]> bbs.cooldavid.org Git - net-next-2.6.git/blame - security/security.c
sysctl: require CAP_SYS_RAWIO to set mmap_min_addr
[net-next-2.6.git] / security / security.c
CommitLineData
1da177e4
LT
1/*
2 * Security plug functions
3 *
4 * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
5 * Copyright (C) 2001-2002 Greg Kroah-Hartman <greg@kroah.com>
6 * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 */
13
c59ede7b 14#include <linux/capability.h>
1da177e4
LT
15#include <linux/module.h>
16#include <linux/init.h>
17#include <linux/kernel.h>
1da177e4 18#include <linux/security.h>
6c21a7fb 19#include <linux/ima.h>
1da177e4 20
076c54c5
AD
21/* Boot-time LSM user choice */
22static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1];
1da177e4 23
5915eb53
MS
24/* things that live in capability.c */
25extern struct security_operations default_security_ops;
1da177e4
LT
26extern void security_fixup_ops(struct security_operations *ops);
27
28struct security_operations *security_ops; /* Initialized to NULL */
a5ecbcb8 29
1da177e4
LT
30static inline int verify(struct security_operations *ops)
31{
32 /* verify the security_operations structure exists */
33 if (!ops)
34 return -EINVAL;
35 security_fixup_ops(ops);
36 return 0;
37}
38
39static void __init do_security_initcalls(void)
40{
41 initcall_t *call;
42 call = __security_initcall_start;
43 while (call < __security_initcall_end) {
44 (*call) ();
45 call++;
46 }
47}
48
49/**
50 * security_init - initializes the security framework
51 *
52 * This should be called early in the kernel initialization sequence.
53 */
54int __init security_init(void)
55{
20510f2f 56 printk(KERN_INFO "Security Framework initialized\n");
1da177e4 57
5915eb53
MS
58 security_fixup_ops(&default_security_ops);
59 security_ops = &default_security_ops;
1da177e4
LT
60 do_security_initcalls();
61
62 return 0;
63}
64
076c54c5
AD
65/* Save user chosen LSM */
66static int __init choose_lsm(char *str)
67{
68 strncpy(chosen_lsm, str, SECURITY_NAME_MAX);
69 return 1;
70}
71__setup("security=", choose_lsm);
72
73/**
74 * security_module_enable - Load given security module on boot ?
75 * @ops: a pointer to the struct security_operations that is to be checked.
76 *
77 * Each LSM must pass this method before registering its own operations
78 * to avoid security registration races. This method may also be used
7cea51be 79 * to check if your LSM is currently loaded during kernel initialization.
076c54c5
AD
80 *
81 * Return true if:
82 * -The passed LSM is the one chosen by user at boot time,
3f23d815
RD
83 * -or user didn't specify a specific LSM and we're the first to ask
84 * for registration permission,
076c54c5
AD
85 * -or the passed LSM is currently loaded.
86 * Otherwise, return false.
87 */
88int __init security_module_enable(struct security_operations *ops)
89{
90 if (!*chosen_lsm)
91 strncpy(chosen_lsm, ops->name, SECURITY_NAME_MAX);
92 else if (strncmp(ops->name, chosen_lsm, SECURITY_NAME_MAX))
93 return 0;
94
95 return 1;
96}
97
1da177e4
LT
98/**
99 * register_security - registers a security framework with the kernel
100 * @ops: a pointer to the struct security_options that is to be registered
101 *
3f23d815 102 * This function allows a security module to register itself with the
1da177e4 103 * kernel security subsystem. Some rudimentary checking is done on the @ops
076c54c5
AD
104 * value passed to this function. You'll need to check first if your LSM
105 * is allowed to register its @ops by calling security_module_enable(@ops).
1da177e4
LT
106 *
107 * If there is already a security module registered with the kernel,
3f23d815 108 * an error will be returned. Otherwise %0 is returned on success.
1da177e4
LT
109 */
110int register_security(struct security_operations *ops)
111{
112 if (verify(ops)) {
113 printk(KERN_DEBUG "%s could not verify "
dd6f953a 114 "security_operations structure.\n", __func__);
1da177e4
LT
115 return -EINVAL;
116 }
117
5915eb53 118 if (security_ops != &default_security_ops)
1da177e4
LT
119 return -EAGAIN;
120
121 security_ops = ops;
122
123 return 0;
124}
125
20510f2f
JM
126/* Security operations */
127
9e48858f 128int security_ptrace_access_check(struct task_struct *child, unsigned int mode)
20510f2f 129{
9e48858f 130 return security_ops->ptrace_access_check(child, mode);
5cd9c58f
DH
131}
132
133int security_ptrace_traceme(struct task_struct *parent)
134{
135 return security_ops->ptrace_traceme(parent);
20510f2f
JM
136}
137
138int security_capget(struct task_struct *target,
139 kernel_cap_t *effective,
140 kernel_cap_t *inheritable,
141 kernel_cap_t *permitted)
142{
143 return security_ops->capget(target, effective, inheritable, permitted);
144}
145
d84f4f99
DH
146int security_capset(struct cred *new, const struct cred *old,
147 const kernel_cap_t *effective,
148 const kernel_cap_t *inheritable,
149 const kernel_cap_t *permitted)
20510f2f 150{
d84f4f99
DH
151 return security_ops->capset(new, old,
