~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/include/linux/security.h

Version: ~ [ linux-5.13-rc7 ] ~ [ linux-5.12.12 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.45 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.127 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.195 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.237 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.273 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.273 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Linux Security plug
  3  *
  4  * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
  5  * Copyright (C) 2001 Greg Kroah-Hartman <greg@kroah.com>
  6  * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
  7  * Copyright (C) 2001 James Morris <jmorris@intercode.com.au>
  8  * Copyright (C) 2001 Silicon Graphics, Inc. (Trust Technology Group)
  9  * Copyright (C) 2016 Mellanox Techonologies
 10  *
 11  *      This program is free software; you can redistribute it and/or modify
 12  *      it under the terms of the GNU General Public License as published by
 13  *      the Free Software Foundation; either version 2 of the License, or
 14  *      (at your option) any later version.
 15  *
 16  *      Due to this file being licensed under the GPL there is controversy over
 17  *      whether this permits you to write a module that #includes this file
 18  *      without placing your module under the GPL.  Please consult a lawyer for
 19  *      advice before doing this.
 20  *
 21  */
 22 
 23 #ifndef __LINUX_SECURITY_H
 24 #define __LINUX_SECURITY_H
 25 
 26 #include <linux/key.h>
 27 #include <linux/capability.h>
 28 #include <linux/fs.h>
 29 #include <linux/slab.h>
 30 #include <linux/err.h>
 31 #include <linux/string.h>
 32 #include <linux/mm.h>
 33 
 34 struct linux_binprm;
 35 struct cred;
 36 struct rlimit;
 37 struct kernel_siginfo;
 38 struct sembuf;
 39 struct kern_ipc_perm;
 40 struct audit_context;
 41 struct super_block;
 42 struct inode;
 43 struct dentry;
 44 struct file;
 45 struct vfsmount;
 46 struct path;
 47 struct qstr;
 48 struct iattr;
 49 struct fown_struct;
 50 struct file_operations;
 51 struct msg_msg;
 52 struct xattr;
 53 struct kernfs_node;
 54 struct xfrm_sec_ctx;
 55 struct mm_struct;
 56 struct fs_context;
 57 struct fs_parameter;
 58 enum fs_value_type;
 59 struct watch;
 60 struct watch_notification;
 61 #include <linux/ccsecurity.h>
 62 
 63 /* Default (no) options for the capable function */
 64 #define CAP_OPT_NONE 0x0
 65 /* If capable should audit the security request */
 66 #define CAP_OPT_NOAUDIT BIT(1)
 67 /* If capable is being called by a setid function */
 68 #define CAP_OPT_INSETID BIT(2)
 69 
 70 /* LSM Agnostic defines for fs_context::lsm_flags */
 71 #define SECURITY_LSM_NATIVE_LABELS      1
 72 
 73 struct ctl_table;
 74 struct audit_krule;
 75 struct user_namespace;
 76 struct timezone;
 77 
 78 enum lsm_event {
 79         LSM_POLICY_CHANGE,
 80 };
 81 
 82 /*
 83  * These are reasons that can be passed to the security_locked_down()
 84  * LSM hook. Lockdown reasons that protect kernel integrity (ie, the
 85  * ability for userland to modify kernel code) are placed before
 86  * LOCKDOWN_INTEGRITY_MAX.  Lockdown reasons that protect kernel
 87  * confidentiality (ie, the ability for userland to extract
 88  * information from the running kernel that would otherwise be
 89  * restricted) are placed before LOCKDOWN_CONFIDENTIALITY_MAX.
 90  *
 91  * LSM authors should note that the semantics of any given lockdown
 92  * reason are not guaranteed to be stable - the same reason may block
 93  * one set of features in one kernel release, and a slightly different
 94  * set of features in a later kernel release. LSMs that seek to expose
 95  * lockdown policy at any level of granularity other than "none",
 96  * "integrity" or "confidentiality" are responsible for either
 97  * ensuring that they expose a consistent level of functionality to
 98  * userland, or ensuring that userland is aware that this is
 99  * potentially a moving target. It is easy to misuse this information
100  * in a way that could break userspace. Please be careful not to do
101  * so.
102  *
103  * If you add to this, remember to extend lockdown_reasons in
104  * security/lockdown/lockdown.c.
105  */
106 enum lockdown_reason {
107         LOCKDOWN_NONE,
108         LOCKDOWN_MODULE_SIGNATURE,
109         LOCKDOWN_DEV_MEM,
110         LOCKDOWN_EFI_TEST,
111         LOCKDOWN_KEXEC,
112         LOCKDOWN_HIBERNATION,
113         LOCKDOWN_PCI_ACCESS,
114         LOCKDOWN_IOPORT,
115         LOCKDOWN_MSR,
116         LOCKDOWN_ACPI_TABLES,
117         LOCKDOWN_PCMCIA_CIS,
118         LOCKDOWN_TIOCSSERIAL,
119         LOCKDOWN_MODULE_PARAMETERS,
120         LOCKDOWN_MMIOTRACE,
121         LOCKDOWN_DEBUGFS,
122         LOCKDOWN_XMON_WR,
123         LOCKDOWN_INTEGRITY_MAX,
124         LOCKDOWN_KCORE,
125         LOCKDOWN_KPROBES,
126         LOCKDOWN_BPF_READ,
127         LOCKDOWN_PERF,
128         LOCKDOWN_TRACEFS,
129         LOCKDOWN_XMON_RW,
130         LOCKDOWN_CONFIDENTIALITY_MAX,
131 };
132 
133 extern const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1];
134 
135 /* These functions are in security/commoncap.c */
136 extern int cap_capable(const struct cred *cred, struct user_namespace *ns,
137                        int cap, unsigned int opts);
138 extern int cap_settime(const struct timespec64 *ts, const struct timezone *tz);
139 extern int cap_ptrace_access_check(struct task_struct *child, unsigned int mode);
140 extern int cap_ptrace_traceme(struct task_struct *parent);
141 extern int cap_capget(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
142 extern int cap_capset(struct cred *new, const struct cred *old,
143                       const kernel_cap_t *effective,
144                       const kernel_cap_t *inheritable,
145                       const kernel_cap_t *permitted);
146 extern int cap_bprm_creds_from_file(struct linux_binprm *bprm, struct file *file);
147 extern int cap_inode_setxattr(struct dentry *dentry, const char *name,
148                               const void *value, size_t size, int flags);
149 extern int cap_inode_removexattr(struct dentry *dentry, const char *name);
150 extern int cap_inode_need_killpriv(struct dentry *dentry);
151 extern int cap_inode_killpriv(struct dentry *dentry);
152 extern int cap_inode_getsecurity(struct inode *inode, const char *name,
153                                  void **buffer, bool alloc);
154 extern int cap_mmap_addr(unsigned long addr);
155 extern int cap_mmap_file(struct file *file, unsigned long reqprot,
156                          unsigned long prot, unsigned long flags);
157 extern int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags);
158 extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
159                           unsigned long arg4, unsigned long arg5);
160 extern int cap_task_setscheduler(struct task_struct *p);
161 extern int cap_task_setioprio(struct task_struct *p, int ioprio);
162 extern int cap_task_setnice(struct task_struct *p, int nice);
163 extern int cap_vm_enough_memory(struct mm_struct *mm, long pages);
164 
165 struct msghdr;
166 struct sk_buff;
167 struct sock;
168 struct sockaddr;
169 struct socket;
170 struct flowi;
171 struct dst_entry;
172 struct xfrm_selector;
173 struct xfrm_policy;
174 struct xfrm_state;
175 struct xfrm_user_sec_ctx;
176 struct seq_file;
177 struct sctp_endpoint;
178 
179 #ifdef CONFIG_MMU
180 extern unsigned long mmap_min_addr;
181 extern unsigned long dac_mmap_min_addr;
182 #else
183 #define mmap_min_addr           0UL
184 #define dac_mmap_min_addr       0UL
185 #endif
186 
187 /*
188  * Values used in the task_security_ops calls
189  */
190 /* setuid or setgid, id0 == uid or gid */
191 #define LSM_SETID_ID    1
192 
193 /* setreuid or setregid, id0 == real, id1 == eff */
194 #define LSM_SETID_RE    2
195 
196 /* setresuid or setresgid, id0 == real, id1 == eff, uid2 == saved */
197 #define LSM_SETID_RES   4
198 
199 /* setfsuid or setfsgid, id0 == fsuid or fsgid */
200 #define LSM_SETID_FS    8
201 
202 /* Flags for security_task_prlimit(). */
203 #define LSM_PRLIMIT_READ  1
204 #define LSM_PRLIMIT_WRITE 2
205 
206 /* forward declares to avoid warnings */
207 struct sched_param;
208 struct request_sock;
209 
210 /* bprm->unsafe reasons */
211 #define LSM_UNSAFE_SHARE        1
212 #define LSM_UNSAFE_PTRACE       2
213 #define LSM_UNSAFE_NO_NEW_PRIVS 4
214 
215 #ifdef CONFIG_MMU
216 extern int mmap_min_addr_handler(struct ctl_table *table, int write,
217                                  void *buffer, size_t *lenp, loff_t *ppos);
218 #endif
219 
220 /* security_inode_init_security callback function to write xattrs */
221 typedef int (*initxattrs) (struct inode *inode,
222                            const struct xattr *xattr_array, void *fs_data);
223 
224 
225 /* Keep the kernel_load_data_id enum in sync with kernel_read_file_id */
226 #define __data_id_enumify(ENUM, dummy) LOADING_ ## ENUM,
227 #define __data_id_stringify(dummy, str) #str,
228 
229 enum kernel_load_data_id {
230         __kernel_read_file_id(__data_id_enumify)
231 };
232 
233 static const char * const kernel_load_data_str[] = {
234         __kernel_read_file_id(__data_id_stringify)
235 };
236 
237 static inline const char *kernel_load_data_id_str(enum kernel_load_data_id id)
238 {
