_SYMBOL(security_unix_may_send); 1118 1119int security_socket_create(int family, int type, int protocol, int kern) 1120{ 1121 return security_ops->socket_create(family, type, protocol, kern); 1122} 1123 1124int security_socket_post_create(struct socket *sock, int family, 1125 int type, int protocol, int kern) 1126{ 1127 return security_ops->socket_post_create(sock, family, type, 1128 protocol, kern); 1129} 1130 1131int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen) 1132{ 1133 return security_ops->socket_bind(sock, address, addrlen); 1134} 1135 1136int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen) 1137{ 1138 return security_ops->socket_connect(sock, address, addrlen); 1139} 1140 1141int security_socket_listen(struct socket *sock, int backlog) 1142{ 1143 return security_ops->socket_listen(sock, backlog); 1144} 1145 1146int security_socket_accept(struct socket *sock, struct socket *newsock) 1147{ 1148 return security_ops->socket_accept(sock, newsock); 1149} 1150 1151int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size) 1152{ 1153 return security_ops->socket_sendmsg(sock, msg, size); 1154} 1155 1156int security_socket_recvmsg(struct socket *sock, struct msghdr *msg, 1157 int size, int flags) 1158{ 1159 return security_ops->socket_recvmsg(sock, msg, size, flags); 1160} 1161 1162int security_socket_getsockname(struct socket *sock) 1163{ 1164 return security_ops->socket_getsockname(sock); 1165} 1166 1167int security_socket_getpeername(struct socket *sock) 1168{ 1169 return security_ops->socket_getpeername(sock); 1170} 1171 1172int security_socket_getsockopt(struct socket *sock, int level, int optname) 1173{ 1174 return security_ops->socket_getsockopt(sock, level, optname); 1175} 1176 1177int security_socket_setsockopt(struct socket *sock, int level, int optname) 1178{ 1179 return security_ops->socket_setsockopt(sock, level, optname); 1180} 1181 1182int security_socket_shutdown(struct socket *sock, int how) 1183{ 1184 return security_ops->socket_shutdown(sock, how); 1185} 1186 1187int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) 1188{ 1189 return security_ops->socket_sock_rcv_skb(sk, skb); 1190} 1191EXPORT_SYMBOL(security_sock_rcv_skb); 1192 1193int security_socket_getpeersec_stream(struct socket *sock, char __user *optval, 1194 int __user *optlen, unsigned len) 1195{ 1196 return security_ops->socket_getpeersec_stream(sock, optval, optlen, len); 1197} 1198 1199int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid) 1200{ 1201 return security_ops->socket_getpeersec_dgram(sock, skb, secid); 1202} 1203EXPORT_SYMBOL(security_socket_getpeersec_dgram); 1204 1205int security_sk_alloc(struct sock *sk, int family, gfp_t priority) 1206{ 1207 return security_ops->sk_alloc_security(sk, family, priority); 1208} 1209 1210void security_sk_free(struct sock *sk) 1211{ 1212 security_ops->sk_free_security(sk); 1213} 1214 1215void security_sk_clone(const struct sock *sk, struct sock *newsk) 1216{ 1217 security_ops->sk_clone_security(sk, newsk); 1218} 1219EXPORT_SYMBOL(security_sk_clone); 1220 1221void security_sk_classify_flow(struct sock *sk, struct flowi *fl) 1222{ 1223 security_ops->sk_getsecid(sk, &fl->flowi_secid); 1224} 1225EXPORT_SYMBOL(security_sk_classify_flow); 1226 1227void security_req_classify_flow(const struct request_sock *req, struct flowi *fl) 1228{ 1229 security_ops->req_classify_flow(req, fl); 1230} 1231EXPORT_SYMBOL(security_req_classify_flow); 1232 1233void security_sock_graft(struct sock *sk, struct socket *parent) 1234{ 1235 security_ops->sock_graft(sk, parent); 1236} 1237EXPORT_SYMBOL(security_sock_graft); 1238 1239int security_inet_conn_request(struct sock *sk, 1240 struct sk_buff *skb, struct request_sock *req) 1241{ 1242 return security_ops->inet_conn_request(sk, skb, req); 1243} 1244EXPORT_SYMBOL(security_inet_conn_request); 1245 1246void security_inet_csk_clone(struct sock *newsk, 1247 const struct request_sock *req) 1248{ 1249 security_ops->inet_csk_clone(newsk, req); 1250} 1251 1252void security_inet_conn_established(struct sock *sk, 1253 struct sk_buff *skb) 1254{ 1255 security_ops->inet_conn_established(sk, skb); 1256} 1257 1258int security_secmark_relabel_packet(u32 secid) 1259{ 1260 return security_ops->secmark_relabel_packet(secid); 1261} 1262EXPORT_SYMBOL(security_secmark_relabel_packet); 1263 1264void security_secmark_refcount_inc(void) 1265{ 1266 security_ops->secmark_refcount_inc(); 1267} 1268EXPORT_SYMBOL(security_secmark_refcount_inc); 1269 1270void security_secmark_refcount_dec(void) 1271{ 1272 security_ops->secmark_refcount_dec(); 1273} 1274EXPORT_SYMBOL(security_secmark_refcount_dec); 1275 1276int security_tun_dev_alloc_security(void **security) 1277{ 1278 return