152 effective, inheritable, permitted);
20510f2f
JM
153}
154
3699c53c 155int security_capable(int cap)
20510f2f 156{
3699c53c
DH
157 return security_ops->capable(current, current_cred(), cap,
158 SECURITY_CAP_AUDIT);
06112163
EP
159}
160
3699c53c 161int security_real_capable(struct task_struct *tsk, int cap)
06112163 162{
3699c53c
DH
163 const struct cred *cred;
164 int ret;
165
166 cred = get_task_cred(tsk);
167 ret = security_ops->capable(tsk, cred, cap, SECURITY_CAP_AUDIT);
168 put_cred(cred);
169 return ret;
170}
171
172int security_real_capable_noaudit(struct task_struct *tsk, int cap)
173{
174 const struct cred *cred;
175 int ret;
176
177 cred = get_task_cred(tsk);
178 ret = security_ops->capable(tsk, cred, cap, SECURITY_CAP_NOAUDIT);
179 put_cred(cred);
180 return ret;
20510f2f
JM
181}
182
183int security_acct(struct file *file)
184{
185 return security_ops->acct(file);
186}
187
188int security_sysctl(struct ctl_table *table, int op)
189{
190 return security_ops->sysctl(table, op);
191}
192
193int security_quotactl(int cmds, int type, int id, struct super_block *sb)
194{
195 return security_ops->quotactl(cmds, type, id, sb);
196}
197
198int security_quota_on(struct dentry *dentry)
199{
200 return security_ops->quota_on(dentry);
201}
202
203int security_syslog(int type)
204{
205 return security_ops->syslog(type);
206}
207
208int security_settime(struct timespec *ts, struct timezone *tz)
209{
210 return security_ops->settime(ts, tz);
211}
212
213int security_vm_enough_memory(long pages)
214{
731572d3 215 WARN_ON(current->mm == NULL);
20510f2f
JM
216 return security_ops->vm_enough_memory(current->mm, pages);
217}
218
219int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
220{
731572d3 221 WARN_ON(mm == NULL);
20510f2f
JM
222 return security_ops->vm_enough_memory(mm, pages);
223}
224
731572d3
AC
225int security_vm_enough_memory_kern(long pages)
226{
227 /* If current->mm is a kernel thread then we will pass NULL,
228 for this specific case that is fine */
229 return security_ops->vm_enough_memory(current->mm, pages);
230}
231
a6f76f23 232int security_bprm_set_creds(struct linux_binprm *bprm)
20510f2f 233{
a6f76f23 234 return security_ops->bprm_set_creds(bprm);
20510f2f
JM
235}
236
a6f76f23 237int security_bprm_check(struct linux_binprm *bprm)
20510f2f 238{
6c21a7fb
MZ
239 int ret;
240
241 ret = security_ops->bprm_check_security(bprm);
242 if (ret)
243 return ret;
244 return ima_bprm_check(bprm);
20510f2f
JM
245}
246
a6f76f23 247void security_bprm_committing_creds(struct linux_binprm *bprm)
20510f2f 248{
200036ca 249 security_ops->bprm_committing_creds(bprm);
20510f2f
JM
250}
251
a6f76f23 252void security_bprm_committed_creds(struct linux_binprm *bprm)
20510f2f 253{
200036ca 254 security_ops->bprm_committed_creds(bprm);
20510f2f
JM
255}
256
257int security_bprm_secureexec(struct linux_binprm *bprm)
258{
259 return security_ops->bprm_secureexec(bprm);
260}
261
262int security_sb_alloc(struct super_block *sb)
263{
264 return security_ops->sb_alloc_security(sb);
265}
266
267void security_sb_free(struct super_block *sb)
268{
269 security_ops->sb_free_security(sb);
270}
271
e0007529 272int security_sb_copy_data(char *orig, char *copy)
20510f2f 273{
e0007529 274 return security_ops->sb_copy_data(orig, copy);
20510f2f 275}
e0007529 276EXPORT_SYMBOL(security_sb_copy_data);
20510f2f 277
12204e24 278int security_sb_kern_mount(struct super_block *sb, int flags, void *data)
20510f2f 279{
12204e24 280 return security_ops->sb_kern_mount(sb, flags, data);
20510f2f
JM
281}
282
2069f457
EP
283int security_sb_show_options(struct seq_file *m, struct super_block *sb)
284{
285 return security_ops->sb_show_options(m, sb);
286}
287
20510f2f
JM
288int security_sb_statfs(struct dentry *dentry)
289{
290 return security_ops->sb_statfs(dentry);
291}
292
b5266eb4 293int security_sb_mount(char *dev_name, struct path *path,
20510f2f
JM
294 char *type, unsigned long flags, void *data)
295{
b5266eb4 296 return security_ops->sb_mount(dev_name, path, type, flags, data);
20510f2f
JM
297}
298
b5266eb4 299int security_sb_check_sb(struct vfsmount *mnt, struct path *path)
20510f2f 300{
b5266eb4 301 return security_ops->sb_check_sb(mnt, path);
20510f2f
JM
302}
303
304int security_sb_umount(struct vfsmount *mnt, int flags)
305{
306 return security_ops->sb_umount(mnt, flags);
307}
308
309void security_sb_umount_close(struct vfsmount *mnt)
310{
311 security_ops->sb_umount_close(mnt);
312}
313
314void security_sb_umount_busy(struct vfsmount *mnt)
315{
316 security_ops->sb_umount_busy(mnt);
317}
318
319void security_sb_post_remount(struct vfsmount *mnt, unsigned long flags, void *data)
320{
321 security_ops->sb_post_remount(mnt, flags, data);
322}
323
b5266eb4 324void security_sb_post_addmount(struct vfsmount *mnt, struct path *mountpoint)
20510f2f 325{
b5266eb4 326 security_ops->sb_post_addmount(mnt, mountpoint);
20510f2f
JM
327}
328
b5266eb4 329int security_sb_pivotroot(struct path *old_path, struct path *new_path)