239         if ((unsigned)id >= LOADING_MAX_ID)
240                 return kernel_load_data_str[LOADING_UNKNOWN];
241 
242         return kernel_load_data_str[id];
243 }
244 
245 #ifdef CONFIG_SECURITY
246 
247 int call_blocking_lsm_notifier(enum lsm_event event, void *data);
248 int register_blocking_lsm_notifier(struct notifier_block *nb);
249 int unregister_blocking_lsm_notifier(struct notifier_block *nb);
250 
251 /* prototypes */
252 extern int security_init(void);
253 extern int early_security_init(void);
254 
255 /* Security operations */
256 int security_binder_set_context_mgr(struct task_struct *mgr);
257 int security_binder_transaction(struct task_struct *from,
258                                 struct task_struct *to);
259 int security_binder_transfer_binder(struct task_struct *from,
260                                     struct task_struct *to);
261 int security_binder_transfer_file(struct task_struct *from,
262                                   struct task_struct *to, struct file *file);
263 int security_ptrace_access_check(struct task_struct *child, unsigned int mode);
264 int security_ptrace_traceme(struct task_struct *parent);
265 int security_capget(struct task_struct *target,
266                     kernel_cap_t *effective,
267                     kernel_cap_t *inheritable,
268                     kernel_cap_t *permitted);
269 int security_capset(struct cred *new, const struct cred *old,
270                     const kernel_cap_t *effective,
271                     const kernel_cap_t *inheritable,
272                     const kernel_cap_t *permitted);
273 int security_capable(const struct cred *cred,
274                        struct user_namespace *ns,
275                        int cap,
276                        unsigned int opts);
277 int security_quotactl(int cmds, int type, int id, struct super_block *sb);
278 int security_quota_on(struct dentry *dentry);
279 int security_syslog(int type);
280 int security_settime64(const struct timespec64 *ts, const struct timezone *tz);
281 int security_vm_enough_memory_mm(struct mm_struct *mm, long pages);
282 int security_bprm_creds_for_exec(struct linux_binprm *bprm);
283 int security_bprm_creds_from_file(struct linux_binprm *bprm, struct file *file);
284 int security_bprm_check(struct linux_binprm *bprm);
285 void security_bprm_committing_creds(struct linux_binprm *bprm);
286 void security_bprm_committed_creds(struct linux_binprm *bprm);
287 int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc);
288 int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param);
289 int security_sb_alloc(struct super_block *sb);
290 void security_sb_free(struct super_block *sb);
291 void security_free_mnt_opts(void **mnt_opts);
292 int security_sb_eat_lsm_opts(char *options, void **mnt_opts);
293 int security_sb_remount(struct super_block *sb, void *mnt_opts);
294 int security_sb_kern_mount(struct super_block *sb);
295 int security_sb_show_options(struct seq_file *m, struct super_block *sb);
296 int security_sb_statfs(struct dentry *dentry);
297 int security_sb_mount(const char *dev_name, const struct path *path,
298                       const char *type, unsigned long flags, void *data);
299 int security_sb_umount(struct vfsmount *mnt, int flags);
300 int security_sb_pivotroot(const struct path *old_path, const struct path *new_path);
301 int security_sb_set_mnt_opts(struct super_block *sb,
302                                 void *mnt_opts,
303                                 unsigned long kern_flags,
304                                 unsigned long *set_kern_flags);
305 int security_sb_clone_mnt_opts(const struct super_block *oldsb,
306                                 struct super_block *newsb,
307                                 unsigned long kern_flags,
308                                 unsigned long *set_kern_flags);
309 int security_add_mnt_opt(const char *option, const char *val,
310                                 int len, void **mnt_opts);
311 int security_move_mount(const struct path *from_path, const struct path *to_path);
312 int security_dentry_init_security(struct dentry *dentry, int mode,
313                                         const struct qstr *name, void **ctx,
314                                         u32 *ctxlen);
315 int security_dentry_create_files_as(struct dentry *dentry, int mode,
316                                         struct qstr *name,
317                                         const struct cred *old,
318                                         struct cred *new);
319 int security_path_notify(const struct path *path, u64 mask,
320                                         unsigned int obj_type);
321 int security_inode_alloc(struct inode *inode);
322 void security_inode_free(struct inode *inode);
323 int security_inode_init_security(struct inode *inode, struct inode *dir,
324                                  const struct qstr *qstr,
325                                  initxattrs initxattrs, void *fs_data);
326 int security_old_inode_init_security(struct inode *inode, struct inode *dir,
327                                      const struct qstr *qstr, const char **name,
328                                      void **value, size_t *len);
329 int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode);
330 int security_inode_link(struct dentry *old_dentry, struct inode *dir,
331                          struct dentry *new_dentry);
332 int security_inode_unlink(struct inode *dir, struct dentry *dentry);
333 int security_inode_symlink(struct inode *dir, struct dentry *dentry,
334                            const char *old_name);
335 int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode);
336 int security_inode_rmdir(struct inode *dir, struct dentry *dentry);
337 int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev);
338 int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
339                           struct inode *new_dir, struct dentry *new_dentry,
340                           unsigned int flags);
341 int security_inode_readlink(struct dentry *dentry);
342 int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
343                                bool rcu);
344 int security_inode_permission(struct inode *inode, int mask);
345 int security_inode_setattr(struct dentry *dentry, struct iattr *attr);
346 int security_inode_getattr(const struct path *path);
347 int security_inode_setxattr(struct dentry *dentry, const char *name,
348                             const void *value, size_t size, int flags);
349 void security_inode_post_setxattr(struct dentry *dentry, const char *name,
350                                   const void *value, size_t size, int flags);
351 int security_inode_getxattr(struct dentry *dentry, const char *name);
352 int security_inode_listxattr(struct dentry *dentry);
353 int security_inode_removexattr(struct dentry *dentry, const char *name);
354 int security_inode_need_killpriv(struct dentry *dentry);
355 int security_inode_killpriv(struct dentry *dentry);
356 int security_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc);
357 int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags);
358 int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size);
359 void security_inode_getsecid(struct inode *inode, u32 *secid);
360 int security_inode_copy_up(struct dentry *src, struct cred **new);
361 int security_inode_copy_up_xattr(const char *name);
362 int security_kernfs_init_security(struct kernfs_node *kn_dir,
363                                   struct kernfs_node *kn);
364 int security_file_permission(struct file *file, int mask);
365 int security_file_alloc(struct file *file);
366 void security_file_free(struct file *file);
367 int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
368 int security_mmap_file(struct file *file, unsigned long prot,
369                         unsigned long flags);
370 int security_mmap_addr(unsigned long addr);
371 int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
372                            unsigned long prot);
373 int security_file_lock(struct file *file, unsigned int cmd);
374 int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg);
375 void security_file_set_fowner(struct file *file);
376 int security_file_send_sigiotask(struct task_struct *tsk,
377                                  struct fown_struct *fown, int sig);
378 int security_file_receive(struct file *file);
379 int security_file_open(struct file *file);
380 int security_task_alloc(struct task_struct *task, unsigned long clone_flags);
381 void security_task_free(struct task_struct *task);
382 int security_cred_alloc_blank(struct cred *cred, gfp_t gfp);
383 void security_cred_free(struct cred *cred);
384 int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp);
385 void security_transfer_creds(struct cred *new, const struct cred *old);
386 void security_cred_getsecid(const struct cred *c, u32 *secid);
387 int security_kernel_act_as(struct cred *new, u32 secid);
388 int security_kernel_create_files_as(struct cred *new, struct inode *inode);
389 int security_kernel_module_request(char *kmod_name);
390 int security_kernel_load_data(enum kernel_load_data_id id);
391 int security_kernel_read_file(struct file *file, enum kernel_read_file_id id);
392 int security_kernel_post_read_file(struct file *file, char *buf, loff_t size,
393                                    enum kernel_read_file_id id);