security_ops->tun_dev_alloc_security(security); 1279} 1280EXPORT_SYMBOL(security_tun_dev_alloc_security); 1281 1282void security_tun_dev_free_security(void *security) 1283{ 1284 security_ops->tun_dev_free_security(security); 1285} 1286EXPORT_SYMBOL(security_tun_dev_free_security); 1287 1288int security_tun_dev_create(void) 1289{ 1290 return security_ops->tun_dev_create(); 1291} 1292EXPORT_SYMBOL(security_tun_dev_create); 1293 1294int security_tun_dev_attach_queue(void *security) 1295{ 1296 return security_ops->tun_dev_attach_queue(security); 1297} 1298EXPORT_SYMBOL(security_tun_dev_attach_queue); 1299 1300int security_tun_dev_attach(struct sock *sk, void *security) 1301{ 1302 return security_ops->tun_dev_attach(sk, security); 1303} 1304EXPORT_SYMBOL(security_tun_dev_attach); 1305 1306int security_tun_dev_open(void *security) 1307{ 1308 return security_ops->tun_dev_open(security); 1309} 1310EXPORT_SYMBOL(security_tun_dev_open); 1311 1312void security_skb_owned_by(struct sk_buff *skb, struct sock *sk) 1313{ 1314 security_ops->skb_owned_by(skb, sk); 1315} 1316 1317#endif /* CONFIG_SECURITY_NETWORK */ 1318 1319#ifdef CONFIG_SECURITY_NETWORK_XFRM 1320 1321int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx) 1322{ 1323 return security_ops->xfrm_policy_alloc_security(ctxp, sec_ctx); 1324} 1325EXPORT_SYMBOL(security_xfrm_policy_alloc); 1326 1327int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, 1328 struct xfrm_sec_ctx **new_ctxp) 1329{ 1330 return security_ops->xfrm_policy_clone_security(old_ctx, new_ctxp); 1331} 1332 1333void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx) 1334{ 1335 security_ops->xfrm_policy_free_security(ctx); 1336} 1337EXPORT_SYMBOL(security_xfrm_policy_free); 1338 1339int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx) 1340{ 1341 return security_ops->xfrm_policy_delete_security(ctx); 1342} 1343 1344int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx) 1345{ 1346 return security_ops->xfrm_state_alloc_security(x, sec_ctx, 0); 1347} 1348EXPORT_SYMBOL(security_xfrm_state_alloc); 1349 1350int security_xfrm_state_alloc_acquire(struct xfrm_state *x, 1351 struct xfrm_sec_ctx *polsec, u32 secid) 1352{ 1353 if (!polsec) 1354 return 0; 1355 /* 1356 * We want the context to be taken from secid which is usually 1357 * from the sock. 1358 */ 1359 return security_ops->xfrm_state_alloc_security(x, NULL, secid); 1360} 1361 1362int security_xfrm_state_delete(struct xfrm_state *x) 1363{ 1364 return security_ops->xfrm_state_delete_security(x); 1365} 1366EXPORT_SYMBOL(security_xfrm_state_delete); 1367 1368void security_xfrm_state_free(struct xfrm_state *x) 1369{ 1370 security_ops->xfrm_state_free_security(x); 1371} 1372 1373int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir) 1374{ 1375 return security_ops->xfrm_policy_lookup(ctx, fl_secid, dir); 1376} 1377 1378int security_xfrm_state_pol_flow_match(struct xfrm_state *x, 1379 struct xfrm_policy *xp, 1380 const struct flowi *fl) 1381{ 1382 return security_ops->xfrm_state_pol_flow_match(x, xp, fl); 1383} 1384 1385int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid) 1386{ 1387 return security_ops->xfrm_decode_session(skb, secid, 1); 1388} 1389 1390void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl) 1391{ 1392 int rc = security_ops->xfrm_decode_session(skb, &fl->flowi_secid, 0); 1393 1394 BUG_ON(rc); 1395} 1396EXPORT_SYMBOL(security_skb_classify_flow); 1397 1398#endif /* CONFIG_SECURITY_NETWORK_XFRM */ 1399 1400#ifdef CONFIG_KEYS 1401 1402int security_key_alloc(struct key *key, const struct cred *cred, 1403 unsigned long flags) 1404{ 1405 return security_ops->key_alloc(key, cred, flags); 1406} 1407 1408void security_key_free(struct key *key) 1409{ 1410 security_ops->key_free(key); 1411} 1412 1413int security_key_permission(key_ref_t key_ref, 1414 const struct cred *cred, key_perm_t perm) 1415{ 1416 return security_ops->key_permission(key_ref, cred, perm); 1417} 1418 1419int security_key_getsecurity(struct key *key, char **_buffer) 1420{ 1421 return security_ops->key_getsecurity(key, _buffer); 1422} 1423 1424#endif /* CONFIG_KEYS */ 1425 1426#ifdef CONFIG_AUDIT 1427 1428int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule) 1429{ 1430 return security_ops->audit_rule_init(field, op, rulestr, lsmrule); 1431} 1432 1433int security_audit_rule_known(struct audit_krule *krule) 1434{ 1435 return security_ops->audit_rule_known(krule); 1436} 1437 1438void security_audit_rule_free(void *lsmrule) 1439{ 1440 security_ops->audit_rule_free(lsmrule); 1441} 1442 1443int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule, 1444 struct audit_context *actx) 1445{ 1446 return security_ops->audit_rule_match(secid, field, op, lsmrule, actx); 1447} 1448 1449#endif /* CONFIG_AUDIT */ 1450