20510f2f 330{
b5266eb4 331 return security_ops->sb_pivotroot(old_path, new_path);
20510f2f
JM
332}
333
b5266eb4 334void security_sb_post_pivotroot(struct path *old_path, struct path *new_path)
20510f2f 335{
b5266eb4 336 security_ops->sb_post_pivotroot(old_path, new_path);
20510f2f
JM
337}
338
c9180a57 339int security_sb_set_mnt_opts(struct super_block *sb,
e0007529 340 struct security_mnt_opts *opts)
c9180a57 341{
e0007529 342 return security_ops->sb_set_mnt_opts(sb, opts);
c9180a57 343}
e0007529 344EXPORT_SYMBOL(security_sb_set_mnt_opts);
c9180a57
EP
345
346void security_sb_clone_mnt_opts(const struct super_block *oldsb,
347 struct super_block *newsb)
348{
349 security_ops->sb_clone_mnt_opts(oldsb, newsb);
350}
e0007529
EP
351EXPORT_SYMBOL(security_sb_clone_mnt_opts);
352
353int security_sb_parse_opts_str(char *options, struct security_mnt_opts *opts)
354{
355 return security_ops->sb_parse_opts_str(options, opts);
356}
357EXPORT_SYMBOL(security_sb_parse_opts_str);
c9180a57 358
20510f2f
JM
359int security_inode_alloc(struct inode *inode)
360{
6c21a7fb
MZ
361 int ret;
362
20510f2f 363 inode->i_security = NULL;
6c21a7fb
MZ
364 ret = security_ops->inode_alloc_security(inode);
365 if (ret)
366 return ret;
367 ret = ima_inode_alloc(inode);
368 if (ret)
369 security_inode_free(inode);
370 return ret;
20510f2f
JM
371}
372
373void security_inode_free(struct inode *inode)
374{
6c21a7fb 375 ima_inode_free(inode);
20510f2f
JM
376 security_ops->inode_free_security(inode);
377}
378
379int security_inode_init_security(struct inode *inode, struct inode *dir,
380 char **name, void **value, size_t *len)
381{
382 if (unlikely(IS_PRIVATE(inode)))
383 return -EOPNOTSUPP;
384 return security_ops->inode_init_security(inode, dir, name, value, len);
385}
386EXPORT_SYMBOL(security_inode_init_security);
387
be6d3e56
KT
388#ifdef CONFIG_SECURITY_PATH
389int security_path_mknod(struct path *path, struct dentry *dentry, int mode,
390 unsigned int dev)
391{
392 if (unlikely(IS_PRIVATE(path->dentry->d_inode)))
393 return 0;
394 return security_ops->path_mknod(path, dentry, mode, dev);
395}
396EXPORT_SYMBOL(security_path_mknod);
397
398int security_path_mkdir(struct path *path, struct dentry *dentry, int mode)
399{
400 if (unlikely(IS_PRIVATE(path->dentry->d_inode)))
401 return 0;
402 return security_ops->path_mkdir(path, dentry, mode);
403}
404
405int security_path_rmdir(struct path *path, struct dentry *dentry)
406{
407 if (unlikely(IS_PRIVATE(path->dentry->d_inode)))
408 return 0;
409 return security_ops->path_rmdir(path, dentry);
410}
411
412int security_path_unlink(struct path *path, struct dentry *dentry)
413{
414 if (unlikely(IS_PRIVATE(path->dentry->d_inode)))
415 return 0;
416 return security_ops->path_unlink(path, dentry);
417}
418
419int security_path_symlink(struct path *path, struct dentry *dentry,
420 const char *old_name)
421{
422 if (unlikely(IS_PRIVATE(path->dentry->d_inode)))
423 return 0;
424 return security_ops->path_symlink(path, dentry, old_name);
425}
426
427int security_path_link(struct dentry *old_dentry, struct path *new_dir,
428 struct dentry *new_dentry)
429{
430 if (unlikely(IS_PRIVATE(old_dentry->d_inode)))
431 return 0;
432 return security_ops->path_link(old_dentry, new_dir, new_dentry);
433}
434
435int security_path_rename(struct path *old_dir, struct dentry *old_dentry,
436 struct path *new_dir, struct dentry *new_dentry)
437{
438 if (unlikely(IS_PRIVATE(old_dentry->d_inode) ||
439 (new_dentry->d_inode && IS_PRIVATE(new_dentry->d_inode))))
440 return 0;
441 return security_ops->path_rename(old_dir, old_dentry, new_dir,
442 new_dentry);
443}
444
445int security_path_truncate(struct path *path, loff_t length,
446 unsigned int time_attrs)
447{
448 if (unlikely(IS_PRIVATE(path->dentry->d_inode)))
449 return 0;
450 return security_ops->path_truncate(path, length, time_attrs);
451}
89eda068
TH
452
453int security_path_chmod(struct dentry *dentry, struct vfsmount *mnt,
454 mode_t mode)
455{
456 if (unlikely(IS_PRIVATE(dentry->d_inode)))
457 return 0;
458 return security_ops->path_chmod(dentry, mnt, mode);
459}
460
461int security_path_chown(struct path *path, uid_t uid, gid_t gid)
462{
463 if (unlikely(IS_PRIVATE(path->dentry->d_inode)))
464 return 0;
465 return security_ops->path_chown(path, uid, gid);
466}
8b8efb44
TH
467
468int security_path_chroot(struct path *path)
469{
470 return security_ops->path_chroot(path);
471}
be6d3e56
KT
472#endif
473
20510f2f
JM
474int security_inode_create(struct inode *dir, struct dentry *dentry, int mode)
475{
476 if (unlikely(IS_PRIVATE(dir)))
477 return 0;
478 return security_ops->inode_create(dir, dentry, mode);
479}
800a9647 480EXPORT_SYMBOL_GPL(security_inode_create);
20510f2f
JM
481
482int security_inode_link(struct dentry *old_dentry, struct inode *dir,
483 struct dentry *new_dentry)
484{
485 if (unlikely(IS_PRIVATE(old_dentry->d_inode)))
486 return 0;