394 int security_task_fix_setuid(struct cred *new, const struct cred *old,
395                              int flags);
396 int security_task_fix_setgid(struct cred *new, const struct cred *old,
397                              int flags);
398 int security_task_setpgid(struct task_struct *p, pid_t pgid);
399 int security_task_getpgid(struct task_struct *p);
400 int security_task_getsid(struct task_struct *p);
401 void security_task_getsecid(struct task_struct *p, u32 *secid);
402 int security_task_setnice(struct task_struct *p, int nice);
403 int security_task_setioprio(struct task_struct *p, int ioprio);
404 int security_task_getioprio(struct task_struct *p);
405 int security_task_prlimit(const struct cred *cred, const struct cred *tcred,
406                           unsigned int flags);
407 int security_task_setrlimit(struct task_struct *p, unsigned int resource,
408                 struct rlimit *new_rlim);
409 int security_task_setscheduler(struct task_struct *p);
410 int security_task_getscheduler(struct task_struct *p);
411 int security_task_movememory(struct task_struct *p);
412 int security_task_kill(struct task_struct *p, struct kernel_siginfo *info,
413                         int sig, const struct cred *cred);
414 int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
415                         unsigned long arg4, unsigned long arg5);
416 void security_task_to_inode(struct task_struct *p, struct inode *inode);
417 int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag);
418 void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid);
419 int security_msg_msg_alloc(struct msg_msg *msg);
420 void security_msg_msg_free(struct msg_msg *msg);
421 int security_msg_queue_alloc(struct kern_ipc_perm *msq);
422 void security_msg_queue_free(struct kern_ipc_perm *msq);
423 int security_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg);
424 int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd);
425 int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
426                               struct msg_msg *msg, int msqflg);
427 int security_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
428                               struct task_struct *target, long type, int mode);
429 int security_shm_alloc(struct kern_ipc_perm *shp);
430 void security_shm_free(struct kern_ipc_perm *shp);
431 int security_shm_associate(struct kern_ipc_perm *shp, int shmflg);
432 int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd);
433 int security_shm_shmat(struct kern_ipc_perm *shp, char __user *shmaddr, int shmflg);
434 int security_sem_alloc(struct kern_ipc_perm *sma);
435 void security_sem_free(struct kern_ipc_perm *sma);
436 int security_sem_associate(struct kern_ipc_perm *sma, int semflg);
437 int security_sem_semctl(struct kern_ipc_perm *sma, int cmd);
438 int security_sem_semop(struct kern_ipc_perm *sma, struct sembuf *sops,
439                         unsigned nsops, int alter);
440 void security_d_instantiate(struct dentry *dentry, struct inode *inode);
441 int security_getprocattr(struct task_struct *p, const char *lsm, char *name,
442                          char **value);
443 int security_setprocattr(const char *lsm, const char *name, void *value,
444                          size_t size);
445 int security_netlink_send(struct sock *sk, struct sk_buff *skb);
446 int security_ismaclabel(const char *name);
447 int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
448 int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
449 void security_release_secctx(char *secdata, u32 seclen);
450 void security_inode_invalidate_secctx(struct inode *inode);
451 int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
452 int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
453 int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen);
454 int security_locked_down(enum lockdown_reason what);
455 #else /* CONFIG_SECURITY */
456 
457 static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data)
458 {
459         return 0;
460 }
461 
462 static inline int register_blocking_lsm_notifier(struct notifier_block *nb)
463 {
464         return 0;
465 }
466 
467 static inline  int unregister_blocking_lsm_notifier(struct notifier_block *nb)
468 {
469         return 0;
470 }
471 
472 static inline void security_free_mnt_opts(void **mnt_opts)
473 {
474 }
475 
476 /*
477  * This is the default capabilities functionality.  Most of these functions
478  * are just stubbed out, but a few must call the proper capable code.
479  */
480 
481 static inline int security_init(void)
482 {
483         return 0;
484 }
485 
486 static inline int early_security_init(void)
487 {
488         return 0;
489 }
490 
491 static inline int security_binder_set_context_mgr(struct task_struct *mgr)
492 {
493         return 0;
494 }
495 
496 static inline int security_binder_transaction(struct task_struct *from,
497                                               struct task_struct *to)
498 {
499         return 0;
500 }
501 
502 static inline int security_binder_transfer_binder(struct task_struct *from,
503                                                   struct task_struct *to)
504 {
505         return 0;
506 }
507 
508 static inline int security_binder_transfer_file(struct task_struct *from,
509                                                 struct task_struct *to,
510                                                 struct file *file)
511 {
512         return 0;
513 }
514 
515 static inline int security_ptrace_access_check(struct task_struct *child,
516                                              unsigned int mode)
517 {
518         return cap_ptrace_access_check(child, mode);
519 }
520 
521 static inline int security_ptrace_traceme(struct task_struct *parent)
522 {
523         return cap_ptrace_traceme(parent);
524 }
525 
526 static inline int security_capget(struct task_struct *target,
527                                    kernel_cap_t *effective,
528                                    kernel_cap_t *inheritable,
529                                    kernel_cap_t *permitted)
530 {
531         return cap_capget(target, effective, inheritable, permitted);
532 }
533 
534 static inline int security_capset(struct cred *new,
535                                    const struct cred *old,
536                                    const kernel_cap_t *effective,
537                                    const kernel_cap_t *inheritable,
538                                    const kernel_cap_t *permitted)
539 {
540         return cap_capset(new, old, effective, inheritable, permitted);
541 }
542 
543 static inline int security_capable(const struct cred *cred,
544                                    struct user_namespace *ns,
545                                    int cap,
546                                    unsigned int opts)
547 {
548         return cap_capable(cred, ns, cap, opts);
549 }
550 
551 static inline int security_quotactl(int cmds, int type, int id,
552                                      struct super_block *sb)
553 {
554         return 0;
555 }
556 
557 static inline int security_quota_on(struct dentry *dentry)
558 {
559         return 0;
560 }
561 
562 static inline int security_syslog(int type)
563 {
564         return 0;
565 }
566 
567 static inline int security_settime64(const struct timespec64 *ts,
568                                      const struct timezone *tz)
569 {
570         int error = cap_settime(ts, tz);
571         if (!error)
572                 error = ccs_settime(ts, tz);
573         return error;
574 }
575 
576 static inline int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
577 {
578         return __vm_enough_memory(mm, pages, cap_vm_enough_memory(mm, pages));
579 }
580 
581 static inline int security_bprm_creds_for_exec(struct linux_binprm *bprm)
582 {
583         return 0;
584 }
585 
586 static inline int security_bprm_creds_from_file(struct linux_binprm *bprm,
587                                                 struct file *file)
588 {
589         return cap_bprm_creds_from_file(bprm, file);
590 }
591 
592 static inline int security_bprm_check(struct linux_binprm *bprm)
593 {
594         return 0;
595 }
596 
597 static inline void security_bprm_committing_creds(struct linux_binprm *bprm)
598 {
599 }
600 
601 static inline void security_bprm_committed_creds(struct linux_binprm *bprm)
602 {
603 }
604 
605 static inline int security_fs_context_dup(struct fs_context *fc,
606                                           struct fs_context *src_fc)
607 {
608         return 0;
609 }
610 static inline int security_fs_context_parse_param(struct fs_context *fc,
611                                                   struct fs_parameter *param)
612 {
613         return -ENOPARAM;
614 }
615 
616 static inline int security_sb_alloc(struct super_block *sb)
617 {
618         return 0;
619 }
620 
621 static inline void security_sb_free(struct super_block *sb)
622 { }
623 
624 static inline int security_sb_eat_lsm_opts(char *options,
625                                            void **mnt_opts)
626 {
627         return 0;
628 }
629 
630 static inline int security_sb_remount(struct super_block *sb,
631                                       void *mnt_opts)
632 {
633         return 0;
634 }
635 
636 static inline int security_sb_kern_mount(struct super_block *sb)
637 {
638         return 0;
639 }
640 
641 static inline int security_sb_show_options(struct seq_file *m,