487 return security_ops->inode_link(old_dentry, dir, new_dentry);
488}
489
490int security_inode_unlink(struct inode *dir, struct dentry *dentry)
491{
492 if (unlikely(IS_PRIVATE(dentry->d_inode)))
493 return 0;
494 return security_ops->inode_unlink(dir, dentry);
495}
496
497int security_inode_symlink(struct inode *dir, struct dentry *dentry,
498 const char *old_name)
499{
500 if (unlikely(IS_PRIVATE(dir)))
501 return 0;
502 return security_ops->inode_symlink(dir, dentry, old_name);
503}
504
505int security_inode_mkdir(struct inode *dir, struct dentry *dentry, int mode)
506{
507 if (unlikely(IS_PRIVATE(dir)))
508 return 0;
509 return security_ops->inode_mkdir(dir, dentry, mode);
510}
800a9647 511EXPORT_SYMBOL_GPL(security_inode_mkdir);
20510f2f
JM
512
513int security_inode_rmdir(struct inode *dir, struct dentry *dentry)
514{
515 if (unlikely(IS_PRIVATE(dentry->d_inode)))
516 return 0;
517 return security_ops->inode_rmdir(dir, dentry);
518}
519
520int security_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
521{
522 if (unlikely(IS_PRIVATE(dir)))
523 return 0;
524 return security_ops->inode_mknod(dir, dentry, mode, dev);
525}
526
527int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
528 struct inode *new_dir, struct dentry *new_dentry)
529{
530 if (unlikely(IS_PRIVATE(old_dentry->d_inode) ||
531 (new_dentry->d_inode && IS_PRIVATE(new_dentry->d_inode))))
532 return 0;
533 return security_ops->inode_rename(old_dir, old_dentry,
534 new_dir, new_dentry);
535}
536
537int security_inode_readlink(struct dentry *dentry)
538{
539 if (unlikely(IS_PRIVATE(dentry->d_inode)))
540 return 0;
541 return security_ops->inode_readlink(dentry);
542}
543
544int security_inode_follow_link(struct dentry *dentry, struct nameidata *nd)
545{
546 if (unlikely(IS_PRIVATE(dentry->d_inode)))
547 return 0;
548 return security_ops->inode_follow_link(dentry, nd);
549}
550
b77b0646 551int security_inode_permission(struct inode *inode, int mask)
20510f2f
JM
552{
553 if (unlikely(IS_PRIVATE(inode)))
554 return 0;
b77b0646 555 return security_ops->inode_permission(inode, mask);
20510f2f
JM
556}
557
558int security_inode_setattr(struct dentry *dentry, struct iattr *attr)
559{
560 if (unlikely(IS_PRIVATE(dentry->d_inode)))
561 return 0;
562 return security_ops->inode_setattr(dentry, attr);
563}
b1da47e2 564EXPORT_SYMBOL_GPL(security_inode_setattr);
20510f2f
JM
565
566int security_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
567{
568 if (unlikely(IS_PRIVATE(dentry->d_inode)))
569 return 0;
570 return security_ops->inode_getattr(mnt, dentry);
571}
572
573void security_inode_delete(struct inode *inode)
574{
575 if (unlikely(IS_PRIVATE(inode)))
576 return;
577 security_ops->inode_delete(inode);
578}
579
8f0cfa52
DH
580int security_inode_setxattr(struct dentry *dentry, const char *name,
581 const void *value, size_t size, int flags)
20510f2f
JM
582{
583 if (unlikely(IS_PRIVATE(dentry->d_inode)))
584 return 0;
585 return security_ops->inode_setxattr(dentry, name, value, size, flags);
586}
587
8f0cfa52
DH
588void security_inode_post_setxattr(struct dentry *dentry, const char *name,
589 const void *value, size_t size, int flags)
20510f2f
JM
590{
591 if (unlikely(IS_PRIVATE(dentry->d_inode)))
592 return;
593 security_ops->inode_post_setxattr(dentry, name, value, size, flags);
594}
595
8f0cfa52 596int security_inode_getxattr(struct dentry *dentry, const char *name)
20510f2f
JM
597{
598 if (unlikely(IS_PRIVATE(dentry->d_inode)))
599 return 0;
600 return security_ops->inode_getxattr(dentry, name);
601}
602
603int security_inode_listxattr(struct dentry *dentry)
604{
605 if (unlikely(IS_PRIVATE(dentry->d_inode)))
606 return 0;
607 return security_ops->inode_listxattr(dentry);
608}
609
8f0cfa52 610int security_inode_removexattr(struct dentry *dentry, const char *name)
20510f2f
JM
611{
612 if (unlikely(IS_PRIVATE(dentry->d_inode)))
613 return 0;
614 return security_ops->inode_removexattr(dentry, name);
615}
616
b5376771
SH
617int security_inode_need_killpriv(struct dentry *dentry)
618{
619 return security_ops->inode_need_killpriv(dentry);
620}
621
622int security_inode_killpriv(struct dentry *dentry)
623{
624 return security_ops->inode_killpriv(dentry);
625}
626
42492594 627int security_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
20510f2f
JM
628{
629 if (unlikely(IS_PRIVATE(inode)))
630 return 0;
42492594 631 return security_ops->inode_getsecurity(inode, name, buffer, alloc);
20510f2f
JM
632}
633
634int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
635{
636 if (unlikely(IS_PRIVATE(inode)))
637 return 0;
638 return security_ops->inode_setsecurity(inode, name, value, size, flags);
639}
640
641int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
642{
643 if (unlikely(IS_PRIVATE(inode)))
644 return 0;
645 return security_ops->inode_listsecurity(inode, buffer, buffer_size);
646}
647
8a076191
AD
648void security_inode_getsecid(const struct inode *inode, u32 *secid)
649{