642                                            struct super_block *sb)
643 {
644         return 0;
645 }
646 
647 static inline int security_sb_statfs(struct dentry *dentry)
648 {
649         return 0;
650 }
651 
652 static inline int security_sb_mount(const char *dev_name, const struct path *path,
653                                     const char *type, unsigned long flags,
654                                     void *data)
655 {
656         return ccs_sb_mount(dev_name, path, type, flags, data);
657 }
658 
659 static inline int security_sb_umount(struct vfsmount *mnt, int flags)
660 {
661         return ccs_sb_umount(mnt, flags);
662 }
663 
664 static inline int security_sb_pivotroot(const struct path *old_path,
665                                         const struct path *new_path)
666 {
667         return ccs_sb_pivotroot(old_path, new_path);
668 }
669 
670 static inline int security_sb_set_mnt_opts(struct super_block *sb,
671                                            void *mnt_opts,
672                                            unsigned long kern_flags,
673                                            unsigned long *set_kern_flags)
674 {
675         return 0;
676 }
677 
678 static inline int security_sb_clone_mnt_opts(const struct super_block *oldsb,
679                                               struct super_block *newsb,
680                                               unsigned long kern_flags,
681                                               unsigned long *set_kern_flags)
682 {
683         return 0;
684 }
685 
686 static inline int security_add_mnt_opt(const char *option, const char *val,
687                                         int len, void **mnt_opts)
688 {
689         return 0;
690 }
691 
692 static inline int security_move_mount(const struct path *from_path,
693                                       const struct path *to_path)
694 {
695         return ccs_move_mount_permission(from_path, to_path);
696 }
697 
698 static inline int security_path_notify(const struct path *path, u64 mask,
699                                 unsigned int obj_type)
700 {
701         return 0;
702 }
703 
704 static inline int security_inode_alloc(struct inode *inode)
705 {
706         return 0;
707 }
708 
709 static inline void security_inode_free(struct inode *inode)
710 { }
711 
712 static inline int security_dentry_init_security(struct dentry *dentry,
713                                                  int mode,
714                                                  const struct qstr *name,
715                                                  void **ctx,
716                                                  u32 *ctxlen)
717 {
718         return -EOPNOTSUPP;
719 }
720 
721 static inline int security_dentry_create_files_as(struct dentry *dentry,
722                                                   int mode, struct qstr *name,
723                                                   const struct cred *old,
724                                                   struct cred *new)
725 {
726         return 0;
727 }
728 
729 
730 static inline int security_inode_init_security(struct inode *inode,
731                                                 struct inode *dir,
732                                                 const struct qstr *qstr,
733                                                 const initxattrs xattrs,
734                                                 void *fs_data)
735 {
736         return 0;
737 }
738 
739 static inline int security_old_inode_init_security(struct inode *inode,
740                                                    struct inode *dir,
741                                                    const struct qstr *qstr,
742                                                    const char **name,
743                                                    void **value, size_t *len)
744 {
745         return -EOPNOTSUPP;
746 }
747 
748 static inline int security_inode_create(struct inode *dir,
749                                          struct dentry *dentry,
750                                          umode_t mode)
751 {
752         return 0;
753 }
754 
755 static inline int security_inode_link(struct dentry *old_dentry,
756                                        struct inode *dir,
757                                        struct dentry *new_dentry)
758 {
759         return 0;
760 }
761 
762 static inline int security_inode_unlink(struct inode *dir,
763                                          struct dentry *dentry)
764 {
765         return 0;
766 }
767 
768 static inline int security_inode_symlink(struct inode *dir,
769                                           struct dentry *dentry,
770                                           const char *old_name)
771 {
772         return 0;
773 }
774 
775 static inline int security_inode_mkdir(struct inode *dir,
776                                         struct dentry *dentry,
777                                         int mode)
778 {
779         return 0;
780 }
781 
782 static inline int security_inode_rmdir(struct inode *dir,
783                                         struct dentry *dentry)
784 {
785         return 0;
786 }
787 
788 static inline int security_inode_mknod(struct inode *dir,
789                                         struct dentry *dentry,
790                                         int mode, dev_t dev)
791 {
792         return 0;
793 }
794 
795 static inline int security_inode_rename(struct inode *old_dir,
796                                          struct dentry *old_dentry,
797                                          struct inode *new_dir,
798                                          struct dentry *new_dentry,
799                                          unsigned int flags)
800 {
801         return 0;
802 }
803 
804 static inline int security_inode_readlink(struct dentry *dentry)
805 {
806         return 0;
807 }
808 
809 static inline int security_inode_follow_link(struct dentry *dentry,
810                                              struct inode *inode,
811                                              bool rcu)
812 {
813         return 0;
814 }
815 
816 static inline int security_inode_permission(struct inode *inode, int mask)
817 {
818         return 0;
819 }
820 
821 static inline int security_inode_setattr(struct dentry *dentry,
822                                           struct iattr *attr)
823 {
824         return 0;
825 }
826 
827 static inline int security_inode_getattr(const struct path *path)
828 {
829         return ccs_inode_getattr(path);
830 }
831 
832 static inline int security_inode_setxattr(struct dentry *dentry,
833                 const char *name, const void *value, size_t size, int flags)
834 {
835         return cap_inode_setxattr(dentry, name, value, size, flags);
836 }
837 
838 static inline void security_inode_post_setxattr(struct dentry *dentry,
839                 const char *name, const void *value, size_t size, int flags)
840 { }
841 
842 static inline int security_inode_getxattr(struct dentry *dentry,
843                         const char *name)
844 {
845         return 0;
846 }
847 
848 static inline int security_inode_listxattr(struct dentry *dentry)
849 {
850         return 0;
851 }
852 
853 static inline int security_inode_removexattr(struct dentry *dentry,
854                         const char *name)
855 {
856         return cap_inode_removexattr(dentry, name);
857 }
858 
859 static inline int security_inode_need_killpriv(struct dentry *dentry)
860 {
861         return cap_inode_need_killpriv(dentry);
862 }
863 
864 static inline int security_inode_killpriv(struct dentry *dentry)
865 {
866         return cap_inode_killpriv(dentry);
867 }
868 
869 static inline int security_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
870 {
871         return -EOPNOTSUPP;
872 }
873 
874 static inline int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
875 {
876         return -EOPNOTSUPP;
877 }
878 
879 static inline int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
880 {
881         return 0;
882 }
883 
884 static inline void security_inode_getsecid(struct inode *inode, u32 *secid)
885 {
886         *secid = 0;
887 }
888 
889 static inline int security_inode_copy_up(struct dentry *src, struct cred **new)
890 {
891         return 0;
892 }
893 
894 static inline int security_kernfs_init_security(struct kernfs_node *kn_dir,
895                                                 struct kernfs_node *kn)
896 {
897         return 0;
898 }
899 
900 static inline int security_inode_copy_up_xattr(const char *name)
901 {
902         return -EOPNOTSUPP;
903 }
904 
905 static inline int security_file_permission(struct file *file, int mask)
906 {
907         return 0;
908 }
909 
910 static inline int security_file_alloc(struct file *file)
911 {
912         return 0;
913 }
914 
915 static inline void security_file_free(struct file *file)
916 { }
917 
918 static inline int security_file_ioctl(struct file *file, unsigned int cmd,
919                                       unsigned long arg)
920 {
921         return ccs_file_ioctl(file, cmd, arg);
922 }
923 
924 static inline int security_mmap_file(struct file *file, unsigned long prot,
925                                      unsigned long flags)
926 {
927         return 0;
928 }
929 
930 static inline int security_mmap_addr(unsigned long addr)
931 {
932         return cap_mmap_addr(addr);