650 security_ops->inode_getsecid(inode, secid);
651}
652
20510f2f
JM
653int security_file_permission(struct file *file, int mask)
654{
655 return security_ops->file_permission(file, mask);
656}
657
658int security_file_alloc(struct file *file)
659{
660 return security_ops->file_alloc_security(file);
661}
662
663void security_file_free(struct file *file)
664{
665 security_ops->file_free_security(file);
6c21a7fb
MZ
666 if (file->f_dentry)
667 ima_file_free(file);
20510f2f
JM
668}
669
670int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
671{
672 return security_ops->file_ioctl(file, cmd, arg);
673}
674
675int security_file_mmap(struct file *file, unsigned long reqprot,
676 unsigned long prot, unsigned long flags,
677 unsigned long addr, unsigned long addr_only)
678{
6c21a7fb
MZ
679 int ret;
680
681 ret = security_ops->file_mmap(file, reqprot, prot, flags, addr, addr_only);
682 if (ret)
683 return ret;
684 return ima_file_mmap(file, prot);
20510f2f
JM
685}
686
687int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
688 unsigned long prot)
689{
690 return security_ops->file_mprotect(vma, reqprot, prot);
691}
692
693int security_file_lock(struct file *file, unsigned int cmd)
694{
695 return security_ops->file_lock(file, cmd);
696}
697
698int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
699{
700 return security_ops->file_fcntl(file, cmd, arg);
701}
702
703int security_file_set_fowner(struct file *file)
704{
705 return security_ops->file_set_fowner(file);
706}
707
708int security_file_send_sigiotask(struct task_struct *tsk,
709 struct fown_struct *fown, int sig)
710{
711 return security_ops->file_send_sigiotask(tsk, fown, sig);
712}
713
714int security_file_receive(struct file *file)
715{
716 return security_ops->file_receive(file);
717}
718
745ca247 719int security_dentry_open(struct file *file, const struct cred *cred)
20510f2f 720{
745ca247 721 return security_ops->dentry_open(file, cred);
20510f2f
JM
722}
723
724int security_task_create(unsigned long clone_flags)
725{
726 return security_ops->task_create(clone_flags);
727}
728
ee18d64c
DH
729int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
730{
731 return security_ops->cred_alloc_blank(cred, gfp);
732}
733
d84f4f99 734void security_cred_free(struct cred *cred)
20510f2f 735{
d84f4f99 736 security_ops->cred_free(cred);
20510f2f
JM
737}
738
d84f4f99 739int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp)
20510f2f 740{
d84f4f99
DH
741 return security_ops->cred_prepare(new, old, gfp);
742}
743
744void security_commit_creds(struct cred *new, const struct cred *old)
745{
200036ca 746 security_ops->cred_commit(new, old);
20510f2f
JM
747}
748
ee18d64c
DH
749void security_transfer_creds(struct cred *new, const struct cred *old)
750{
751 security_ops->cred_transfer(new, old);
752}
753
3a3b7ce9
DH
754int security_kernel_act_as(struct cred *new, u32 secid)
755{
756 return security_ops->kernel_act_as(new, secid);
757}
758
759int security_kernel_create_files_as(struct cred *new, struct inode *inode)
760{
761 return security_ops->kernel_create_files_as(new, inode);
762}
763
9188499c
EP
764int security_kernel_module_request(void)
765{
766 return security_ops->kernel_module_request();
767}
768
20510f2f
JM
769int security_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
770{
771 return security_ops->task_setuid(id0, id1, id2, flags);
772}
773
d84f4f99
DH
774int security_task_fix_setuid(struct cred *new, const struct cred *old,
775 int flags)
20510f2f 776{
d84f4f99 777 return security_ops->task_fix_setuid(new, old, flags);
20510f2f
JM
778}
779
780int security_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
781{
782 return security_ops->task_setgid(id0, id1, id2, flags);
783}
784
785int security_task_setpgid(struct task_struct *p, pid_t pgid)
786{
787 return security_ops->task_setpgid(p, pgid);
788}
789
790int security_task_getpgid(struct task_struct *p)
791{
792 return security_ops->task_getpgid(p);
793}
794
795int security_task_getsid(struct task_struct *p)
796{
797 return security_ops->task_getsid(p);
798}
799
800void security_task_getsecid(struct task_struct *p, u32 *secid)
801{
802 security_ops->task_getsecid(p, secid);
803}
804EXPORT_SYMBOL(security_task_getsecid);
805
806int security_task_setgroups(struct group_info *group_info)
807{
808 return security_ops->task_setgroups(group_info);
809}
810
811int security_task_setnice(struct task_struct *p, int nice)
812{
813 return security_ops->task_setnice(p, nice);
814}
815
816int security_task_setioprio(struct task_struct *p, int ioprio)
817{
818 return security_ops->task_setioprio(p, ioprio);
819}
820
821int security_task_getioprio(struct task_struct *p)
822{
823 return security_ops->task_getioprio(p);
824}
825
826int security_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
827{
828 return security_ops->task_setrlimit(resource, new_rlim);
829}
830
831int security_task_setscheduler(struct task_struct *p,
832 int policy, struct sched_param *lp)
833{
834 return security_ops->task_setscheduler(p, policy, lp);
835}
836
837int security_task_getscheduler(struct task_struct *p)
838{
839 return security_ops->task_getscheduler(p);
840}
841
842int security_task_movememory(struct task_struct *p)
843{
844 return security_ops->task_movememory(p);
845}
846
847int security_task_kill(struct task_struct *p, struct siginfo *info,
848 int sig, u32 secid)
849{
850 return security_ops->task_kill(p, info, sig, secid);
851}
852
853int security_task_wait(struct task_struct *p)
854{
855 return security_ops->task_wait(p);
856}
857
858int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
d84f4f99 859 unsigned long arg4, unsigned long arg5)
20510f2f 860{
d84f4f99 861 return security_ops->task_prctl(option, arg2, arg3, arg4, arg5);
20510f2f
JM
862}
863
864void security_task_to_inode(struct task_struct *p, struct inode *inode)
865{
866 security_ops->task_to_inode(p, inode);
867}
868
869int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
870{
871 return security_ops->ipc_permission(ipcp, flag);
872}
873
8a076191
AD
874void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
875{
876 security_ops->ipc_getsecid(ipcp, secid);
877}
878
20510f2f
JM
879int security_msg_msg_alloc(struct msg_msg *msg)
880{
881 return security_ops->msg_msg_alloc_security(msg);
882}
883
884void security_msg_msg_free(struct msg_msg *msg)
885{
886 security_ops->msg_msg_free_security(msg);
887}
888
889int security_msg_queue_alloc(struct msg_queue *msq)
890{
891 return security_ops->msg_queue_alloc_security(msq);
892}
893
894void security_msg_queue_free(struct msg_queue *msq)
895{
896 security_ops->msg_queue_free_security(msq);
897}
898
899int security_msg_queue_associate(struct msg_queue *msq, int msqflg)
900{
901 return security_ops->msg_queue_associate(msq, msqflg);
902}
903
904int security_msg_queue_msgctl(struct msg_queue *msq, int cmd)
905{
906 return security_ops->msg_queue_msgctl(msq, cmd);
907}
908
909int security_msg_queue_msgsnd(struct msg_queue *msq,
910 struct msg_msg *msg, int msqflg)
911{
912 return security_ops->msg_queue_msgsnd(msq, msg, msqflg);
913}
914
915int security_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
916 struct task_struct *target, long type, int mode)
917{
918 return security_ops->msg_queue_msgrcv(msq, msg, target, type, mode);
919}
920
921int security_shm_alloc(struct shmid_kernel *shp)
922{
923 return security_ops->shm_alloc_security(shp);
924}
925
926void security_shm_free(struct shmid_kernel *shp)
927{
928 security_ops->shm_free_security(shp);
929}
930
931int security_shm_associate(struct shmid_kernel *shp, int shmflg)
932{
933 return security_ops->shm_associate(shp, shmflg);
934}
935
936int security_shm_shmctl(struct shmid_kernel *shp, int cmd)
937{
938 return security_ops->shm_shmctl(shp, cmd);
939}
940
941int security_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, int shmflg)
942{
943 return security_ops->shm_shmat(shp, shmaddr, shmflg);
944}
945
946int security_sem_alloc(struct sem_array *sma)
947{
948 return security_ops->sem_alloc_security(sma);
949}
950
951void security_sem_free(struct sem_array *sma)
952{
953 security_ops->sem_free_security(sma);
954}
955
956int security_sem_associate(struct sem_array *sma, int semflg)
957{
958 return security_ops->sem_associate(sma, semflg);
959}
960
961int security_sem_semctl(struct sem_array *sma, int cmd)
962{
963 return security_ops->sem_semctl(sma, cmd);
964}
965
966int security_sem_semop(struct sem_array *sma, struct sembuf *sops,
967 unsigned nsops, int alter)
968{
969 return security_ops->sem_semop(sma, sops, nsops, alter);
970}
971
972void security_d_instantiate(struct dentry *dentry, struct inode *inode)
973{
974 if (unlikely(inode && IS_PRIVATE(inode)))
975 return;
976 security_ops->d_instantiate(dentry, inode);
977}
978EXPORT_SYMBOL(security_d_instantiate);
979
980int security_getprocattr(struct task_struct *p, char *name, char **value)
981{
982 return security_ops->getprocattr(p, name, value);
983}
984
985int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size)
986{
987 return security_ops->setprocattr(p, name, value, size);
988}
989
990int security_netlink_send(struct sock *sk, struct sk_buff *skb)
991{
992 return security_ops->netlink_send(sk, skb);
993}
20510f2f
JM
994
995int security_netlink_recv(struct sk_buff *skb, int cap)
996{
997 return security_ops->netlink_recv(skb, cap);
998}
999EXPORT_SYMBOL(security_netlink_recv);
1000
1001int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
1002{
1003 return security_ops->secid_to_secctx(secid, secdata, seclen);
1004}
1005EXPORT_SYMBOL(security_secid_to_secctx);
1006
7bf570dc 1007int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
63cb3449
DH
1008{
1009 return security_ops->secctx_to_secid(secdata, seclen, secid);
1010}
1011EXPORT_SYMBOL(security_secctx_to_secid);
1012
20510f2f
JM
1013void security_release_secctx(char *secdata, u32 seclen)
1014{