933 }
934 
935 static inline int security_file_mprotect(struct vm_area_struct *vma,
936                                          unsigned long reqprot,
937                                          unsigned long prot)
938 {
939         return 0;
940 }
941 
942 static inline int security_file_lock(struct file *file, unsigned int cmd)
943 {
944         return 0;
945 }
946 
947 static inline int security_file_fcntl(struct file *file, unsigned int cmd,
948                                       unsigned long arg)
949 {
950         return ccs_file_fcntl(file, cmd, arg);
951 }
952 
953 static inline void security_file_set_fowner(struct file *file)
954 {
955         return;
956 }
957 
958 static inline int security_file_send_sigiotask(struct task_struct *tsk,
959                                                struct fown_struct *fown,
960                                                int sig)
961 {
962         return 0;
963 }
964 
965 static inline int security_file_receive(struct file *file)
966 {
967         return 0;
968 }
969 
970 static inline int security_file_open(struct file *file)
971 {
972         return ccs_file_open(file);
973 }
974 
975 static inline int security_task_alloc(struct task_struct *task,
976                                       unsigned long clone_flags)
977 {
978         return ccs_alloc_task_security(task);
979 }
980 
981 static inline void security_task_free(struct task_struct *task)
982 {
983         ccs_free_task_security(task);
984 }
985 
986 static inline int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
987 {
988         return 0;
989 }
990 
991 static inline void security_cred_free(struct cred *cred)
992 { }
993 
994 static inline int security_prepare_creds(struct cred *new,
995                                          const struct cred *old,
996                                          gfp_t gfp)
997 {
998         return 0;
999 }
1000 
1001 static inline void security_transfer_creds(struct cred *new,
1002                                            const struct cred *old)
1003 {
1004 }
1005 
1006 static inline int security_kernel_act_as(struct cred *cred, u32 secid)
1007 {
1008         return 0;
1009 }
1010 
1011 static inline int security_kernel_create_files_as(struct cred *cred,
1012                                                   struct inode *inode)
1013 {
1014         return 0;
1015 }
1016 
1017 static inline int security_kernel_module_request(char *kmod_name)
1018 {
1019         return 0;
1020 }
1021 
1022 static inline int security_kernel_load_data(enum kernel_load_data_id id)
1023 {
1024         return 0;
1025 }
1026 
1027 static inline int security_kernel_read_file(struct file *file,
1028                                             enum kernel_read_file_id id)
1029 {
1030         return 0;
1031 }
1032 
1033 static inline int security_kernel_post_read_file(struct file *file,
1034                                                  char *buf, loff_t size,
1035                                                  enum kernel_read_file_id id)
1036 {
1037         return 0;
1038 }
1039 
1040 static inline int security_task_fix_setuid(struct cred *new,
1041                                            const struct cred *old,
1042                                            int flags)
1043 {
1044         return cap_task_fix_setuid(new, old, flags);
1045 }
1046 
1047 static inline int security_task_fix_setgid(struct cred *new,
1048                                            const struct cred *old,
1049                                            int flags)
1050 {
1051         return 0;
1052 }
1053 
1054 static inline int security_task_setpgid(struct task_struct *p, pid_t pgid)
1055 {
1056         return 0;
1057 }
1058 
1059 static inline int security_task_getpgid(struct task_struct *p)
1060 {
1061         return 0;
1062 }
1063 
1064 static inline int security_task_getsid(struct task_struct *p)
1065 {
1066         return 0;
1067 }
1068 
1069 static inline void security_task_getsecid(struct task_struct *p, u32 *secid)
1070 {
1071         *secid = 0;
1072 }
1073 
1074 static inline int security_task_setnice(struct task_struct *p, int nice)
1075 {
1076         return cap_task_setnice(p, nice);
1077 }
1078 
1079 static inline int security_task_setioprio(struct task_struct *p, int ioprio)
1080 {
1081         return cap_task_setioprio(p, ioprio);
1082 }
1083 
1084 static inline int security_task_getioprio(struct task_struct *p)
1085 {
1086         return 0;
1087 }
1088 
1089 static inline int security_task_prlimit(const struct cred *cred,
1090                                         const struct cred *tcred,
1091                                         unsigned int flags)
1092 {
1093         return 0;
1094 }
1095 
1096 static inline int security_task_setrlimit(struct task_struct *p,
1097                                           unsigned int resource,
1098                                           struct rlimit *new_rlim)
1099 {
1100         return 0;
1101 }
1102 
1103 static inline int security_task_setscheduler(struct task_struct *p)
1104 {
1105         return cap_task_setscheduler(p);
1106 }
1107 
1108 static inline int security_task_getscheduler(struct task_struct *p)
1109 {
1110         return 0;
1111 }
1112 
1113 static inline int security_task_movememory(struct task_struct *p)
1114 {
1115         return 0;
1116 }
1117 
1118 static inline int security_task_kill(struct task_struct *p,
1119                                      struct kernel_siginfo *info, int sig,
1120                                      const struct cred *cred)
1121 {
1122         return 0;
1123 }
1124 
1125 static inline int security_task_prctl(int option, unsigned long arg2,
1126                                       unsigned long arg3,
1127                                       unsigned long arg4,
1128                                       unsigned long arg5)
1129 {
1130         return cap_task_prctl(option, arg2, arg3, arg4, arg5);
1131 }
1132 
1133 static inline void security_task_to_inode(struct task_struct *p, struct inode *inode)
1134 { }
1135 
1136 static inline int security_ipc_permission(struct kern_ipc_perm *ipcp,
1137                                           short flag)
1138 {
1139         return 0;
1140 }
1141 
1142 static inline void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
1143 {
1144         *secid = 0;
1145 }
1146 
1147 static inline int security_msg_msg_alloc(struct msg_msg *msg)
1148 {
1149         return 0;
1150 }
1151 
1152 static inline void security_msg_msg_free(struct msg_msg *msg)
1153 { }
1154 
1155 static inline int security_msg_queue_alloc(struct kern_ipc_perm *msq)
1156 {
1157         return 0;
1158 }
1159 
1160 static inline void security_msg_queue_free(struct kern_ipc_perm *msq)
1161 { }
1162 
1163 static inline int security_msg_queue_associate(struct kern_ipc_perm *msq,
1164                                                int msqflg)
1165 {
1166         return 0;
1167 }
1168 
1169 static inline int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
1170 {
1171         return 0;
1172 }
1173 
1174 static inline int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
1175                                             struct msg_msg *msg, int msqflg)
1176 {
1177         return 0;
1178 }
1179 
1180 static inline int security_msg_queue_msgrcv(struct kern_ipc_perm *msq,
1181                                             struct msg_msg *msg,
1182                                             struct task_struct *target,
1183                                             long type, int mode)
1184 {
1185         return 0;
1186 }
1187 
1188 static inline int security_shm_alloc(struct kern_ipc_perm *shp)
1189 {
1190         return 0;
1191 }
1192 
1193 static inline void security_shm_free(struct kern_ipc_perm *shp)
1194 { }
1195 
1196 static inline int security_shm_associate(struct kern_ipc_perm *shp,
1197                                          int shmflg)
1198 {
1199         return 0;
1200 }
1201 
1202 static inline int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
1203 {
1204         return 0;
1205 }
1206 
1207 static inline int security_shm_shmat(struct kern_ipc_perm *shp,
1208                                      char __user *shmaddr, int shmflg)
1209 {
1210         return 0;
1211 }
1212 
1213 static inline int security_sem_alloc(struct kern_ipc_perm *sma)
1214 {
1215         return 0;
1216 }
1217 
1218 static inline void security_sem_free(struct kern_ipc_perm *sma)
1219 { }
1220 
1221 static inline int security_sem_associate(struct kern_ipc_perm *sma, int semflg)
1222 {
1223         return 0;
1224 }
1225 
1226 static inline int security_sem_semctl(struct kern_ipc_perm *sma, int cmd)
1227 {
1228         return 0;
1229 }
1230 
1231 static inline int security_sem_semop(struct kern_ipc_perm *sma,
1232                                      struct sembuf *sops, unsigned nsops,
1233                                      int alter)
1234 {
1235         return 0;
1236 }
1237 
1238 static inline void security_d_instantiate(struct dentry *dentry,
1239                                           struct inode *inode)
1240 { }
1241 
1242 static inline int security_getprocattr(struct task_struct *p, const char *lsm,
1243                                        char *name, char **value)
1244 {
1245         return -EINVAL;
1246 }
1247 
1248 static inline int security_setprocattr(const char *lsm, char *name,