65fc7668 1015 security_ops->release_secctx(secdata, seclen);
20510f2f
JM
1016}
1017EXPORT_SYMBOL(security_release_secctx);
1018
1ee65e37
DQ
1019int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
1020{
1021 return security_ops->inode_notifysecctx(inode, ctx, ctxlen);
1022}
1023EXPORT_SYMBOL(security_inode_notifysecctx);
1024
1025int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
1026{
1027 return security_ops->inode_setsecctx(dentry, ctx, ctxlen);
1028}
1029EXPORT_SYMBOL(security_inode_setsecctx);
1030
1031int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
1032{
1033 return security_ops->inode_getsecctx(inode, ctx, ctxlen);
1034}
1035EXPORT_SYMBOL(security_inode_getsecctx);
1036
20510f2f
JM
1037#ifdef CONFIG_SECURITY_NETWORK
1038
1039int security_unix_stream_connect(struct socket *sock, struct socket *other,
1040 struct sock *newsk)
1041{
1042 return security_ops->unix_stream_connect(sock, other, newsk);
1043}
1044EXPORT_SYMBOL(security_unix_stream_connect);
1045
1046int security_unix_may_send(struct socket *sock, struct socket *other)
1047{
1048 return security_ops->unix_may_send(sock, other);
1049}
1050EXPORT_SYMBOL(security_unix_may_send);
1051
1052int security_socket_create(int family, int type, int protocol, int kern)
1053{
1054 return security_ops->socket_create(family, type, protocol, kern);
1055}
1056
1057int security_socket_post_create(struct socket *sock, int family,
1058 int type, int protocol, int kern)
1059{
1060 return security_ops->socket_post_create(sock, family, type,
1061 protocol, kern);
1062}
1063
1064int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
1065{
1066 return security_ops->socket_bind(sock, address, addrlen);
1067}
1068
1069int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
1070{
1071 return security_ops->socket_connect(sock, address, addrlen);
1072}
1073
1074int security_socket_listen(struct socket *sock, int backlog)
1075{
1076 return security_ops->socket_listen(sock, backlog);
1077}
1078
1079int security_socket_accept(struct socket *sock, struct socket *newsock)
1080{
1081 return security_ops->socket_accept(sock, newsock);
1082}
1083
20510f2f
JM
1084int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size)
1085{
1086 return security_ops->socket_sendmsg(sock, msg, size);
1087}
1088
1089int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,
1090 int size, int flags)
1091{
1092 return security_ops->socket_recvmsg(sock, msg, size, flags);
1093}
1094
1095int security_socket_getsockname(struct socket *sock)
1096{
1097 return security_ops->socket_getsockname(sock);
1098}
1099
1100int security_socket_getpeername(struct socket *sock)
1101{
1102 return security_ops->socket_getpeername(sock);
1103}
1104
1105int security_socket_getsockopt(struct socket *sock, int level, int optname)
1106{
1107 return security_ops->socket_getsockopt(sock, level, optname);
1108}
1109
1110int security_socket_setsockopt(struct socket *sock, int level, int optname)
1111{
1112 return security_ops->socket_setsockopt(sock, level, optname);
1113}
1114
1115int security_socket_shutdown(struct socket *sock, int how)
1116{
1117 return security_ops->socket_shutdown(sock, how);
1118}
1119
1120int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
1121{
1122 return security_ops->socket_sock_rcv_skb(sk, skb);
1123}
1124EXPORT_SYMBOL(security_sock_rcv_skb);
1125
1126int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
1127 int __user *optlen, unsigned len)
1128{
1129 return security_ops->socket_getpeersec_stream(sock, optval, optlen, len);
1130}
1131
1132int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
1133{
1134 return security_ops->socket_getpeersec_dgram(sock, skb, secid);
1135}
1136EXPORT_SYMBOL(security_socket_getpeersec_dgram);
1137
1138int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
1139{
1140 return security_ops->sk_alloc_security(sk, family, priority);
1141}
1142
1143void security_sk_free(struct sock *sk)
1144{
65fc7668 1145 security_ops->sk_free_security(sk);
20510f2f
JM
1146}
1147
1148void security_sk_clone(const struct sock *sk, struct sock *newsk)
1149{
65fc7668 1150 security_ops->sk_clone_security(sk, newsk);
20510f2f
JM
1151}
1152
1153void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
1154{
1155 security_ops->sk_getsecid(sk, &fl->secid);
1156}
1157EXPORT_SYMBOL(security_sk_classify_flow);
1158
1159void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
1160{
1161 security_ops->req_classify_flow(req, fl);
1162}
1163EXPORT_SYMBOL(security_req_classify_flow);
1164
1165void security_sock_graft(struct sock *sk, struct socket *parent)
1166{
1167 security_ops->sock_graft(sk, parent);
1168}
1169EXPORT_SYMBOL(security_sock_graft);
1170
1171int security_inet_conn_request(struct sock *sk,
1172 struct sk_buff *skb, struct request_sock *req)
1173{
1174 return security_ops->inet_conn_request(sk, skb, req);
1175}
1176EXPORT_SYMBOL(security_inet_conn_request);
1177
1178void security_inet_csk_clone(struct sock *newsk,