1249                                        void *value, size_t size)
1250 {
1251         return -EINVAL;
1252 }
1253 
1254 static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb)
1255 {
1256         return 0;
1257 }
1258 
1259 static inline int security_ismaclabel(const char *name)
1260 {
1261         return 0;
1262 }
1263 
1264 static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
1265 {
1266         return -EOPNOTSUPP;
1267 }
1268 
1269 static inline int security_secctx_to_secid(const char *secdata,
1270                                            u32 seclen,
1271                                            u32 *secid)
1272 {
1273         return -EOPNOTSUPP;
1274 }
1275 
1276 static inline void security_release_secctx(char *secdata, u32 seclen)
1277 {
1278 }
1279 
1280 static inline void security_inode_invalidate_secctx(struct inode *inode)
1281 {
1282 }
1283 
1284 static inline int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
1285 {
1286         return -EOPNOTSUPP;
1287 }
1288 static inline int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
1289 {
1290         return -EOPNOTSUPP;
1291 }
1292 static inline int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
1293 {
1294         return -EOPNOTSUPP;
1295 }
1296 static inline int security_locked_down(enum lockdown_reason what)
1297 {
1298         return 0;
1299 }
1300 #endif  /* CONFIG_SECURITY */
1301 
1302 #if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
1303 int security_post_notification(const struct cred *w_cred,
1304                                const struct cred *cred,
1305                                struct watch_notification *n);
1306 #else
1307 static inline int security_post_notification(const struct cred *w_cred,
1308                                              const struct cred *cred,
1309                                              struct watch_notification *n)
1310 {
1311         return 0;
1312 }
1313 #endif
1314 
1315 #if defined(CONFIG_SECURITY) && defined(CONFIG_KEY_NOTIFICATIONS)
1316 int security_watch_key(struct key *key);
1317 #else
1318 static inline int security_watch_key(struct key *key)
1319 {
1320         return 0;
1321 }
1322 #endif
1323 
1324 #ifdef CONFIG_SECURITY_NETWORK
1325 
1326 int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk);
1327 int security_unix_may_send(struct socket *sock,  struct socket *other);
1328 int security_socket_create(int family, int type, int protocol, int kern);
1329 int security_socket_post_create(struct socket *sock, int family,
1330                                 int type, int protocol, int kern);
1331 int security_socket_socketpair(struct socket *socka, struct socket *sockb);
1332 int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen);
1333 int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen);
1334 int security_socket_listen(struct socket *sock, int backlog);
1335 int security_socket_accept(struct socket *sock, struct socket *newsock);
1336 int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size);
1337 int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,
1338                             int size, int flags);
1339 int security_socket_getsockname(struct socket *sock);
1340 int security_socket_getpeername(struct socket *sock);
1341 int security_socket_getsockopt(struct socket *sock, int level, int optname);
1342 int security_socket_setsockopt(struct socket *sock, int level, int optname);
1343 int security_socket_shutdown(struct socket *sock, int how);
1344 int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb);
1345 int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
1346                                       int __user *optlen, unsigned len);
1347 int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid);
1348 int security_sk_alloc(struct sock *sk, int family, gfp_t priority);
1349 void security_sk_free(struct sock *sk);
1350 void security_sk_clone(const struct sock *sk, struct sock *newsk);
1351 void security_sk_classify_flow(struct sock *sk, struct flowi *fl);
1352 void security_req_classify_flow(const struct request_sock *req, struct flowi *fl);
1353 void security_sock_graft(struct sock*sk, struct socket *parent);
1354 int security_inet_conn_request(struct sock *sk,
1355                         struct sk_buff *skb, struct request_sock *req);
1356 void security_inet_csk_clone(struct sock *newsk,
1357                         const struct request_sock *req);
1358 void security_inet_conn_established(struct sock *sk,
1359                         struct sk_buff *skb);
1360 int security_secmark_relabel_packet(u32 secid);
1361 void security_secmark_refcount_inc(void);
1362 void security_secmark_refcount_dec(void);
1363 int security_tun_dev_alloc_security(void **security);
1364 void security_tun_dev_free_security(void *security);
1365 int security_tun_dev_create(void);
1366 int security_tun_dev_attach_queue(void *security);
1367 int security_tun_dev_attach(struct sock *sk, void *security);
1368 int security_tun_dev_open(void *security);
1369 int security_sctp_assoc_request(struct sctp_endpoint *ep, struct sk_buff *skb);
1370 int security_sctp_bind_connect(struct sock *sk, int optname,
1371                                struct sockaddr *address, int addrlen);
1372 void security_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
1373                             struct sock *newsk);
1374 
1375 #else   /* CONFIG_SECURITY_NETWORK */
1376 static inline int security_unix_stream_connect(struct sock *sock,
1377                                                struct sock *other,
1378                                                struct sock *newsk)
1379 {
1380         return 0;
1381 }
1382 
1383 static inline int security_unix_may_send(struct socket *sock,
1384                                          struct socket *other)
1385 {
1386         return 0;
1387 }
1388 
1389 static inline int security_socket_create(int family, int type,
1390                                          int protocol, int kern)
1391 {
1392         return ccs_socket_create(family, type, protocol, kern);
1393 }
1394 
1395 static inline int security_socket_post_create(struct socket *sock,
1396                                               int family,
1397                                               int type,
1398                                               int protocol, int kern)
1399 {
1400         return 0;
1401 }
1402 
1403 static inline int security_socket_socketpair(struct socket *socka,
1404                                              struct socket *sockb)
1405 {
1406         return 0;
1407 }
1408 
1409 static inline int security_socket_bind(struct socket *sock,
1410                                        struct sockaddr *address,
1411                                        int addrlen)
1412 {
1413         return ccs_socket_bind(sock, address, addrlen);
1414 }
1415 
1416 static inline int security_socket_connect(struct socket *sock,
1417                                           struct sockaddr *address,
1418                                           int addrlen)
1419 {
1420         return ccs_socket_connect(sock, address, addrlen);
1421 }
1422 
1423 static inline int security_socket_listen(struct socket *sock, int backlog)
1424 {
1425         return ccs_socket_listen(sock, backlog);
1426 }
1427 
1428 static inline int security_socket_accept(struct socket *sock,
1429                                          struct socket *newsock)
1430 {
1431         return 0;
1432 }
1433 
1434 static inline int security_socket_sendmsg(struct socket *sock,
1435                                           struct msghdr *msg, int size)
1436 {
1437         return ccs_socket_sendmsg(sock, msg, size);
1438 }
1439 
1440 static inline int security_socket_recvmsg(struct socket *sock,
1441                                           struct msghdr *msg, int size,
1442                                           int flags)
1443 {
1444         return 0;
1445 }
1446 
1447 static inline int security_socket_getsockname(struct socket *sock)
1448 {
1449         return 0;
1450 }
1451 
1452 static inline int security_socket_getpeername(struct socket *sock)
1453 {
1454         return 0;
1455 }
1456 
1457 static inline int security_socket_getsockopt(struct socket *sock,
1458                                              int level, int optname)
1459 {
1460         return 0;
1461 }
1462 
1463 static inline int security_socket_setsockopt(struct socket *sock,
1464                                              int level, int optname)
1465 {
1466         return 0;
1467 }
1468 
1469 static inline int security_socket_shutdown(struct socket *sock, int how)
1470 {
1471         return 0;
1472 }
1473 static inline int security_sock_rcv_skb(struct sock *sk,
1474                                         struct sk_buff *skb)
1475 {
1476         return 0;
1477 }
1478 
1479 static inline int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
1480                                                     int __user *optlen, unsigned len)
1481 {
1482         return -ENOPROTOOPT;
1483 }
1484 
1485 static inline int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
1486 {
1487         return -ENOPROTOOPT;
1488 }
1489 
1490 static inline int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
1491 {
1492         return 0;
1493 }
1494 
1495 static inline void security_sk_free(struct sock *sk)
1496 {
1497 }
1498 
1499 static inline void security_sk_clone(const struct sock *sk, struct sock *newsk)
1500 {
1501 }
1502 
1503 static inline void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
1504 {
1505 }
1506 
1507 static inline void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
1508 {
1509 }
1510 
1511 static inline void security_sock_graft(struct sock *sk, struct socket *parent)
1512 {
1513 }
1514 
1515 static inline int security_inet_conn_request(struct sock *sk,
1516                         struct sk_buff *skb, struct request_sock *req)
1517 {
1518         return 0;
1519 }
1520 
1521 static inline void security_inet_csk_clone(struct sock *newsk,
1522                         const struct request_sock *req)
1523 {
1524 }
1525 
1526 static inline void security_inet_conn_established(struct sock *sk,
1527                         struct sk_buff *skb)
1528 {
1529 }
1530 
1531 static inline int security_secmark_relabel_packet(u32 secid)
1532 {
1533         return 0;
1534 }
1535 
1536 static inline void security_secmark_refcount_inc(void)
1537 {
1538 }
1539 
1540 static inline void security_secmark_refcount_dec(void)
1541 {
1542 }
1543 
1544 static inline int security_tun_dev_alloc_security(void **security)
1545 {
1546         return 0;
1547 }
1548 
1549 static inline void security_tun_dev_free_security(void *security)
1550 {
1551 }
1552 
1553 static inline int security_tun_dev_create(void)
1554 {
1555         return 0;
1556 }
1557 
1558 static inline int security_tun_dev_attach_queue(void *security)
1559 {
1560         return 0;
1561 }
1562 
1563 static inline int security_tun_dev_attach(struct sock *sk, void *security)
1564 {
1565         return 0;
1566 }
1567 
1568 static inline int security_tun_dev_open(void *security)
1569 {
1570         return 0;
1571 }
1572 
1573 static inline int security_sctp_assoc_request(struct sctp_endpoint *ep,
1574                                               struct sk_buff *skb)
1575 {
1576         return 0;
1577 }
1578 
1579 static inline int security_sctp_bind_connect(struct sock *sk, int optname,
1580                                              struct sockaddr *address,
1581                                              int addrlen)
1582 {
1583         return 0;
1584 }
1585 
1586 static inline void security_sctp_sk_clone(struct sctp_endpoint *ep,
1587                                           struct sock *sk,
1588                                           struct sock *newsk)
1589 {
1590 }
1591 #endif  /* CONFIG_SECURITY_NETWORK */
1592 
1593 #ifdef CONFIG_SECURITY_INFINIBAND
1594 int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey);
1595 int security_ib_endport_manage_subnet(void *sec, const char *name, u8 port_num);
1596 int security_ib_alloc_security(void **sec);
1597 void security_ib_free_security(void *sec);
1598 #else   /* CONFIG_SECURITY_INFINIBAND */
1599 static inline int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey)
1600 {
1601         return 0;
1602 }
1603 
1604 static inline int security_ib_endport_manage_subnet(void *sec, const char *dev_name, u8 port_num)
1605 {
1606         return 0;
1607 }
1608 
1609 static inline int security_ib_alloc_security(void **sec)
1610 {
1611         return 0;
1612 }
1613 
1614 static inline void security_ib_free_security(void *sec)
1615 {
1616 }
1617 #endif  /* CONFIG_SECURITY_INFINIBAND */
1618 
1619 #ifdef CONFIG_SECURITY_NETWORK_XFRM
1620 
1621 int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
1622                                struct xfrm_user_sec_ctx *sec_ctx, gfp_t gfp);
1623 int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctxp);
1624 void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
1625 int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
1626 int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx);
1627 int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
1628                                       struct xfrm_sec_ctx *polsec, u32 secid);
1629 int security_xfrm_state_delete(struct xfrm_state *x);
1630 void security_xfrm_state_free(struct xfrm_state *x);
1631 int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
1632 int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
1633                                        struct xfrm_policy *xp,
1634                                        const struct flowi *fl);
1635 int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid);
1636 void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl);
1637 
1638 #else   /* CONFIG_SECURITY_NETWORK_XFRM */
1639 
1640 static inline int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
1641                                              struct xfrm_user_sec_ctx *sec_ctx,
1642                                              gfp_t gfp)
1643 {
1644         return 0;
1645 }
1646 
1647 static inline int security_xfrm_policy_clone(struct xfrm_sec_ctx *old, struct xfrm_sec_ctx **new_ctxp)
1648 {
1649         return 0;
1650 }
1651 
1652 static inline void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
1653 {
1654 }
1655 
1656 static inline int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
1657 {
1658         return 0;
1659 }
1660 
1661 static inline int security_xfrm_state_alloc(struct xfrm_state *x,
1662                                         struct xfrm_user_sec_ctx *sec_ctx)
1663 {
1664         return 0;
1665 }
1666 
1667 static inline int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
1668                                         struct xfrm_sec_ctx *polsec, u32 secid)
1669 {
1670         return 0;
1671 }
1672 
1673 static inline void security_xfrm_state_free(struct xfrm_state *x)
1674 {
1675 }
1676 
1677 static inline int security_xfrm_state_delete(struct xfrm_state *x)
1678 {
1679         return 0;
1680 }
1681 
1682 static inline int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
1683 {
1684         return 0;
1685 }
1686 
1687 static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
1688                         struct xfrm_policy *xp, const struct flowi *fl)
1689 {
1690         return 1;
1691 }
1692 
1693 static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
1694 {
1695         return 0;
1696 }
1697 
1698 static inline void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)
1699 {
1700 }
1701 
1702 #endif  /* CONFIG_SECURITY_NETWORK_XFRM */
1703 
1704 #ifdef CONFIG_SECURITY_PATH
1705 int security_path_unlink(const struct path *dir, struct dentry *dentry);
1706 int security_path_mkdir(const struct path *dir, struct dentry *dentry, umode_t mode);
1707 int security_path_rmdir(const struct path *dir, struct dentry *dentry);
1708 int security_path_mknod(const struct path *dir, struct dentry *dentry, umode_t mode,
1709                         unsigned int dev);
1710 int security_path_truncate(const struct path *path);
1711 int security_path_symlink(const struct path *dir, struct dentry *dentry,
1712                           const char *old_name);
1713 int security_path_link(struct dentry *old_dentry, const struct path *new_dir,
1714                        struct dentry *new_dentry);
1715 int security_path_rename(const struct path *old_dir, struct dentry *old_dentry,
1716                          const struct path *new_dir, struct dentry *new_dentry,
1717                          unsigned int flags);
1718 int security_path_chmod(const struct path *path, umode_t mode);
1719 int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid);
1720 int security_path_chroot(const struct path *path);
1721 #else   /* CONFIG_SECURITY_PATH */
1722 static inline int security_path_unlink(const struct path *dir, struct dentry *dentry)
1723 {
1724         return ccs_path_unlink(dir, dentry);
1725 }
1726 
1727 static inline int security_path_mkdir(const struct path *dir, struct dentry *dentry,
1728                                       umode_t mode)
1729 {
1730         return ccs_path_mkdir(dir, dentry, mode);
1731 }
1732 
1733 static inline int security_path_rmdir(const struct path *dir, struct dentry *dentry)
1734 {
1735         return ccs_path_rmdir(dir, dentry);
1736 }
1737 
1738 static inline int security_path_mknod(const struct path *dir, struct dentry *dentry,
1739                                       umode_t mode, unsigned int dev)
1740 {
1741         return ccs_path_mknod(dir, dentry, mode, dev);
1742 }
1743 
1744 static inline int security_path_truncate(const struct path *path)
1745 {
1746         return ccs_path_truncate(path);
1747 }
1748 
1749 static inline int security_path_symlink(const struct path *dir, struct dentry *dentry,
1750                                         const char *old_name)
1751 {
1752         return ccs_path_symlink(dir, dentry, old_name);
1753 }
1754 
1755 static inline int security_path_link(struct dentry *old_dentry,
1756                                      const struct path *new_dir,
1757                                      struct dentry *new_dentry)
1758 {
1759         return ccs_path_link(old_dentry, new_dir, new_dentry);
1760 }
1761 
1762 static inline int security_path_rename(const struct path *old_dir,
1763                                        struct dentry *old_dentry,
1764                                        const struct path *new_dir,
1765                                        struct dentry *new_dentry,
1766                                        unsigned int flags)
1767 {
1768         /*
1769          * Not using RENAME_EXCHANGE here in order to avoid KABI breakage
1770          * by doing "#include <uapi/linux/fs.h>" .