1179 const struct request_sock *req)
1180{
1181 security_ops->inet_csk_clone(newsk, req);
1182}
1183
1184void security_inet_conn_established(struct sock *sk,
1185 struct sk_buff *skb)
1186{
1187 security_ops->inet_conn_established(sk, skb);
1188}
1189
2b980dbd
PM
1190int security_tun_dev_create(void)
1191{
1192 return security_ops->tun_dev_create();
1193}
1194EXPORT_SYMBOL(security_tun_dev_create);
1195
1196void security_tun_dev_post_create(struct sock *sk)
1197{
1198 return security_ops->tun_dev_post_create(sk);
1199}
1200EXPORT_SYMBOL(security_tun_dev_post_create);
1201
1202int security_tun_dev_attach(struct sock *sk)
1203{
1204 return security_ops->tun_dev_attach(sk);
1205}
1206EXPORT_SYMBOL(security_tun_dev_attach);
1207
20510f2f
JM
1208#endif /* CONFIG_SECURITY_NETWORK */
1209
1210#ifdef CONFIG_SECURITY_NETWORK_XFRM
1211
03e1ad7b 1212int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx)
20510f2f 1213{
03e1ad7b 1214 return security_ops->xfrm_policy_alloc_security(ctxp, sec_ctx);
20510f2f
JM
1215}
1216EXPORT_SYMBOL(security_xfrm_policy_alloc);
1217
03e1ad7b
PM
1218int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
1219 struct xfrm_sec_ctx **new_ctxp)
20510f2f 1220{
03e1ad7b 1221 return security_ops->xfrm_policy_clone_security(old_ctx, new_ctxp);
20510f2f
JM
1222}
1223
03e1ad7b 1224void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
20510f2f 1225{
03e1ad7b 1226 security_ops->xfrm_policy_free_security(ctx);
20510f2f
JM
1227}
1228EXPORT_SYMBOL(security_xfrm_policy_free);
1229
03e1ad7b 1230int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
20510f2f 1231{
03e1ad7b 1232 return security_ops->xfrm_policy_delete_security(ctx);
20510f2f
JM
1233}
1234
1235int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx)
1236{
1237 return security_ops->xfrm_state_alloc_security(x, sec_ctx, 0);
1238}
1239EXPORT_SYMBOL(security_xfrm_state_alloc);
1240
1241int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
1242 struct xfrm_sec_ctx *polsec, u32 secid)
1243{
1244 if (!polsec)
1245 return 0;
1246 /*
1247 * We want the context to be taken from secid which is usually
1248 * from the sock.
1249 */
1250 return security_ops->xfrm_state_alloc_security(x, NULL, secid);
1251}
1252
1253int security_xfrm_state_delete(struct xfrm_state *x)
1254{
1255 return security_ops->xfrm_state_delete_security(x);
1256}
1257EXPORT_SYMBOL(security_xfrm_state_delete);
1258
1259void security_xfrm_state_free(struct xfrm_state *x)
1260{
1261 security_ops->xfrm_state_free_security(x);
1262}
1263
03e1ad7b 1264int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
20510f2f 1265{
03e1ad7b 1266 return security_ops->xfrm_policy_lookup(ctx, fl_secid, dir);
20510f2f
JM
1267}
1268
1269int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
1270 struct xfrm_policy *xp, struct flowi *fl)
1271{
1272 return security_ops->xfrm_state_pol_flow_match(x, xp, fl);
1273}
1274
1275int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
1276{
1277 return security_ops->xfrm_decode_session(skb, secid, 1);
1278}
1279
1280void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)
1281{
1282 int rc = security_ops->xfrm_decode_session(skb, &fl->secid, 0);
1283
1284 BUG_ON(rc);
1285}
1286EXPORT_SYMBOL(security_skb_classify_flow);
1287
1288#endif /* CONFIG_SECURITY_NETWORK_XFRM */
1289
1290#ifdef CONFIG_KEYS
1291
d84f4f99
DH
1292int security_key_alloc(struct key *key, const struct cred *cred,
1293 unsigned long flags)
20510f2f 1294{
d84f4f99 1295 return security_ops->key_alloc(key, cred, flags);
20510f2f
JM
1296}
1297
1298void security_key_free(struct key *key)
1299{
1300 security_ops->key_free(key);
1301}
1302
1303int security_key_permission(key_ref_t key_ref,
d84f4f99 1304 const struct cred *cred, key_perm_t perm)
20510f2f 1305{
d84f4f99 1306 return security_ops->key_permission(key_ref, cred, perm);
20510f2f
JM
1307}
1308
70a5bb72
DH
1309int security_key_getsecurity(struct key *key, char **_buffer)
1310{
1311 return security_ops->key_getsecurity(key, _buffer);
1312}
1313
ee18d64c
DH
1314int security_key_session_to_parent(const struct cred *cred,
1315 const struct cred *parent_cred,
1316 struct key *key)
1317{
1318 return security_ops->key_session_to_parent(cred, parent_cred, key);
1319}
1320
20510f2f 1321#endif /* CONFIG_KEYS */
03d37d25
AD
1322
1323#ifdef CONFIG_AUDIT
1324
1325int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule)
1326{
1327 return security_ops->audit_rule_init(field, op, rulestr, lsmrule);
1328}
1329
1330int security_audit_rule_known(struct audit_krule *krule)
1331{
1332 return security_ops->audit_rule_known(krule);
1333}
1334
1335void security_audit_rule_free(void *lsmrule)
1336{
1337 security_ops->audit_rule_free(lsmrule);
1338}
1339
1340int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule,
1341 struct audit_context *actx)
1342{
1343 return security_ops->audit_rule_match(secid, field, op, lsmrule, actx);
1344}
1345
1346#endif /* CONFIG_AUDIT */