1771          */
1772         if (flags & (1 << 1)) {
1773                 int err = ccs_path_rename(new_dir, new_dentry, old_dir,
1774                                           old_dentry);
1775                 if (err)
1776                         return err;
1777         }
1778         return ccs_path_rename(old_dir, old_dentry, new_dir, new_dentry);
1779 }
1780 
1781 static inline int security_path_chmod(const struct path *path, umode_t mode)
1782 {
1783         return ccs_path_chmod(path, mode);
1784 }
1785 
1786 static inline int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
1787 {
1788         return ccs_path_chown(path, uid, gid);
1789 }
1790 
1791 static inline int security_path_chroot(const struct path *path)
1792 {
1793         return ccs_path_chroot(path);
1794 }
1795 #endif  /* CONFIG_SECURITY_PATH */
1796 
1797 #ifdef CONFIG_KEYS
1798 #ifdef CONFIG_SECURITY
1799 
1800 int security_key_alloc(struct key *key, const struct cred *cred, unsigned long flags);
1801 void security_key_free(struct key *key);
1802 int security_key_permission(key_ref_t key_ref, const struct cred *cred,
1803                             enum key_need_perm need_perm);
1804 int security_key_getsecurity(struct key *key, char **_buffer);
1805 
1806 #else
1807 
1808 static inline int security_key_alloc(struct key *key,
1809                                      const struct cred *cred,
1810                                      unsigned long flags)
1811 {
1812         return 0;
1813 }
1814 
1815 static inline void security_key_free(struct key *key)
1816 {
1817 }
1818 
1819 static inline int security_key_permission(key_ref_t key_ref,
1820                                           const struct cred *cred,
1821                                           enum key_need_perm need_perm)
1822 {
1823         return 0;
1824 }
1825 
1826 static inline int security_key_getsecurity(struct key *key, char **_buffer)
1827 {
1828         *_buffer = NULL;
1829         return 0;
1830 }
1831 
1832 #endif
1833 #endif /* CONFIG_KEYS */
1834 
1835 #ifdef CONFIG_AUDIT
1836 #ifdef CONFIG_SECURITY
1837 int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule);
1838 int security_audit_rule_known(struct audit_krule *krule);
1839 int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule);
1840 void security_audit_rule_free(void *lsmrule);
1841 
1842 #else
1843 
1844 static inline int security_audit_rule_init(u32 field, u32 op, char *rulestr,
1845                                            void **lsmrule)
1846 {
1847         return 0;
1848 }
1849 
1850 static inline int security_audit_rule_known(struct audit_krule *krule)
1851 {
1852         return 0;
1853 }
1854 
1855 static inline int security_audit_rule_match(u32 secid, u32 field, u32 op,
1856                                             void *lsmrule)
1857 {
1858         return 0;
1859 }
1860 
1861 static inline void security_audit_rule_free(void *lsmrule)
1862 { }
1863 
1864 #endif /* CONFIG_SECURITY */
1865 #endif /* CONFIG_AUDIT */
1866 
1867 #ifdef CONFIG_SECURITYFS
1868 
1869 extern struct dentry *securityfs_create_file(const char *name, umode_t mode,
1870                                              struct dentry *parent, void *data,
1871                                              const struct file_operations *fops);
1872 extern struct dentry *securityfs_create_dir(const char *name, struct dentry *parent);
1873 struct dentry *securityfs_create_symlink(const char *name,
1874                                          struct dentry *parent,
1875                                          const char *target,
1876                                          const struct inode_operations *iops);
1877 extern void securityfs_remove(struct dentry *dentry);
1878 
1879 #else /* CONFIG_SECURITYFS */
1880 
1881 static inline struct dentry *securityfs_create_dir(const char *name,
1882                                                    struct dentry *parent)
1883 {
1884         return ERR_PTR(-ENODEV);
1885 }
1886 
1887 static inline struct dentry *securityfs_create_file(const char *name,
1888                                                     umode_t mode,
1889                                                     struct dentry *parent,
1890                                                     void *data,
1891                                                     const struct file_operations *fops)
1892 {
1893         return ERR_PTR(-ENODEV);
1894 }
1895 
1896 static inline struct dentry *securityfs_create_symlink(const char *name,
1897                                         struct dentry *parent,
1898                                         const char *target,
1899                                         const struct inode_operations *iops)
1900 {
1901         return ERR_PTR(-ENODEV);
1902 }
1903 
1904 static inline void securityfs_remove(struct dentry *dentry)
1905 {}
1906 
1907 #endif
1908 
1909 #ifdef CONFIG_BPF_SYSCALL
1910 union bpf_attr;
1911 struct bpf_map;
1912 struct bpf_prog;
1913 struct bpf_prog_aux;
1914 #ifdef CONFIG_SECURITY
1915 extern int security_bpf(int cmd, union bpf_attr *attr, unsigned int size);
1916 extern int security_bpf_map(struct bpf_map *map, fmode_t fmode);
1917 extern int security_bpf_prog(struct bpf_prog *prog);
1918 extern int security_bpf_map_alloc(struct bpf_map *map);
1919 extern void security_bpf_map_free(struct bpf_map *map);
1920 extern int security_bpf_prog_alloc(struct bpf_prog_aux *aux);
1921 extern void security_bpf_prog_free(struct bpf_prog_aux *aux);
1922 #else
1923 static inline int security_bpf(int cmd, union bpf_attr *attr,
1924                                              unsigned int size)
1925 {
1926         return 0;
1927 }
1928 
1929 static inline int security_bpf_map(struct bpf_map *map, fmode_t fmode)
1930 {
1931         return 0;
1932 }
1933 
1934 static inline int security_bpf_prog(struct bpf_prog *prog)
1935 {
1936         return 0;
1937 }
1938 
1939 static inline int security_bpf_map_alloc(struct bpf_map *map)
1940 {
1941         return 0;
1942 }
1943 
1944 static inline void security_bpf_map_free(struct bpf_map *map)
1945 { }
1946 
1947 static inline int security_bpf_prog_alloc(struct bpf_prog_aux *aux)
1948 {
1949         return 0;
1950 }
1951 
1952 static inline void security_bpf_prog_free(struct bpf_prog_aux *aux)
1953 { }
1954 #endif /* CONFIG_SECURITY */
1955 #endif /* CONFIG_BPF_SYSCALL */
1956 
1957 #ifdef CONFIG_PERF_EVENTS
1958 struct perf_event_attr;
1959 struct perf_event;
1960 
1961 #ifdef CONFIG_SECURITY
1962 extern int security_perf_event_open(struct perf_event_attr *attr, int type);
1963 extern int security_perf_event_alloc(struct perf_event *event);
1964 extern void security_perf_event_free(struct perf_event *event);
1965 extern int security_perf_event_read(struct perf_event *event);
1966 extern int security_perf_event_write(struct perf_event *event);
1967 #else
1968 static inline int security_perf_event_open(struct perf_event_attr *attr,
1969                                            int type)
1970 {
1971         return 0;
1972 }
1973 
1974 static inline int security_perf_event_alloc(struct perf_event *event)
1975 {
1976         return 0;
1977 }
1978 
1979 static inline void security_perf_event_free(struct perf_event *event)
1980 {
1981 }
1982 
1983 static inline int security_perf_event_read(struct perf_event *event)
1984 {
1985         return 0;
1986 }
1987 
1988 static inline int security_perf_event_write(struct perf_event *event)
1989 {
1990         return 0;
1991 }
1992 #endif /* CONFIG_SECURITY */
1993 #endif /* CONFIG_PERF_EVENTS */
1994 
1995 #endif /* ! __LINUX_SECURITY_H */
1996 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp